TECHNICAL MANAGEMENT

¶a. Risk Management Issues

¶Issue

¶There a coordinated and effective risk management program in the NSTS?

¶Findings

NASA does not explicitly use a centralized program that coordinates all the factors that encompass an adequate risk management program.
As a result of the accident, NASA is reexamining the Failure Modes and Effects Analyses (FMEA) and Hazard Analyses (HA) to reassess risks associated with the designs of Shuttle subsystems.
NASA's lack of statistical data on the performance of certain components will limit the usefulness of sound engineering judgment in much the same way as it limits the usefulness of probabilistic risk assessment. Recomnenda tions
NASA should develop and provide to the Committee a description of an overall risk management program as it relates to the Space Shuttle. This effort should include a determination of whether or not a more centralized coordination of a risk management program and issuance of direct risk management guidance directives are needed.
NASA should review analytical methods utilized in the performance of risk assessment, including statistical analyses, trend analyses and probabilistic risk assessment methodologies to determine their applicability to the NSTS program. Assistance from the National Academy of Sciences, or other appropriate organizations with expertise in these matters, may be required to adequately perform this review.
NASA should review its certification testing to ensure that all critical items are adequately tested. Data obtained from these tests should be used when appropriate in conducting a formal risk assessment. Discussion

¶NASA does not have a specifically labeled risk management program. The process is accomplished by the agency through its configuration management program and the FMEA performed on each component of the Space Shuttle. The identification of critical items is the principal product of these analyses. The ability to make the programmatic or engineering changes necessary to enhance the safety and performance of flight systems while controlling costs and schedule is the task of the risk management activity.

139

¶The process of risk management as applied to systems such as the Shuttle can be described schematically as shown in Figure VI- 3,123which shows the various steps that might be imposed upon flight systems such as the Shuttle through a risk management program.

¶123Douglas B. Feaver, "Succeea Relaxed NASA's Vigilence", Washington Post, May 26, 1986, pp. A-1, A-10.

140

¶VIGi

141

¶Top NASA managers lack a clear understanding of risk management. Dr. Fletcher, NASA's Administrator, made the following statement, when asked by Mrs. Lloyd to "describe the elements of NASA's risk management activities . . .":

Well, risk management is a pretty generic term. Risk management is decided in Headquarters in terms of what are the chances of an overall failure of a system under a given set of circumstances. When you get down to the flight team, the launch crew in those last several hours or couple of days, risk management is an entirely different thing. They have to look at the factors that have come up just before launch and assess whether this is a risk we want to take. This is a judgement question; you can't make calculations at this point.124

¶Dr. Silveira, NASA's Chief Engineer, testified on the same day that,

As we had mentioned in the testimony that we gave previously . . ., the only time that we had gone into trying to assess a probability, if you will, or a risk, was as a result of a request that was made by DOE for their analysis that they were performing at that time, to assess the probability of failure of the vehicle, to assess the danger when we are flying the RTG's, the radioactive material. As far as in our program, and any major decisions that we would make, we have a number of reasons why our past history had indicated that that was not a good way of doing it. As a result, we don't use it generally in our risk management, we prefer using things like the failure effects and analysis that we do; the technical engineering judgement, using things to control our failures rather than depending upon a probability analysis to assess it.²² Rogers Commission Report, Volume I, p. 199. 5

¶However, Mr. Robert Thompson, who was Shuttle Program Manager from 1970 to 1972, testified on July 24th before the Committee in a much less ambiguous fashion regarding his view on the importance of risk management:

I would first like to make an observation on the decisionmaking process. Evidence, in retrospect, points to a long period of time, especially based on post-flight inspections when the joint design weakness was 'sending a message' and the true potential of this message was not perceived and reacted to. This, combined with perlaunch discussions between Marshall and Thiokol, points out the need that must pervade the Shuttle management team in the future. A very strong risk management . . . I have parentheses around risk management. I will be happy to expand on that. It has a certain meaning to me. A very strong risk management organization must be kept in place and a continuing search for potential failures must be maintained. . . .

¶124 Cmt Hgs, Transcript, June 12, 1986, p. 186. 125 Ibid. p. 187.

142

The role of the program manager in this risk management organization must be very strong and clear. The entire program organization from top to bottom must be clearly chartered and as people come and go these organizational relationships must be carefully maintained.²² Rogers Commission Report, Volume I, p. 199. 6

¶Based upon the divergences of these testimonies, the Committee concluded that although NASA's Space Transportation System program contains the elements of a risk management program, there needs to be a new and heightened coordination of the separate activities by NASA in order to minimize the risks inherent in Shuttle flights.

¶The FMEAs determine the worst case "What if' scenarios for all possible failure modes and their potential worst case or intended effects.127 As a result of performing the FMEA, a list of critical items is identified. NASA's FMEA assure that all Criticality 1 and 1R systems are properly identified and classified. The failure of these items would produce loss of life and/or loss of vehicle. The FMEA applies strictly to the hardware associated with the NSTS and is "bottoms-up" analysis, in which a single component failure is traced and its effect on a particular subsystem, subsystem interfaces, and the overall flight systems is determined. Accompanying the FMEA is the Hazard Analyses (HA) which is, according to NASA, a "top-down" approach that takes into account human factors in evaluating the consequences of particular accidents or accident scenarios. Hazard Analysis is the basic tool of the safety evaluation.

¶The FMEA as used by NASA assigns no probability numbers to event sequences along a given failure path. Although NASA re- gards the methodology of FMEA as rigorous, within the agency there was a wide variation in the engineering judgments among the design engineers and senior management in the NSTS program on the probability of failure of the Shuttle.128The Committee, in hearings held earlier this year related to the safety aspects of the Shuttle Centaur in its utilization of Radioisotope Thermoelectric Generators on board the Shuttle spacecraft, also found wide discrepancies in the estimate of the failure probability for the Solid Rocket Booster among the experts. 129

¶NASA has rejected the use of probability on the basis that such techniques are insufficient to assure that adequate safety margins can be applied to protect the lives of the crew. They also argue that their problem correction procedures preclude the establishment of a sufficient statistical database, because once a single point failure has been identified through the FMEA, steps are taken to design bid., July 24, 1986, p. 106.

¶12' It is the prime responsibility of the design engineers working with reliability analysts to nerform the FMEA in accordance with guidelines established in NASA documents (Apuendix b1-0. These documents are provided as part of each statement of work submitted to the contractor. From such FMEAs, a Critical Items List is established in which particular components under the responsibility of the contractor are categorized in accordance with their criticality to the mission, crew, and/or spacecraft. Included as Appendix VI-D is NASA's document 100-2G entitled Reliability Desk Instruction, Flight Hardware Failure Mode and Effects Analyses (FMEA) and Critical Items List (CIL).

¶Rogers Commlsslon Report, Volume 11, p. F-4.¹¹ For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. 2 9 Hearine before Subcommittee on Energy Research and Production and Subcommittee on Space-&ien& and Applications of the Committee on Science and Technology, 99th Gong., 2nd Sew., March 4, 1986 (No. 97). "Review of RTG Utilization in Space Missions."

143

¶the safety features into the component, thereby eliminating the failure mode or establishing sufficient redundancy to preclude catastrophic failures associated with the particular component. This change of the component means that earlier data no longer apply.

¶On the other hand, with respect to certification testing of the Space Shuttle Main Engine, NASA seems to argue that a useful statistical data base can be generated even though the configuration of the engine is changed as data is accumulated. That is, as running time is accumulated in SSME certification testing, major components-e.g., the high pressure turbopumps-are replaced, and yet NASA seems to believe that the total accumulated running time has some meaning for determining engine life time. l30

¶All subsystems of the NSTS are intended to meet design requirements that incorporate the fail-safe features as a minimum with fail-operationaVfai1-safecriteria placed on all Orbiter avionics systems. Fail-safe requirements are defined as designs which can withstand a single failure and permit return of the crew to the ground safely. Fail-operational/fail-safeis defined as permitting two sequential failures while enabling crew return. There are some parts of the NSTS which must be exempted from meeting these criteria. The reason is that it is not possible to improve the safety features of these systems through redundancy or other means. Such systems are the primary structure, the thermal protection system, pressure vessels and the premature firing mode of the pyrotech- nics. For example, the pressure vessel cannot be provided with redundancy in a safe manner because addition of another pressure vessel would only enhance the failure probability or the criticality of this component.

¶The FMEA is a very conservative analysis according to NASA since it provides information on worst case situations of all possible failure modes and the potential worst case effects. Even so, the Committee was unable to determine the degree to which flight anomalies and trend analyses in historical performance data are utilized to insure that the appropriate measures are taken in the design and testing of various critical components to assure ultimate safety and minimization of risk.

¶NASA is presently reviewing the 748 Criticality 1 items and the 1,621 Criticality 1R items. Based upon a series of tests and analyses and the availability of methods and instrumentation to detect problems associated with various Criticality 1 and 1R items, waivers are given to permit flight of critical items. Before a waiver is granted, according to NASA, extensive documentation and review of each item on the Critical Items List (CIL) for which a waiver has been applied must be undertaken and approved all the way through Level 1 management. There is a difference between the number of waivers granted and the total number of items on the Critical Items List. For Criticality-1 items this difference reflects the number of systems exempted from the criteria of fail-safe or fail-operational/fail-safe.NASA, however, does not distinguish in its quality control procedure between exempted items and those items which are not exempt from the waiver process. According to 130 Rogers Commission Report, Volume 11, pp. K25-26

¶NASA Briefing on July 10, 1986.

144

¶NASA, this categorization of exempt versus waiver is strictly a management technique for identifying components and systems on the Space Shuttle in terms of their safety compatibility.

¶The Committee finds the FMEA to be a n appropriate method for identifying the Critical 1 and 1R elements of the NSTS; however, not all the elements so identified pose a n equal threat. Without some means of estimating the probability of failure of the various elements it is not clear how NASA can focus its attention and resources as effectively as possible on the most critical systems. Moreover, waivers can be granted without assurance that a n adequate level of safety has been achieved.

¶b. Launch Decision Process

¶Issue 1

¶Is the process for establishing launch constraints and dealing with them effective?

¶Findings

There is no clear understanding or agreement among the various levels of NASA management as to what constitutes a launch constraint or the process for imposing and waiving constraints.
Launch constraints were often waived after developing a rationale for accepting the problem rather than correcting the problem; moreover, this rationale was not always based on sound engineering or scientific principles.

¶Recommendations

NASA should establish rigorous procedures for identifying and documenting launch constraints, The individual(s1 responsible for implementing this procedure should be clearly identified, and well defined and understood criteria for waiving the constraints should be established.
NASA should exercise extreme caution in waiving launch constraints before correcting the problem that led to the launch constraint. The rationale should be based on rigorous scientifidengi- neering analyses or tests and should be understood and accepted by the Program Manager. Discussion

¶No single system exists for establishing and dealing with launch constraints within the Shuttle Program; for example, Marshall maintains their own system through their Problem Assessment Center (PAC) to deal with problems affecting the propulsion system. In testimony before the Rogers Commission, Mr. Mulloy explained that the system was established to provide visability for problems relating to the propulsion system and a "launch constraint" was in effect a flag to alert the Project Office to address the problem at the Flight Readiness Review.

¶A launch constraint means that we have to address the observations, see if we have seen anything on the previous flight that changes our previous rationale, and address that at the Flight Readiness Review. 132

145

¶The NSTS Program Manager stated that he was unaware that a launch constraint had been imposed as a result of the O-ring erosion. Unawareness of this launch constraint was also claimed by the Level I Program Office and key Thiokol personnel: Mssrs. Ebeling, Kilminster, Russell, McDonald, and Boisjoly.³³³³ Rogers Commission Report, Volume V, p. 784. a* bid., Chart 130 (p. H-66).

¶In staff briefings, it was suggested by NASA personnel that perhaps "launch constraint" was a poor choice of words to describe this process for flagging problems. Those individuals who claimed no knowledge of a launch constraint had certainly been made aware of the O-ring erosion problem. This problem and the resolution had been discussed throughout the system including the FRRs. Therefore, although it is difficult to understand why the Program Manager and others weren't more familiar with the Marshall PAS, as a practical matter it probably had little effect on the final decisions. These "launch constraints" were potential problems that had to be resolved prior to flight and the Level 111 Project Managers were responsible for resolving any problems dealing with their systems. During the Rogers Commission hearings, Mr. Mulloy acknowledged that he had ultimate responsibility for waivifig the launch constraints and ultimate responsibility for the launch readiness of the Solid Rocket Boosters.

¶Although the O-ring erosion continued to occur, and with no apparent pattern, the SRB Project Manager repeatedly waived the launch constraint. Throughout the Rogers Commission hearings and the hearings of the Committee on Science and Technology, NASA witnesses continually justified their decision to continue flying the Shuttle based on their previous successful flights. This reliance on their "experience base" was a major factor in the repeated waivers of the Marshall imposed launch constraint on the SRBs. Chairman Rogers asked Mr. Mulloy what was meant by "addressing" the problem, and Mr. Mulloy responded:

I mean present the data as to whether or not what we have seen in our most recent observation, which may not be the last flight, it may be the flight before that, is within our experience base and whether or not the previous analyses and tests that previously concluded that was a n acceptable situation is still valid, based upon later observations.³³ NASA, "Report to the President Actions to Implement the Recommendations of the Presi- dential Commission on the Space Shuttle Challenger Accident," July 14, 1986. (Hereafter r e ferred to as NASA Response to Rogers Commission.) 4

¶Mr. Mulloy also explained his reliance on the experience base in testimony before the Science and Technology Committee:

That was presented to me as a rationale to continue flying, one we had seen it on STS-2, what we saw on the last flight wasn't as bad, therefore it was a n acceptable risk.

¶l n 2 Rogers Commission Report, Volume V, p. 1513.¹¹ For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. 3 3 Ibid., p. 1590; note: Yet it was Mr. McDonald who wrote a letter to the SRB Project Office recommending that the O-ring problem be dropped from the Problem Assessment System (PAS), which was in fact equivalent to removing the launch constraint.

¶L 3 4 Rogers Commission Report, Volume V, p. 1513.¹¹ For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. 3 5 Cmte Hgs, Transcript, June 17, 1986, p. 151.

146

¶The Committee concurs with Dr. Feynman's analysis that NASA had no understanding of the O-ring erosion phenomenon, and their rationale for accepting it was not based on sound engineering principles.

. . . The acceptance and success of these flights is taken as evidence of safety. But erosion and blow-by are not what the design expected. They are warnings that something is wrong. . . . The fact that this danger did not lead to a catastrophe before is no guarantee that it will not the next time, unless it is completely understood. . . . The origin and consequences of the erosion and blow-by were not understood . . . officials behaved as if they understood it, giving apparently logical arguments to each other often depending on the "success" of previous flights. 36

¶Issue 2

¶Are the launch commit criteria procedures adequate to ensure the safety of the mission?

¶Findings

The procedure used for developing launch commit criteria is systematic and thorough; however, violations of the criteria do not necessarily mean "no go". Therefore, NASA sometimes relied on engineering judgments made during the terminal countdown in determining whether to launch.
Launch commit criteria were sometimes waived without adequate engineering analysis or understanding of the technical reasons for establishing the criteria.

¶Recommendations

NASA should review the launch commit criteria procedures, especially those for dealing with violations, to lessen the reliance on engineering judgments under str::s.
When situations arise where real time" engineering judgments are unavoidable, NASA should adopt a more conservative approach to waiving previously established criteria. In no case should a criterion be waived without a thorough understanding of the rationale for the establishment of the criterion. Discussion

¶Launch commit criteria define limits on specific system parameters which are required to be monitored during the terminal countdown. When these limits are exceeded the launch is held until the condition is corrected or a n acceptable alternate capability or procedure is instituted.

¶Proposed criteria are developed by NASA and contractor personnel and are submitted to the NSTS Program Office for review and disposition. All changes are controlled by the Level I1 PRCB (Program Requirements Change Board) and all launch commit criteria are reviewed prior to each flight a t the launch site flow review (8 weeks prior to launch), the Flight Readiness Review and the L-1

¶Rogers Commission Report, Volume 11, p. F-1.

147

¶review. Where practical Launch Commit Criteria include preplanned decisions on courses of action to be taken when violations occur.

¶The process described for developing and controlling the launch commit criteria is systematic and thorough; however, in briefings by NASA personnel it was learned that it is not uncommon to experience violations of the specified limits. These can often be resolved in a straight forward manner based on a prior plan of action; however, the Committee is concerned that in those situations where no preplanned course of action is available, real time engineering decisions are being made under the stress that is inherent in a pre-launch environment. This is particularly undesirable when it is perceived that there are pressures to launch.

¶For example, it was learned that on the morning of the scheduled launch of STS 51-L the Mission Evaluation Room (MER) Manager requested a waiver of the Launch Commit Criteria lower limit of 31 degrees F.13' The Flight Director can not unilaterally waive launch commit criteria and since the temperature at launch was above 31 degrees it became unnecessary to pursue the matter further. Had it been necessary to waive the criterion, the Flight Director would have advised the Program Manager who then would have orally polled the Project Managers before making the final decision. One can only conjecture at this point what the decision would have been; however, the Committee is concerned that at least two key managers in the decision making chain (i.e. the MER Manager and the Flight Director) were prepared to waive the criterion without thoroughly understanding it.

¶Issue 3

¶Are the launch readiness review procedures and communications adequate?

¶Finding

¶The Committee finds that the review procedures and communications used to assure flight readiness were systematic, thorough, and comprehensive and provided ample opportunity for surfacing hardware problems prior to flight. Level I FRRs are usually recorded (audio); however, there is often no record made of other key prelaunch meetings.

¶Recommendation

¶NASA should make every reasonable effort to record meetings where key decisions might be made; in particular, all formal Flight Readiness Reviews, including the L-1 and the Mission Management Team meeting should be recorded, where feasible by video. Discussion

¶The Flight Readiness Review process encompasses a series of reviews beginning with contractor reviews of their systems, and going through the Project Management review (Level III), and NSTS Program Management review (the "Pre-FRR'), and culmi-

¶Rogers Commission Report, Volume 11, pp. 522-23.

148

¶nating in the Level I (Headquarters) review which is referred to as "the" FRR. One additional formal review takes place 24 hours before launch and is called the "L-1" review. This is conducted by the Mission Management Team (MMT) which is appointed by the Associate Administrator for Space Flight at the time he calls for the FRR. All open work and action items identified at the FRR are closed out at the L-1. In addition to conducting the L-1 review, the MMT functions as a technical advisory body for the Program Manager and is on call beginning 48 hours before the launch until after the mission is completed and the Orbiter is safed.

¶The Committee concurs with the Rogers Commission that NASA should record key pre-launch meetings; however, the Committee finds no basis for concluding that the Flight Readiness Review procedure is flawed; on the contrary, the procedure appears to be exceptionally thorough and the scope of the issues that are addressed at the FRRs is sufficient to surface any problems that the contractors or NASA management deem appropriate to surface. However, the Flight Readiness Reviews are not intended to replace engineering analysis, and therefore, they cannot be expected to prevent a flight because of a design flaw that management had already determined represented an acceptable risk. In addition all the appropriate offices, including the Chief Engineer representing SR&QA, are represented at the FRRs. Specifically, from the first evidence of 0- ring erosion to the final decision to launch 51-L, the process provided ample opportunity to review and assess the severity of the problems; moreover, all levels of NASA management were made aware of the erosion.138 However, a process is only as effective as the responsible individuals make it. For example, see section VI B.2.c. on the weakness in the SR&QA organization.

¶Issue 4

¶Was the failure to inform the Level I or Level I1 Program Managers of the Teleconference involving NASA and Morton Thiokol on the eve of the launch a factor in the decision to launch?

¶Findings

The Committee finds that Marshall management used poor judgment in not informing the NSTS Program Manager or the Level I Manager of the events that took place the night before the launch, specifically the stated concerns of the Thiokol engineers. However, the Committee finds no evidence to support a suggestion that the outcome would have been any different had they been told.
The Committee finds the efforts of Thiokol engineers to post- pone the launch commendable; however, Thiokol had numerous opportunities throughout the normal flight readiness process following flight 51-C in January, 1985 to have the new minimum temperature criteria established.

¶138 Ibid., pp. H1-97

149

¶Discussion

¶The management of the Shuttle Program has given the responsibility for the Solid Rocket Boosters to the Marshall Space Flight Center. It is the Marshall Center that contracts with Thiokol for the hardware and related services pertaining to the SRBs. The NSTS Program Manager relies on the Marshall management and technical expertise for issues relating to the SRB and it is unreasonable to expect him to take technical advice from the contractor's engineers. This position is supported by the actions taken by Mr. Aldrich and Mr. Moore with regard to the Rockwell concerns over ice. 39 Unlike the SRB situation where the Thiokol managers gave a written positive recommendation for launch, the Rockwell managers refused to give an unqualified go for launch; yet Mr. Aldrich asked for and accepted the recommendations of the Orbiter Project Manager and the Directors of Engineering at JSC and KSC. The Committee finds no evidence to suggest that in the instance of the Thiokol engineers' concerns, either Mr. Aldrich or Mr. Moore would have disregarded the recommendation of the technical managers with the expertise in solid rockets (i.e. Marshall and Thiokol) and relied instead on their own assessment of the engineers' concerns.

¶Launch commit criteria and launch constraints should be established well in advance of a scheduled mission and should be based on rational, scientific and engineering arguments, including previous flight experience. Thiokol engineers based their arguments for a 53 degree temperature criteria on the fact that this was the cold- est temperature experienced to date and they had experienced severe (but not necessarily the worst) erosion on that flight. However, a test firing had been conducted at 40 degrees joint temperature which resulted in no joint problems (technicians had "tamped" the joint putty before the test, however, a procedure not used on flight hardware). Moreover, it was pointed out in the hearing that this flight had occurred a year earlier and no mention had been made of changing the temperature criteria for launch.

Mr. VOLKMER. But in all of the memorandums, et cetera, that had occurred before-in-between the time, January 1985 and January 1986, you don't specifically say that. . . . Mr. BOISJOLY. That is right, . . . It was nobody's expectation we would ever experience any cold weather to that degree before we had a chance to fix it again, so that basically is why it wasn't pursued any further than that from my personal standpoint.¹¹ For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. 4 0

¶That was later questioned by Mr. Nelson in remembering that flight 61-C (the flight just prior to 51-L) had been scrubbed four times for reasons unrelated to temperature when the temperatures were less than 53 degrees during several of those scrubs, reaching down into the low 40s during the first scheduled launch.

¶lS8 bid., Volume I, pp. 114-17.

¶Cmte Hgs, Transcript, June 18, 1986, pp. 83-84.

150

Mr. NELSON. . . . and so my question is, did any of these same concerns with the temperature come up in discussions during the final checks before those attempted launches? Mr. MCDONALD. I am not aware that they had, Congressman. I don't know. I wasn't at that launch, but I don't recall that that came up. l 4

¶Mr. Nelson later asked the Commander of 61-43, Cdr. Robert L. Gibson, whether he recalled any discussion among management or any of the contractors regarding the desirability of launching in 41 degree weather; Commander Gibson also recalled no special concerns regarding temperature.⁴⁴ Rogers Commission Report, Volume 11, p. H-1. 2

¶Mr. Packard also questioned Mr. McDonald about the temperature during earlier attempts to launch 51-L and asked whether in fact it had been below 53 degrees during some of those attempts. Mr. McDonald replied, "That is correct", and when asked whether temperature had been discussed at those times, Mr. McDonald said, "No, it was not . . . Nowhere was it, no." Mr. Packard also asked why, in Mr. McDonald's judgment, temperature had not been discussed in as much as the temperature was below what they believed to be safe, and Mr. McDonald answered, "I don't-I can't answer that."¹¹ For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. 4 3

¶Mr. Packard also noted the delay in evaluating the effects of temperature, quoting from Mr. Kilminster's testimony, "As launch was scheduled for early the next day, our engineers immediately commenced evaluating the available data." He asked why they waited until the night before the launch to begin even considering the whole question of O-ring resiliency and O-ring problems under cold weather conditions. Mr. Kilminster replied that this was in response to a specific request by NASA.144

¶This indicated that the concerns and recommendations of the Thiokol engineers were solicited by NASA, and in as much as they had not come forth with the recommendation for a higher minimum temperature criterion on earlier occasions when it was planned to launch at temperatures below 53 degrees, it is unlikely that this recommendation would have been made on this occasion without the specific inquiry by NASA.

¶The Committee finds no evidence that new data were presented during the January 27th teleconference that were not available to Thiokol at the time of the Flight Readiness Review. Moreover, the information presented was substantially the same as that presented at the August 19th briefing (see Section VIII) a t which time they had recommended that it was safe to fly as long as the joints were leaked checked to 200 psi, were free from contamination in the seal area and met O-ring squeeze requirements. No mention was made of a temperature constraint at that time o r anytime between then and the January 27th teleconference.

¶The Committee finds that Thiokol's advice and recommendations to NASA were inconsistent, and therefore, the arguments presented during the January 27th teleconference might not have been as persuasive at the time as they now appear to be in hindsight.

151

¶Issue 5

¶Do the principal contractors have a n appropriate role in the launch decision making process?

¶Finding

¶The principal contractors have a n active role throughout the decision making process right up to the launch; however, the look of a firm requirement for their concurrence at the time of launch does partially relieve them of responsibility for mission success.

¶Recommendation

¶Principal contractors should be required to make a clear, unam- biguous statement concerning launch readiness just prior to launch. Discussion

¶Participating contractors are required to sign off prior to launch that their flight system or facility is ready to support the flight. This is generally a one-time requirement for a given mission and although they are orally polled prior to the flight, they are not generally required to make any additional written positive commitment for a "go" prior to launch. Mr. Richard Davis, President, Martin Marietta Michoud Aerospace, explained:

Up to and including the L-minus-one-day review, there's no doubt that every company has a very strong voice; and, as a matter of fact, at the L-minus-one-day review, they

¶are required to stand up and commit their hardware as go or no-go. And those are very unequivocal commitments, also. After that time, then the reviews are more mission management meetings that are held, and as you get down into the countdown, it turns into more of a real time polling of the people that are actually controlling the launch.

¶In those latter meetings we are not, I would say, formally involved in those unless there is some problem with the hardware itself . . . We are polled by the Director of Engineering prior to the launch actually proceeding, so we are sort of polled in a n informal manner. We are not asked at any time after the L-minus-one-day for a formal go or no-go.

¶Contractors can stop the launch if they have serious reservations about the safety of the mission, and presumably they would.

¶Mr. DAVIS.. . . I have never felt that if I needed to stop a launch, I could not stop it. While I have not been asked for a positive go or no-go, the ability is always there if I decide no, to stop the launch.146

152

¶However, the present system permits them to "express concern" without actually saying, "stop the flight, it is unsafe". If the odds favor a successful flight they do not have to be responsible for can- celling, yet if the mission fails they are on record as having warned about potential dangers. (see Section V, discussion over Rockwell concerns over ice)

¶Issue 6

¶Are astronauts adequately represented in the decision making process?

¶Finding

¶The astronauts believe they currently have the opportunity to make inputs into the process and are reluctant to assume a greater responsibility for the decision to launch. Discussion

¶Considerable discussion at the hearing focused on the astronaut's interest in being more involved in the decision making, for example by attending management meetings. Capt. Young made the point that astronauts really didn't have the time to attend a lot of meetings, or the technical expertise to influence the decision.

We could certainly put people in those kinds of meetings. I am not sure they have the technical expertise to really be able to say go or not

¶With regard to the SRB seals, he pointed out that he and Captain Crippen had attended a briefing at Thiokol where it was stated that the seals weren't even necessary, and some people were complaining about having to put two seals in. And he suggested that if others in the agency had understood the problem they would have stopped the flights.

The rest of the agency, if they had been aware of this problem, we wouldn t have flown. We would have fixed it. If other people responsible in the management structure had the feeling this was a serious problem, we wouldn't have gone. We have to believe that, because there, on the Orbiter, there are 1500 criticality 1 items on the Orbiter alone, on STS-1, those items are still there, and if the management system can't make sure those things are ready to fly, we can never fly again. If you have an astronaut saying every step of the way, don't fly because of this, that or this, where they have no expertise, it would be troublesome. 14*

¶Mr. Lujan asked whether NASA should consider a new class of astronauts with specific technical expertise who would fly occasion- ally. Capt. Young suggested that this was not a good use of an astronaut's talents.

You can get real good engineers to do the same thing, a heck of a lot cheaper, and make just as good inputs. . . .

¶1*7 Ibid.,June 25, 1986,p. 42.

¶Ibid.,p. 44.

153

In the main, you like to keep astronauts around to fly spaceships because that is their talent, and that is what they want to do. . . .¹¹ For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. 4 9

¶General McDivitt concurred:

There should be a caution about putting too much responsibility on astronauts, when they don't have the time to do it. Like the flight crew commander is very busy prior to flight and does not have time to spend a lot of his time involved in reviewing engineering decisions that have already been made by very professional people. . . .l 5 0

¶In response to suggestions that the astronauts might have stopped the launch of 51-L had they been aware of the problems with the seals, Capt. Young provided an excellent analogy to illustrate his skepticism that they would have altered the decision to launch:

If an engine man comes up and says that engine is ready to fly and the turbine blades are a little cracked but we have run tests and we can show with a cracked turbine blade the engine pumps are not going to come apart and we have got to fly, would an astronaut say no, you are not going to fly until you change the turbines, for example?151

¶There was complete agreement among the astronauts who testified that the crew should be able to make inputs to the decision making process, but they all felt they now have this opportunity; they can and do attend FRRs and other meetings. However, there was a strong feeling among the astronauts that they had to rely on the expertise of the engineers and the technical competence of the managers and could not be expected to intervene in that process. They believed it was unrealistic to expect the crew to make the go or no-go decision; astronauts should not be expected to represent the principal concern for safety.

¶Major Slayton made the point that astronauts in general were willing to take more risk than management, not less.

One philosophical point that needs to be brought out here . . . is that the crew commanders and astronauts in general view things a little bit different than everybody else does to begin with and you have to recognize that and be a little bit cautious. In general a crew commander, if given a choice, is willing to take more risk than his management. That has been the case in the past and he is more likely to give you a 'go' and you need somebody at a higher level that is willing to, on his behalf, willing to take the bull by the horns and have the guts to say 'no go' on behalf of the crew.

¶Col. Hartsfield concurred: ~~~

154

I wanted to say that I feel that it is just like in our own government, the buck stops at the White House or the Congress perhaps, but somewhere, but certainly above the level of the rest of us. I think that the decison to go or "no go'' rightfully be- longs with the upper management, and not, my personal opinion, not with the crew. The crew input should be felt very strong.153 c. Technical Expertise of Personnel

¶Issue

¶Does NASA have an adequate level of in-house technical expertise to manage the Shuttle Program properly?

¶Findings

During the last decade NASA has had significant decreases in manpower. A disproportionate reduction may have occurred in the safety, reliability and quality assurance staff at NASA headquarters and at the Marshall Space Flight Center. Additionally during the period preceding the Challenger accident, the Office of Space Flight also suffered a decline in staff. The decreases may have limited the ability of those offices to perform their review functions.
The information presented to NASA headquarters on August 19, 1985 was sufficient to require immediate and concentrated efforts to remedy the joint design flaws. The fact that NASA did not take stronger action to solve this problem indicates that its top technical staff did not fully accept or understand the seriousness of the joint problem.

¶Recommendations

NASA should review the numbers and qualifications of key staff in technical and management positions and should consider additional training and recruitment of individuals to further the quality and safety of NASA's missions.
The Committee should maintain on-going oversight of this analysis and conduct an in-depth examination upon the conclusion of NASA's review. Discussion

¶In the wake of the Challenger accident, serious questions arose over whether NASA had sufficient technical capability to identify and solve problems like the SRB seal problem. It is argued that through reductions in staffing levels and departures to the private sector by experienced technical employees, NASA lacked in-house problem assessment capability. This is an issue that is not subject to ready answers, and an in-depth examination of NASA technical capacity was generally beyond the scope of the Committee's hearing.

¶However, it is clear that over the last 15 years NASA has had significant staffing reductions and that a disproportionate number of these reductions may have occurred in the areas of quality assurance and safety.⁵⁵ bid. 4 While NASA argues that its personnel levels for these functions "were adequate,' l 5 5 the Rogers Commission found:

155

Reductions in safety, reliablility and quality assurance work force at Marshall and NASA Headquarters have seriously limited capability in those vital functions.¹¹ For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. 5 6

¶Reductions were not limited to the safety and quality assurance program. The former Associate Administrator for Space Flight, Jesse Moore, testified that his office also experienced a decline in the number of staff. As Mr. Moore observed, "we need to . . . get as much technical expertise into the Office of Space Flight as we possibly can" in order to "work on a plane with the real experts- the contractors, the engineers, the safety people at the contractors and at the NASA centers. . ."¹¹ For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. 5 7

¶Similar views were voiced by former Shuttle program manager Robert Thompson:

I think we have to look pretty deep in our organization to make sure we are keeping enough technical muscle in the organization to continually search for these pending problems that are somtines pretty subtle. Sometimes they just don't, as I say, announce themselves. So you have to be willing to expend the resources and keep that technical muscle in place and you have to put that technical muscle close to the heart of the issue so that they can perceive a problem if it is just beginning to occur.'5*

¶It does not necessarily follow however, that reductions in the numbers of technical personnel automatically limit the ability of headquarters to identify and correct emerging problems. The adverse impact flows from those reductions that cut into crucial areas. Accordingly, the Committee is pleased that Admiral Truly has undertaken an examination "throughout the agency and particularly in . . . the Space Shuttle program" to make sure that 'we have not only the right numbers but the right kind of trained people ..... 1 5 9 It is hoped that this analysis will identify appropriate technical staffing levels and positions that must be maintained if the agency is to properly perform its function.

¶NASA technical expertise is further reduced by the departure of highly skilled employees. During fiscal year 1985, approximately 1500 employees left the agency, over one-half of these (784) were engineers, technicians and scientists. If present trends continue,

¶166Rogers Commission Report, Volume I, p. 161.

156

¶NASA can expect to lose between 7500 and 9000 technical and scientific employees over the next ten years. While 50 percent of these personnel losses are formally attributed to retirement, NASA officials "know. . .that many retires leave NASA for higher paying jobs in industry." 162 Additionally, 17 percent of the departing employees acknowledge that they are leaving NASA for more finan- cially rewarding jobs. 63

¶NASA is concerned that the difficulty it will experience in re- placing these employees is essentially the same that led to the departures; the agency's "salary structure is not sufficiently flexible and competitive to attract the very best talent our nation has to offer."⁶⁶ id. iNm.-The nozzle to case joint design is significantly different than the case field joint design w ich caused the Challenger accident. However, it is cited here because some of the prob- l e m are relevant to the failure of the aft field joint.] 4 Therefore, despite liberal hire authority for engineering positions, NASA is experiencing difficulty in recruiting entry-level engineers, largely due to salary. As noted by the Agency:

Currently the Government pays GS-7 recent college graduates in all engineering disciplines a special salary rate of $23,170. This is the statutory maximum under the current special salary rate provisions. At the same time, our private sector competitors are offering these graduates an average salary of $27,000 to $29,000 depending on the engineering discipline. It would take approximately a 20 percent increase for us to match our competitors. However, absent a legislative change, the most we could offer in the next year would be the percentage increase to the General Schedule (perhaps two or three percent in January 1987). A continuing infusion of recent college graduates is critical to the continued success of NASA's mission and accomplishing this has become increasingly difficult. Inadequate salaries are an equally significant problem at the executive levels in the agency.165

¶While outside witnesses did not fully concur as to the prevalence of departures for the private sector, all acknowledged the need to create incentives for qualit people to enter and remain with the agency.166 To this end, NAJA Administrator Fletcher is examining means by which his organimFn can retain its highly skilled technical employees through a more motivational type of organizational structure" and premium pay scheduled. l 6 7 The Committee shares NASA's concern that it maintain a strong in-house technical capability and support staff.

¶In addition to the number of technical managers, it is also necessary to examine their technical performance. Insight into NASA

¶18s Ibid.

¶166Cmte Hgs, Transcript, July 24, 1986, pp. 119-23 headquarters' technical ability to discern and react to emerging problems may be gained from an examination of the manner in which it addressed the growing concerns with the O-rings in the summer of 1985. Prior to that time the problems with the O-rings had been briefed at all levels of the agency and had been presented to headquarters on at least two occasions.⁶⁶ id. iNm.-The nozzle to case joint design is significantly different than the case field joint design w ich caused the Challenger accident. However, it is cited here because some of the prob- l e m are relevant to the failure of the aft field joint.] 8 However, increasing problems with case-to-case erosion prompted headquarters to request a complete briefing "to go over the situation in detail."¹¹ For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. 6 9

¶The meeting was chaired by Mr. Moore's deputy for technical matters, L. Michael Weeks, and attended by a number of other headquarters personnel which Mr. Moore characterized as having "some knowledge about the SRB."170 In testimony before the Rogers Commission, Mr. Moore described the composition of the meeting:

¶Mr. Winterhalter, who was Shuttle Propulsion Division

¶Acting Director at that time, Mr. Bill Hamby was the STS program integration Deputy Director, Mr. Paul Wetzel, who was the Solid Rocket Booster programs chief, Mr. Paul Herr, who was the Solid Rocket Motor program manager, and Mr. Henry Quong, who was the reliability, maintainability and quality assurance director of the chief engineer's office.

¶Those were the group of people at NASA headquarters who attended the meeting. Mr. Mulloy of Marshall Space

¶Flight Center, who was a Solid Rocket Booster program manager, attended and Mr. Bob Swinghammer of Marshall also attended, who is the material and processes laboratory director at Marshall. Thiokol had a total of six people lsaSee,e.g., testimony of L. Michae; Weeks, Cmte Hgs, Transcript, June 12, 1986, p. 130; Rogers Commission Report, Volume I, pp. 120-140.

¶Rogers Commission Report, Volume V, 1051, testimony of Jesse Moore. A somewhat different version of the enesis of the August 1 briefing waa presented by Allen McDonald, Thio kol's Director of Solif Rocket Motor Project, in testimony before the Rogers Commission (Bid., pp. 1591-92):

¶Mr. MCDONALD. The meeting that occurred on August 19 came about aa a result of this problem with the nozzle eroding through, and that is what drove that meeting. Headquarters wanted to hear about that. We lost the runary seal and eroded some secondary.

¶We all sat down together a n i f o t together with the engineering people and put together that presentation and collective1 sai , you know, we ought to address the whole seal issue, not Just that failure, because we alf felt that if that ever happened in the field joint we were in bad trouble because the nozzle has a much better cyondary sea! than the +Id joint does.

¶Mr. Sumn. At this meeting on August 19th a t headquarters, that was called because of Thiokol's concern that the joint was reall in trouble?

¶Mr. MCD~NALD. No,, it was cald-we had had another meeting scheduled a t Washington headquarters a t that time that had a problem with the mixer fire earlier in the year, and there was a review of that.

¶I believe Mike Weeks either called Joe or I or one of us and said well, you're here, you ought to come and address a couple of other issues that have happened recently that we are very interested in.

¶One of them is we had broken the structural test article on the filament would case I believe in July down a t Marshall, and they wanted to hear about that.

¶The other one was they were made aware that we had violated the primary seal in the nozzle and wanted to hear about that and what our rationale waa to continue.

¶See also, Cmte Hgs, Transcri t, June 17, 1986, pp. 98-101.¹¹ For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. 7 0 Cmte Hgs, Transcript, Juyy 24, 1986, p. 97.

158

there, including Mr. Mason, Mr. Wiggins, Mr. Kilminster, Mr. McDonald and Mr. Speas.171

¶The briefing documents prepared by ThiokoI included a detailed history of seal erosion which noted, inter alia, that the "frequency of O-ring damage has increased since incorporation of Randolph putty; higher stabilization pressures in leak test procedures; and high performance motors.'' The briefing documents also listed MTI's primary concerns; the highest concern was "Field joint- joint deflection and secondary O-ring resiliency."

¶It is suggested that the August 19th briefing failed to give a complete picture of the seriousness of the O-ring problem because it did not include data on the effect that temperature would have on resiliency of the seals. As Michael Weeks noted in his testimony before the Committee:

When the briefing was presented to us on August 19th of 1985-as you will look in the briefing that was provided to the Commission on February 10th-there was no temperature data presented that showed that the resiliency was such a critical factor. It wasn't until after the disaster of 51-L that I actually saw the resiliency data that showed that Viton, which is the O-ring material that we've been using, is so slow to recover at very low temperatures-lT2

¶Mr. Weeks correctly notes that the briefing documents did not include data which resulted from bench testing which concluded that resiliency is a function of temperature.

¶Other participants in the meeting felt that the temperature issue had been presented at the briefing.

General KUTYNA.Secondly, there has been some question that people understood that there was a temperature problem. I remember your conclusions chart, your file chart, and the very first bullet of that chart had the word "resiliency" in it. Do you feel when you talked about resiliency at that meeting people got the connection between resiliency and temperature, that resiliency was a function of temperature, or was that lost? Mr. MCDONALD.It may have gotten lost because we hadn't run a very long range of temperatures when we got that data. General KUTYNA.So it is possible that people at headquarters from that briefing did not understand temperature was a concern? Mr. MCDONALD. I guess it is possible they could have. General KUTYNA. Is it probable? Mr. MCDONALD. I don't know if it is probable, because we put it as the first bullet of why we thought that was

¶Rogers Commission Report, Volume V, pp. 1051-52.

159

our highest concern, and if that hadn't have happened, we wouldn't have had that concern.⁷⁷ bid. 4

¶The briefing recommended an "accelerated pace" to eliminate SRM seal erosion but concluded that "it is safe to continue flying existing design as long as all joints are leak checked with a 200 psig stabilization pressure, are free of contamination in the seal areas and meet O-ring squeeze requirements." Sometime thereafter, Mr. Weeks reported to Mr. Moore on the briefing, indicating that it was safe to continue the program and that it was not "an issue that ought to ground the fleet."175

¶In evaluating the information presented at the August 19, 1985, briefing, the Rogers Commission found:

The O-ring erosion history presented to Level I at NASA headquarters in August 1985 was sufficiently detailed to require corrective action prior to the next flight. l

¶The current NASA administrator concurs in the finding.'?

¶Despite the clarity of the Commission's conclusions, none of the participants at this meeting (all with technical backgrounds)- NASA or Thiokol-recommended that the Shuttle be grounded until the problem with the seals was solved.178Rather, as noted above, the unanimous recommendation was to accelerate the efforts to fix the problem but continue flying. In adopting this course, did NASA take steps to seek a solution that was reasonably commensurate with a threatened failure of a criticality 1 item? Mr. 174 Rogers Commission Report, Volume V, pp. 1595-96.

¶Ibid., p. 1052. See also, Cmte Hgs, Transcript, June 12, 1986, pp. 143-44, and July 24, 1986,

A conflict in the testimony arose on the question of the briefing Mr. Weeks provided Mr. boore following the August 19th meeting. Accordin to the testimony resented by Mr. Weeks, "I briefed on the results of that [meeting] and told t i m about the brieing and showed him the briefing [documents]." Ibid., June 12, 1986, p. 143. Mr. Moore disagreed with this recitation of the facts (Ibid., July 24, 1986, pp. 89-91):

¶Mr. SCHEUER. Are you telling us that you didn't receive a briefing from Mr. Weeks and that vou didn't receive the briefing documents from Mr. Weeks that waa eiven to headauarters bv

¶I I ihe Thiokol officials?

¶Mr. MOORE.To my recollection, the first time I remember seeing that document was on Aurmst-was on Januarv 29th or Januarv 30th. rieht after the Challeneer accident. I was shown a dkument which contkned the briefink materid. It also subsequently came up in one of the earlier discussions with Chairman Rogers and his Commission is the other time I have seen some of that.

¶Post-accident was the first time I had, to my knowledge, as I said, seen that particular briefing. I had not sat down and been given a briefing on the Thiokol presentation on August 19th.

¶Mr. Weeks verbally said that the meeting was held that day on August 19th and that in effect that he felt comfortable with the overall conclusions, although he did have one more concern. He felt he wanted to talk to somebody else a t Marshall and he did, I believe, talk to Mr. Hardy and said that he thought based on the data and also on the Titan success that in fact there was an acceptable position as far as he was concerned and that is where I left the information and that was the information I was given.

¶Mr. SCHEUER. He didn't indicate the kind of depth of concern that would have led you to believe that additional time was needed or that additional resources needed to apply to some of these problems before lunch?

¶Mr. MOORE.No sir. I did not get the feeling that we should have grounded the Shuttle fleet prior to the next flight as a result of that particular briefing.

¶In a subsequent interview with staff, Mr. Weeks recanted his earlier statement and acknowledged that he did not show Mr. Moore a copy of the briefing document and that to the best of his knowledge Mr. Moore did not see this document until after the Challenger accident. Moreover, Mr. Weeks stated that he did not tell Moore specifically that Morton Thiokol was calling for an accelerated pace to eliminate the seal erosion problem nor did he state that additional resources were needed to be committed to solve the problem.

¶176 Rogers Commission Report, Volume I, p. 148.

¶177 Cmte Hgs, Transcript, June 12, 1986, p. 129.¹¹ For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. 7 8 Ibid., June 17, 1986, pp. 97-8, 101.

160

¶Moore, when asked what he would have done had he received the oral briefing and reviewed the briefing document responded:

I believe that looking at the document and looking a t some of the issues that were cited about criticality 1, flight safety issues and mission success issues that came out in the series of the document there, I believe we would have initiated a formal team to go off and take a much more concentrated look at it. So I believe my actions would have been to form a team of experts to asess this data and to make recommendations on what our course of action should be at this point in time.

¶Unfortunately this team of experts was not formed until after the Challenger accident. Rather, NASA proceeded on the course summarized in the following exchange between Chairman Roe and Michael Weeks:

Mr. ROE.Therefore, there are a group of people-whom- ever they were-that participated at this particular meeting, reviewed these facts that were available, and they determined two things, according to your testimony. One, they determined that if everything-if they had their "druthers," or whatever the case may be-it would take two years in their judgment to be able to correct that; but in spite of that decision they took and made the second judgement. And the second judgement, well, we can continue to fly. We'll start the mechanisms going to get this corrected, but we can continue to fly until we get that done. Isn't that the decision that was made, according to what you're saying? Mr. WEEKS.That is correct. Mr. ROE. Therefore, some people who were at that specific meeting had to be the people who made that specific decision.

¶In attempting to assess the reasons for NASA Level 1 managers not adopting a more aggressive posture to the O-ring problem, it is suggested that insufficient information was communicated to top.¹¹ For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. 8 1 However, as Deputy Acting Administrator Graham observed:

They could have transmitted the information in a higher profile way, but also as engineers, as managers at headquarters, there was certainly a responsibility to perceive the significance of this.182

¶There was plainly a failure of NASA technical managers, and for that matter those at Thiokol, to grasp the seriousness of the problem. As former Shuttle Program Manager Robert Thompson observed:

¶'79 Ibid., July 24, 1986, pp. 91-2.

¶Ibid., June 12, 1986, p. 141.

¶181 The issue of whether communications are filtered so that important information is prevented from reaching decision-makers is addressed in Section VI.B.2.b.¹¹ For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. 8 1 Cmte Hgs,Transcript, June 17, 1986, p. 207.

161

Sometimes these problems are very subtle. Sometimes they stand up and shout louder than at other times. Frankly, this time I think it was standing up and shouting pretty loudly.183

¶Why then did top technical managers in the Office of Space Flight at NASA Headquarters (Level I), Johnson Space Flight Center (Level II), and the Marshall Space Flight Center (Level 111) fail to take stronger action? (See VI. A.1.f.) The answer may be simply poor technical decision-making, perhaps in combination with a type of collective rationalization described by Larry Mulloy:

You asked why wasn't more done. You know, in the six years previous. And I have had that question posted to me many times in the last four months, and I have asked it of myself many times since the tragic accident. And my answer has been in hindsight, obviously, more should have been done. The turning, I think we started down a road where we had a design deficiency. When we recognized that it had design deficiency, we did not fix it. Then we continued to fly with it, and rationalized why it was safe, and eventually concluded and convinced ourselves that it was an acceptable risk. That was-when we started down that road, we started down the road to eventually having the inevitable accident. I believe that.lS4 d. Change Control Process

¶Issue 1

¶Has the pressure to maintain operational flight rates and schedules for the Shuttle compromised the hardware Change Control Process?

¶Findings

When NASA declared the Space Shuttle to be an operational system, additional pressure to increase flight rates impacted other aspects of the overall program such as the ability to implement, evaluate, test, and certify changes in hardware design.
As a result of attempting to operate the Shuttle at increased flight rates, controlling other aspects of the program such as the flight production process and manifest also became a more complex and difficult aspect of program administration.

¶Recommendations

NASA must reconsider its efforts to categorize the Shuttle as an operational transportation system.
The Configuration Management System designed to control such changes must be reexamined by NASA as to its effectiveness in assuring that all hardware changes take place in a safe and reliable fashion.

¶l a 3 Ibid., July 24, 1986, p. 117. I84Ibid., June 17, 1986, pp.215-16

162

¶Discussion

¶The Rogers Commission noted that, "Following successful completion of the orbital flight test phase of the Shuttle program, the system was declared to be operational."⁸⁸ Discussions with Allan McDonald and Carver Kennedy, Thiokol (Wasatch Operations), Brigham City, Utah,, September 4, 1986. 5 The Commission found that as a result, NASA reduced its safety, reliability and quality assurance activities related to the Shuttle. The Commission report goes on to note that this reasoning was faulty; "The machinery is highly complex, and the requirements are exacting. The Space Shuttle remains a totally new system with little or no history."

¶Program officials frequently find it necessary to consider changing existing hardware designs or production processes. Such changes can be required for a number of reasons, including: to correct the deficiency in a component; to improve a component's performance or the length of this operating life; to enhance the ease of maintaining the component; or to reduce the cost of manufacturing, servicing, or processing the component. Typically, change proposals originate from a manufacturer and are reviewed by the cognizant NASA field center and frequently by the Level I1 Program Office at the Johnson Space Center as well. In his review process, NASA compares the cost and schedule impacts of the proposed change against the performance improvement that is anticipated. Of particular concern are the safety aspects related to the change (e.g., What analyses and tests must be conducted to insure that the change does not directly or indirectly have a negative impact on the systems safety or reliability?).

¶It is clear that these activities or steps in the process of implementing essential changes are complex and time consuming, especially if the components to be evaluated are some of the larger and critical elements of the Space Shuttle. Therefore, it is the Committee's view that until such time as all elements of the Space Transportation System can be fully evaluated through extensive flight testing and trend analyses, it is premature to impose an operational flight schedule on the system in a manner comparable to that imposed upon, for example, an air transportation system.

¶Issue 2

¶Is the change control process sufficiently defined for all elements of the Shuttle system?

¶Findings

The NSTS engineering and process change guidelines are, for the most part, sufficiently well-defined for the majority of the subsystems that comprise the Space Shuttle.
NASA gives the same level of scrutiny to changes involving a minor component (such as moving Velcro strips in the Orbiter) as those involving mission critical elements of flight hardware.

¶Recommendation

¶NASA should review its change control process to determine the usefulness of differentiating between minor changes and significant changes.

¶185 Rogers Commission &port, Volume I, p. 159.

163

¶Discussion

¶NASA's Change Control System is shown in Figure VI-4. From the chart, it is evident that the success of the system is highly dependent on the information flow among the various levels of management control.

1'11'111 13f i 31

I — 1

¶I 13P.31 I 1 13A31

¶I 1 1 1 13;5.31

165

¶The Configuration Management System Requirements are documented in JSC 07700 Volume 4, entitled "Configuration Management Requirements," dated March 2, 1973. Changes to this document have periodically been issued over the course of the program. The configuration management system defines requirements for all levels of management within the NSTS program. A baseline set of requirements is defined for each level of management (Level I through Level IV). This baseline establishes what is to be accomplished at each level of management and established the controlling procedures that supposedly prevent deviations from the baseline program. This baseline program is specified for each flight and includes specifications on payloads for each flight as well.

¶Changes to the flight and system requirements and the acceptance baselines are made, according to NASA, only by directives issued by the Program Requirements Control Board at Level I and Level I1 and the Change Control Boards. For example, there is an Orbiter Avionics Software Control Board (OASCB) that has joint Level I1 and Level I11 authority for managing the program-wide requirements for Shuttle computer hardware and software systems as part of the Orbiter project. The Board also assures the correct configuration of the software within the Orbiter avionics system for all vehicle and test operations.

¶Design changes at the contractor level are processed through several levels of technical and managerial reviews. Design and engineering changes on the Orbiter, for example, undergo Technical Status Reviews (TSR's), Avionics Status Reviews (ASR's), Preliminary Design Reviews (PDR's), Critical Design Reviews, (CDR's), Design Certification Reviews (DCR's), and numerous special meetings of NASA and the Rockwell management are utilized to review issues and concerns about any design drawing or specification. According to Rockwell,1s6 "Changes are reviewed at a TSR or ASR and the Change Control Board for approval. Any outstanding design dispute is tracked as an open action until it is resolved by Rockwell and NASA management."

¶The Committee questions, however, whether the complex and extensive processes involved in NASA's change control management system allow for sufficient distinction between minor changes and the significant changes. For example, the systems requires the same level of management attention to as minor a change as moving Velcro strips on the Orbiter as it is applied to all Criticality 1 item such as changing a turbo-pump on the SSME.

¶a. Management Structure

¶Issue 1

¶Does the management of the Shuttle Program adequately defi e the lines of authority and are managers given authority commensurate with their responsibilities?

¶186 Responses to Committee Questions, dated August 22, 1986.

166

¶Finding

¶The management of the Shuttle Program is complex and diversi- fied and it is not always clear who has authority or responsibility. NASA's "lead center" concept has resulted in placing the management of the program at JSC, one of three centers participating in the program; however, because Johnson does not have control of the other centers' resources, the NSTS program manager's authority to manage the program is limited and the responsibility is unclear.

¶Recommendation

¶NASA should restructure the Shuttle Program management to define clear lines of authority and responsibilities. This restructur- ing should take into account the special role each center must play and be especially sensitive to the need for the cooperation and support of all the participants to achieve a common goal. NASA should give special consideration to moving the Program Manager to NASA Headquarters to avoid the confusion and inter-center ri- valry that result from having a large multi-center program managed out of one of the participating centers. Discussion

¶The line of management responsibility, authority, and account- ability for NASA programs is from the Administrator to the Associate Administrator to the Field Center Directors, who delegate implementation authority to a program/project manager. JSC has been designated the "lead" center for the NSTS Program and has the responsibility for systems engineering and integration, operations integration, and management integration. Marshall has the responsibility for the propulsion system and Kennedy has the responsibility €or launch operations.

¶The Associate Administrator for Space Flight (the Level I program manager) performs oversight over the program but doesn't have the technical staff to effectively manage the program. The NSTS Program Manager, i.e. the Level I1 manager at JSC, functions as a program coordinator; he is responsible for integrating the various program elements and he controls all the project interfaces. He clearly does not control all the program elements since the individual (Level 111) Project Managers are accountable to their Center Directors who are in turn accountable to the Associate Administrator who controls the funding. For example, the Level I1 manager told the Rogers Commission that he was unaware that the SRB Project Office had procured additional Solid Rocket Motor casings to be used for testing of the joints;

Now it turns out that the budget for that kind of work does not come through my level I1 office. It is worked directly between the Marshall Center and NASA Headquarters and there again had I been responsible for the budget for that sort of work, it would have to come through me, . . . .187

¶'87 Rogers Commission Report, Volume V, p. 1490.

167

¶The witnesses who addressed the management issues at the Committee hearings had differing philosophies regarding the best possible solution; however there was general agreement that the present system tended to cause confusion. There was also strong sentiment for strengthening the headquarter's role. Mr. Jesse Moore, former Associate Administrator for Space Flight, testified:

I think we need to go back and make sure we clearly define the roles of NASA headquarters, the roles of the centers in the overall management of the STS. I think we need to re-look at that kind of interaction and the kind of specific roles, responsibilities, to ensure that authority and responsibility is commensurate in terms of the role definitions for the varous levels of management in NASA. I think we need to look at strengthening NASA headquarters. I would say that in my tenure a NASA headquarters we had a decline in staff in the Office of Space Flight. It was a decline in the number of staff, and I think we need to look at what is the proper level of staffing requirements to do this particular job. I also think we need to look to make sure we get as much technical expertise into the Office of Space Flight as we possibly can. 88

¶General Stafford, a former Gemini and Apollo astronaut, also stated: ". . . I guess I was never comfortable with the lead center type of management structure, after having seen how satisfactorily Apollo worked." (Note: The Apollo program was managed out of headquarters.)

¶With regard to the appropriate role of the Program Manager (Level 11),there was not a clear consensus. In discussing the Rogers Commission's recommendations, General Abrahamson stated:

. . . However, I would also like to point out that many of these recommendations have long been incorporated in NASA management procedures. The Program Manager, by definition, has the necessary authority to get the job done.19O

¶When asked if the program management should remain at JSC, Mr. Moore, who is currently Director of JSC, replied:

I think that is certainly a topic that is going to be studied very, very carefully. I think there are a couple of options that can be looked at that would keep the major parts of program management that has been in operation at the Johnson Space Center at the Johnson Center. There are a lot of tools, roots and capabilities. I think, on the other hand, there should be some looks at the Office of Space Flight for finding some way to strengthen

168

the overall program management in the Office of Space Flight. And one concept might be to have a Shuttle Program Director within the Office of Space Flight and working with the Level I1 program office at the Johnson Space Center. My answer is, I believe the Level I1 program office, with some strengthening, and the level I program office, with some strengthening-we can make it work and it should remain at the Johnson Space Center.

¶This was in direct contrast to the view held by John Yardley, former Associate Administrator for Space Flight. In discussing the Rogers Commission's recommendations, he stated:

The one in particular that I think I have some background in that I think is not correct is they are trying to strengthen the authority and responsibility of the Program Manager at Johnson. Let me just relate what happened when I went to NASA. I hadn't been there but a couple of weeks and one of the other centers called me and said, "Hey, the Program Manager wants to take 15 million of my money and put it on the Orbiter." It became immediately apparent to me to have one of the center people handle the funding decisions was not going to be in the best interests of cooperative technical activity. So I pull+& 1 the final decisions on the money to Washington, where 1 think they still are . . .⁹⁹ Rogers Commission Report, loc. cit. 2

¶Major Slayton made a similar observation concerning the problems with having a multi-center program managed at one of the field centers:

. . . I think when you look at relationships between the centers and how the organization is structured; and you could say it could be restructured so you don't have intercenter jealousies interfering with the communications channel. A lead center concept where Level I1 is viewed by the other centers as being another center instead of having its headquarters' level is one reference I would make.

¶Major Slayton went on to say that any organization could work with the proper people:

A lot of it is in the management attitude; but again, my opinion is, you can make any organization work if you got the right people, and if you don't have the right people I don't care how you organize it, it will not work, so you still end up dealing with individuals.⁹⁹ Rogers Commission Report, loc. cit. 4

¶I s 1 Ibid., p. 99.

169

¶Other witnesses also alluded to the problems with inter-center ri- valries under the current system and the break down of esprit de corps. Mr. Moore called for a new effort to re-instill the team spirit:

¶I believe a n approach to that has got to be building team work, again, to make sure-the Shuttle program involves many elements, many contractors, many NASA centers, all playing together as a team.

¶I believe we have to go back and re-instill in our people, in our participants, a team work approach . . .

¶I think the overall structure of the Shuttle program is obviously built upon people and, you know, there are humans all the way up the chain, all the way from the engineers a t the subcontractors to the engineers at the contractors, the NASA centers and so forth.

¶I think we have got to make sure that each of those participants in the program feel a dedication, feel a dedication to safety, feel a dedication to the program that they are making a valuable contribution and I think we need to do that by personal communications as well as trying to look a t our structure to make sure we have not defined something that will at least maybe encourage, tend to encourage communications breakdown.

¶General Abrahamson made the following observations with regard to changing organization:

¶It is true that when any organization is formed, it is formed to help you accomplish a particular task. By the same token, once it is there, it develops momentum and procedures and impediments sometimes to exactly what you would like to have, a dynamic and modifying organiza-

tion for the challenges of the future. This is always difficult. I believe that we had a n organization that was designed for the development of the Shuttle, and when we got there, since it was only the second flight, that we had a tremendous change of attitude that we had to be able to create, and that was to create a n organization that would think in terms of operations of the Shuttle and overcome the flight test problems.

¶Issue 2

¶Are astronauts adequately represented in management?

¶Finding

¶The Committee finds no evidence that astronauts are denied the opportunity to enter management if they so choose. Discussion

¶The Rogers Commission has suggested that NASA should make greater use of astronauts in management; however, the Commission report provides no basis for that recommendation. Astronauts generally have shown little interest in going into any kind of desk job, including management positions, until such time as their active flying days end. At that time, management jobs within the astronaut program become attractive alternatives to some; however, opportunities in this area are naturally limited. Major Slayton expressed this very well when he testified about his experience with the Mercury Program:

170

I had the misfortune at that time of having been grounded due to a medical problem so I was elected to take over the management of the astronaut corps, a job I didn't particularly care about, but it was the next best thing.lS7

¶Mr. Nelson asked the astronauts whether any of them felt there was a "modus operandi" within NASA that excluded either active or former astronauts from the management structure. General McDivitt stated he had seen no bias in his three years as Program manager for the Apollo Program. Mr. Nelson then asked Deke Slayton if he had ever seen any bias in NASA and Major Slayton confirmed that he too saw no evidence of bias against astronauts in management. General Abrahamson observed:

Throughout my tenure, astronauts were in key program office positions and one served as a n Assistant Associate Administrator in the Office of Space Flight. . . . I s 8

¶There was agreement among the astronauts that the astronaut office should be moved up higher in the organization. General McDivitt summed up the astronauts' position:

I think I would recommend that the Flight Crew Operations Directorate be moved up to report to the Center Director as well as the Flight Operations Director. I think both of those organizations are very key to flying, and having them go through another layer of management before they get to the Center Director creates a filter which is not necessary or desirable for either one of them. I think it also gets them on the same level as the engineering arganizations within the manned spacecraft center, and gives them better access to the program.lgg b. Communication

¶Issue 1

¶Are there adequate opportunities to communicate problems within the Shuttle Program management structure?

¶Finding

¶There are many regularly scheduled meetings and teleconferences at all levels of management throughout the Shuttle Program. In addition, "special" meetings and telecons are routine. No evidence was found to support a conclusion that the system inhibited communication or that it was difficult to surface problems. Discussion

171

¶Every day at noon central time a teleconference is held among all NASA Space Shuttle Program participants. This is the daily "special" Level I1 PRCB (Program Requirements Change Board) meet,ing and includes, among others, all the managers of the various program elements, the JSC Directors of Flight Crew Operations, Mission Operations, Engineering, Mission Support, SR&QA, and Space and Life Sciences. Program status, urgent problems, and program requirements are brought up at this meeting. The PRCB convenes by teleconference on alternate Fridays to discuss all other (less urgent) program issues; in addition, other special meetings are called by the PRCB secretary when deemed necessary.

¶Each of the supporting organizations also has regularly scheduled meetings, often by teleconference when they involve more than one location. Regularly scheduled (often daily) teleconferences are also held between various directors and managers.

¶Level I at headquarters conducts daily status meetings and also participates in the noon teleconference. These meetings plus all the Flight Readiness Reviews provide ample opportunity to surface problems.

¶Issue 2

¶Is too much information being disseminated so that important information is lost?

¶Finding

¶Large amounts of information are disseminated on a routine basis, often with little or no indication of its importance to all of the recipients.

¶Recommendation

¶NASA management should review the process of providing information on significant actions so that awareness by concerned managers is assured. Discussion

¶In a NASA briefing to staff on Mission Operations (May 21, 19861, NASA managers revealed that they routinely received information copies of all sorts of memoranda, such as directives, requests, approvals for changes, etc. Often the individual receiving these copies had no direct involvement with the specific subject of the memoranda, and they acknowledged that it was entirely likely that an important piece of information could cross their desk without their awareness.

¶Issue 3

¶Are communications filtered so that important information is prevented from reaching the decision makers?

172

¶Finding

¶NASA managers delegated the responsibility for making technical judgments to lower level managers or assistants. Therefore, the information that reached the top decision makers was "filtered" in that it was interpreted by others that were presumed to have more specialized experience or expertise in a given area. There is no evidence that middle level managers suppressed information that they themselves deemed to be significant. In fact, as discussed in the Section on Technical Expertise, the failure was not the problem of technical communications, but rather a failure of technical decisionmaking. Discussion

¶It is typical in any large, complex organization that as managers rise higher in the organization the scope of their responsibilities broadens to encompass technical areas beyond their own specialized expertise. Therefore they must rely increasingly on the technical judgments of lower level managers or assistants. There is the additional risk of subordinates' reluctance to transmit unpleasant information upwards; however, it is not evident that NASA managers suppressed information about problems they themselves understood.

¶Throughout the hearings, witnesses said that had they known about the seriousness of the problem with the SRM joint, they would have stopped the flights; or (in their opinion), had the decision makers known about it the flights would have stopped. The witnesses acknowledged that the problems with the SRM joint had been briefed at all levels, but always in a way that didn't communicate the seriousness of the problem; it was not viewed as life- threatening. Yet the witnesses appeared reluctant to attribute this to poor technical judgments on the part of the managers or technical staff with expertise in propulsion, preferring instead to bl,ame it on poor communications or a poor "decision-making process.

¶Mr. Scheuer questioned Jesse Moore specifically on this point when he asked, referring to Mr. Weeks' summary of the August 19 meeting, "Was it a failure of decision-making on his part or communications on his part?" Mr. Moore responded:

Sir, I think that in a position like Mr. Weeks is in, we have to work as a team, for example, and people have to make assessments on situations and I think Mr. Weeks looked at the data and his assessment was that he thought we had a program adequate to cover the activities in the SRB and he believed that after he had talked to the people at Thiokol and he also believed that, I think, after talking to the people at Marshall and I believe his position was that in fact was an acceptable posture for him to take. Part of his responsibility is to make technical judgments.200

¶Mr. Moore went on to explain that he believed the lack of understanding of the SRB joint extended throughout the agency:

173

I would say, sir, in looking up and down the system and what has been determined about the SRB from the many analyses and work that has been done in the past, I don t think the system all the way from day one of the program really understood all the implications of how the SRB joints worked and I think that we have learned, all of us have learned, an awful lot about the SRB . . .201

¶And again referring to the August 19 meeting:

That was a report from my deputy (Mr. Weeks), that he believed the situation was acceptable as far as assessment of the data presented to him, and I trust the people in the organization to make those kinds of judgments. We have to make those judgments on a day-to-day kind of basis, but I did hear at Flight Readiness Reviews, as everybody as a member of the overall Shuttle team heard about issues associated with the O-ring problem. I believe the first time this was experienced on the Shuttle Program was all the way back to flight 2 . . . I did not, as the head of the Level I office, believe the problem with the SRB 0- rings was serious enough to consider stopping the launches. If I did, I would have stopped the launches, sir.2o2

¶Mr. Scheuer again asked Mr. Moore to identify where the failure was, "Was it in your being communicated with by Mr. Weeks? Was it a failure of judgment on Mr. Weeks' part that all systems were go.? Where was the failure?" At that point, Mr. Moore blamed the failure on communications:

I think in looking at the whole situation, I think there was a failure to communicate the technical seriousness from the contractors involved in this program through . . . .203

¶But, Mr. Scheuer suggested that the contractors had communicated the problem at the August 19th meeting. Mr. Moore then suggested that perhaps someone should have made a stronger statement; however, in their collective judgment it was not a serious problem:

On the basis of the specific August 19 briefing that was presented, I believe there should have been a stronger

¶statement made to me that we have a much more serious

problem by Mr. Weeks or any of the people who attended that briefing. Mr. Weeks was not the only one at the briefing. There were others at the briefing who had some knowledge about the SRB . . . . I don't recall the specific list of attendees at that particular meeting, but people that were in the overall propulsion area of the office of space flight-and the office of space flight is level one-that is the level one-people who had experience in this thing.

¶20' bid., p. 95.

174

I believe if they felt after that August 19th briefing that we had a problem, that the system should be grounded, that somebody would have come and said, "We have got a problem serious enough to ground the Shuttle flight." That did not occur, and I believe it was based on a collective set of judgments that we did not believe the problem was as serious.204

¶The Committee finds no reason to doubt Mr. Moore's observations that no one within NASA understood the problem with the 0- ring and accepts his conclusions:

In hindsight, I think we should have taken much stronger action after the August 19th briefing . . . if I had the knowledge then that I have today, we would have grounded the fleet. I did not have it at the time.205

¶In hindsight, the August 19th briefing, as well as the January 27th telephone conversation clearly identified a serious problem. Perhaps the Thiokol engineers understood the seriousness of the problem; however, Thiokol's own summary and recommendation at the conclusion of the August 19th briefing stated:

Analysis of existing data indicates that it is safe to continue flying existing design as long as all joints are leak checked with a 200 psig stabilization pressure, are free of contamination in the seal areas and meet O-ring squeeze requirements.20

¶This conclusion was accepted by all who heard the briefing, and this was the information that was transmitted throughout NASA. The evidence does not support a conclusion that the top decision makers would have arrived at a different conclusion from the managers at Marshall and the Level I managers with propulsion backgrounds. (For additional discussion on this issue, see Section VI.B.l.c.1 c. Safety, Reliability and Quality Assurance

¶Issue 1

¶Is NASA's decision to establish a new Office of Safety, Reliability, and Quality Assurance appropriate and, if so, what should its role be?

¶Finding

¶The Committee finds that the Rogers Commission recommendation that NASA should establish an Office of Safety, Reliability and Quality Assurance that reports directly to the Administrator is indeed appropriate. However it is not clear what the activities of this office will encompass.

bid, p. 98.

175

¶Recommendations

The Associate Administrator for Safety, Reliability and Quality Assurance (SR&QA) should provide to the Committee the agency's draft plan delineating the organization, goals, implementation strategies and resource requirements of the office of SR&QA.
After the Office of SR&QA is fully operational, the Committee will wish to continue oversight over its activities. Discussion

¶Chapter 7 of the Rogers Commission report deals with the subject entitled "The Silent Safety Program." The Commission identified shortcomings in NASA's overall Safety, Reliability and Quality Assurance Programs, and recommended the formation of a separate Office of Safety, Reliability and Quality Assurance that would report directly to the Administrator. The role of safety and quality assurance in the decisionmaking processes associated with Shuttle flight production requirements has been relatively undefined and ambiguous. The formation of a centralized coordination and control organization should serve to remedy the situation. As the Rogers Commission report notes, ". . . No one thought to invite a safety representative or a reliability and quality assurance engineer to the January 27, 1986 teleconference between Marshall and Thiokol."²² Rogers Commission Report, Volume I, p. 199. 0 7

¶On July 8, 1986, the Administrator established the position of Associate Administrator for Safety, Reliability and Quality Assurance, and briefly delineated the responsibilities of this office in NASA's responsive document to the Rogers Commission report.208

¶According to NASA, the purpose of this office is to strengthen the role of the SR&QA functions across all the the NASA programs. This will be accomplished by establishing centralized coordination under the Associate Administrator €or SR&QA who reports direct1 to the Administrator on all pertinent matters related to the NlTS. The Associate Administrator is chartered to examine the adequacy of the agencies resources in these areas and to make recommendations for improvements as appropriate. Functional organizations that were previously under the purview of the Chief Engineer's office will now report directly to the Associate Administrator for SR&QA.

¶The major contractors to the NSTS agree with the Commission's recommendation to form a separate NASA SR&QA organization reporting directly to the Administrator. They are, however, of the opinion that responsibility for the work required to recommend or implement changes or modifications in the quality assurance area must remain with Level I11 and the contractors themselves.

¶The Committee does not argue with the contention that strong SR&QA capabilities must reside at the contractors' plants. Further, the Committee suports NASA's efforts to enhance its in-house capabilities in order to improve the agency's monitoring and oversight capabilities in the areas of SR&QA. Strengthening Headquarter's ability to provide guidance and centralized coordination in the

¶*O' bid., Volume I, p. 152. *08 NASA Response to Rogers Commission, July 14, 1986, p. 20.

176

¶areas of configuration management, product reliability and quality assurance and risk management, are essential to returning the Shuttle to flight readiness condition.

¶Issue 2

¶Has NASA applied sufficient resources to support adequate S M Q A efforts within the NSTS program?

¶Findings

The Committee finds that reductions in NASA civil service personnel that have occurred over the past decade have adversely impacted the agency's ability to maintain the appropriate level of oversight control of the Safety, Reliability and Quality Assurance activities within the NSTS.
NASA has become increasingly dependent upon outside SR&QA support from the Department of Defense (Defense Contract Administration Services [DCAS] and Air Force Plant Representative Office [AFPRO]) and contractors.
NASA has reduced or reassigned to other program areas in-house safety, reliability and quality assurance tasks such as testing, analyses and instrumentation and has reduced or shut down in-house facilities for performing SR&QA research and technology development. The degree to which these factors have adversely impacted the safety, reliability and quality assurance activities within the NSTS program has not been adequately assessed. Reconmenda t ions
NASA should establish and maintain a strong and effective SR&QA Program. Continuing support for such a program must come directly from the Administrator.
Although it is appropriate to establish strong contractor capa- bilitie in the areas of SR&QA the internal oversight responsibilities and coordination of SR&QA tasks must be the responsibility of NASA itself. In order to assure that the appropriate interfaces among the various subsystem elements that comprise the NSTS, are maintained, a sufficient complement of NASA SR&QA management and support staff must be available to perform the necessary oversight and coordination tasks. Discussion

¶Reductions in force over the past several years have reduced personnel across the agency from a complement of some thirty-six thousand people down to twenty-two thousand people. A disproportionate decline in Reliability and Quality Assurance (R&QA) staffing occured as a result of these reductions. In the Shuttle program, many of the quality control functions and government inspection activities have been performed by contractors in conjunction with the Department of Defense support personnel (DCAS and AFPRO). NASA has expressed some concern about their ability to maintain adequate in-house staffing in these areas. The total number of civil servant employees within NASA dedicated to the SR&QA program is presently about 500 professionals.²² Rogers Commission Report, Volume I, p. 199. 0 9 This represents a reduction of 71% from the 1970 complement.

177

¶NASA attributes this reduction to the termination of "in-house flight programs, along with the transfer of certain functions . . . to other organizations within the NASA centers," In their response to Mr. Roe's inquiryY2 l o NASA makes the following statement:

"Even though we had a reduction in R&QA personnel, our detailed review of the quality operation did not reveal that we missed any of the quality control check points which may be contributed to the accident.''

¶The Committee cannot support NASA's assessment on this matter. Although NASA may argue that the quality control check points for the certification tests required on the ambient and induced temperature effects on the O-ring seals were checked off by the &A representative at Thiokol as having been satisfactorily completed, in actuality these tests were never performed. To what extent this failure of the QA function to do its job conbributed to the accident may be questioned, but the fact that the control didn't work in this case cannot be denied.

¶It should be noted, however, that according to some of the prime contractors, SR&QA staffing has actually improved over the years. For example, at the Rocketdyne Corporation, there has been an increase in QA staffing to a level that represents nearly 40% of the corporation's manufacturing staff.

¶Issue 3

¶Are the responsibilities of safety engineers and design engineers adequately specified within NASA's "risk management" program?

¶Finding

¶The roles of safety, design as well as reliability engineers are not adequately and uniformly defined throughout the NSTS program. In some cases, the Committee learned that safety engineers were not participating in major decisions related to flights of the Shuttle.

¶Recommendations

¶It should be the responsibility of the new Associate Administrator for SR&QA to fully specify the roles of safety and reliability engineering as well as quality assurance personnel within the NSTS program so that all critical aspects of the program and decisions related to the adequacy of hardware and subsystem performance are fully reviewed by these disciplines. Discussion

¶The function of the safety engineers within the NSTS program has been to determine whether or not certain prescribed tests, analyses, and design descriptions have been followed appropriately

¶*OQDiscussionwith the NASA Chief Engineer's Ofice, May 13, 1986. Also, Cmte Hgs, response to question by Mr. Roe,Transcript, June 11, 1986, pp. 59-60.²² Rogers Commission Report, Volume I, p. 199. 1 0 Cmte Hgs, response to question by Mr. Roe, Transcript, June 11, 1986, pp. 59-60.²² Rogers Commission Report, Volume I, p. 199. 1 1 Telephone Conversation, August 13, 1986.

178

¶as they relate to safety concerns, using the techniques of HA. The safety office has not been significantly involved in the engineering design efforts. If an engineering problem arises that could effect the safety of the overall system, it is the responsibility of design engineering teams to perform technical evaluations rather than having these analyses performed by the safety engineers. Prior to the Challenger accident, the safety program did not have the personnel, facilities or expertise to review decisions by design engineers that the O-ring erosion problem was a manageable risk. Even though this erosion was a continuing problem, there was, according to testimony provided to the Rogers Commission, no second set of "eyes" available to question waiver applied to this problem.212 Issue .I

¶Does the SR&QA program require improved coordination between centers, contractors and NASA Headquarters?

¶Findings

Although guidelines have been published that describe the responsibility of contractors' in the areas of SR&QA,213 NASA's guidelines do not adequately distinguish these various activities as distinct disciplines requiring specialized skills and centralized coordination.
In its review of the agency's reliability and quality assurance programs as they relate to the Space Shuttle, the Committee found there was little commonality among the cognizant officials at MSFC, JSC, KSC, and Headquarters in the perception of the various responsibilities associated with these separate and distinct disciplines.

¶Recommendations

It is important that a clear delineation of responsibilities for the separate SR&QA disciplines be appropriately documented. It is also essential that the relative importance of each of the three separate disciplines be established as an integral part of the NSTS program. These functions are the responsibility of NASA Headquarters.
NASA must carefully review the staff and resources devoted to the SR&QA function within NASA and contractor organizations for adequacy. The Administrator shall report to the Committee with his findings and recommendations. Discussion

¶Although the controlling document describing the SR&QA functions for the Shuttle contractors was provided to the Committee, no corresponding document was identified that describes the implementation of these functions for the SR&QA engineers that are direct employees of NASA. NASA contends that the same controlling document applies to agency employees. The specific oversight

¶Testimony before the Rogers Commission, Mr. Jack Walker, Deputy Director, MSFC Safety Office, ,$ ril, 1986.²² Rogers Commission Report, Volume I, p. 199. 1 5 NASA, &fety, Reliabiliz Maintainability and Quality Provisions for the Space Shuttle Program": NHB 5300.4 (1D-2), tober, 1979 responsibilities of these employees and their independent reviews and analyses requires a more complete delineation in the Committee's view. The Rogers Commission report provides definitions for the SR&QA disciplines. An expansion upon these definitions is required in order to establish a commonality of understanding of the various functions as they apply to the Shuttle program.

179

¶The management structure within NASA that coordinates and performs the activities associated with the SR&QA tasks for the NSTS has become decentralized over the past decade. Until recently many of the oversight duties that at one time were handled through Level I were moved to the field centers. Responsibilities for various systems that comprise the Space Shuttle are delegated to the Level I11 field centers. These centers establish and coordi- nate SR&QA activities at the contractor facilities. They are also responsible for reporting any anomalies, inconsistencies, or problems to Level I1 program management.

¶Until recently, the Office of the Chief Engineer had responsibility for SR&QA activities. For various reasons, the operations of this office in the areas of SR&QA appear to have lost effectiveness, either through reductions of personnel and support of these programs at the Headquarters level or through the diffusion of these functions into various organizations within the operating divisions at the field centers. These changes reduced Headquarter's ability to participate in field center status reviews with the prime contractors, limited the Level I manager's ability to survey the effectiveness of the SR&QA programs agency-wide and reduced the co- location of SR&QA personnel within Headquarter's program offices. The Committee expects that the new Office of SR&QA will be chartered to make appropriate corrections to augment the safety, reliability and quality assurance functions within the NSTS Program.

¶d. Contractor Incentives

¶Issue

¶Key Shuttle contracts (e.g., the Solid Rocket Booster Production Contract and the Shuttle Processing Contract (SPC))provide incentives both for reliability, integrity, and safety of products and services on the one hand, and for cost and schedule on the other. Do these contracts provide an appropriate balance between the two types of incentives? That is, does NASA utilize contracts to reward and promote operational safety?

¶Findings

The SPC provides far greater incentives to the contractor for minimizing costs and meeting schedules than for features related to safety and performance. SPC is a cost-plus, incentive/award fee contract. The amount of the incentive fee is based on contract costs (lower costs yields a larger incentive fee) and on safe and successful launch and recovery of the Orbiter. The award fee is designed to permit NASA to focus on those areas of concern which are not sen-

¶Rogers Commission Re rt, Volume I, p. 152. 21bDiacussion with the N E A Chief Engineer's Oftice, May 13, 1986.

180

¶sitive to the incentive fee provisions, including the safety record of the contractor. However, the incentive fee dwarfs the award fee- while the maximum value of the award fee is only one percent of the value of the SPC, the incentive fee could total as much as 14 percent of the SPC.

During the developmental phases of the Thiokol contract for Solid Rocket Booster production (1980-1983), the contractor received consistent ratings of "Excellent-Plus" or "Superior" under the cost-plus, award-fee contract. NASA contracted with Thiokol on a cost-plus, incentive-fee (CPIF) basis beginning in July, 1983. The CPIF contract pays strictly on the basis of costs, although penalties may be invoked for delays in delivery or for Shuttle accidents due to SRB failure. At the time of the Challenger accident, Thiokol was eligible to receive a very large incentive fee, probably on the order of $75 million.

¶Recommendations

NASA should reexamine all Shuttle contracts and report to the Committee with its findings and recommendations on whether more incentives for safety and quality can be built into these contracts. This report should address, inter alia, the SRB Production Contract and the SPC.
NASA's new Office of SWQA should be involved in the procurement and award fee processes, both to establish reasonable guidelines and rewards in new contract and to judge performance of ongoing contracts. Discussion

¶Mr. Robert Thompson, Vice President of McDonnell Douglas, summarized the position of several Committee witnesses when he stated:

I have never detected that a contractor would deliberately infringe on safety for a profit motive.2

¶On the other hand, Thompson also admitted that contracts do vary in the extent of their safety incentives and that, to a certain degree, such incentives can make a difference in operational safety:

. . . the type of safety that we are looking for, for a system like the Shuttle, I think they can be enhanced with these kind of stipulations in a contract. They can't truly be bought that way. Certainly you [could] hang a larger incentive toward safety. You may enhance a strong focus on safety and I would not say that it wouldn't do some good to enlarge those enhancements. '

¶The more difficult question is whether existing NASA contracts, such as the SPC and the SRB Production Contact, strike an appropriate balance between safety incentives and cost/schedule incentives. This question is particularly critical in light of reductions in

¶01aCrnt.e Hgs, Transcript,July 24, 1986, p. 135. 117 mid.

181

¶NASA's SR & &A programs detailed in Section VI.B.2.c. of this report.

¶Both Thiokol and NASA witnesses on June 17, 1986, argued that the penalties inherent in the Thiokol contract with Marshall Space Flight Center provided more than adequate incentives for Thiokol to deliver safe, reliable products. These penalties are of two types. Late-delivery penalties amount to $100-200 thousand per unit. Penalties for mission failures are much larger:

If findings of this Board of Investigation determines (sic) that the cause of the failure is attributed to the Solid Rocket Motor/Motors not performing in compliance with the specification requirements of the contract, a fee reduction of $10,000,000 for each category I failure and $5,000,000 for each category I1 failure shall be deducted from any fee otherwise earned under this contract.218

¶Similarly, in briefings for Committee staff, NASA contract managers have stated that the award fee portion of the SPC, though small, is highly visible and that contractors take the award fee and the semiannual contract ratings very seriously. In NASA's view, high ratings enhance a company's reputation and, therefore, its likelihood of competing effectively for additional contracts.

¶Nevertheless, there are several reasons to believe that NASA could utilize contractual terms more effectively to enhance program safety. First, there can be no argument, for both the SPC and the SRB contract, that absent a major mission failure, virtually all the financial incentives are tilted toward cost-savings and timely delivery.

¶Secondly, because of the complex and overlapping division of responsibilities between NASA and its contractors, it is not clear that contractors will be fully penalized even in cases where their actions or their hardware appear to be directly responsible for a mission failure. Mr. Scheuer's questioning of Mr. Charles Locke, Chairman of the Board of Morton Thiokol, showed that Thiokol is not prepared to accept the full contractual penalties for the Challenger accident.219

¶Finally, it is revealing that, under its NASA contract, Thiokol was never penalized for any of the numerous SRB flight anomalies.22oThe booster joint had never worked as intended, nor was its behavior at ignition ever clearly understood. Occurrences of O-ring erosion and/or blow-by exceeded twenty-five at the time of the Challenger accident. In fact, the rute of erosion/blow-by had increased steadily since the beginning of the SRB contract in 1983. The seal problem was serious enough to lead both to briefings at Headquarters and to establishment of a redesign task force. Yet, in spite of all these problems, Thiokol was eligible to receive a near-maximum incentive fee of approximately $75 million. But, in the final analysis, it was NASA that both approved the SRB design z:: NASA,

¶218 Schedule D! NAS8-30490, A 1983,

ril 12, Ch&FeI& Transcript, June 1 9 d , 55-56. 17, pp. p. 71. discussion focuses on possible contract penalties related flight anomalies, it to

¶is also interesting to note that Thiokol has never been penalbed for numerous safety and process violations at its Utah facilities. Several of these violations have resulted in serious fim and/ or explosions.

182

¶and drew up an SRB contract which contained no provisions for performance penalties or flight-anomaly penalties. One must not fault Thiokol for collecting the bonus; one must fault NASA for allowing the bonus to be collected at all.

¶The problem with the kinds of penalties that were contained in the SRB contract is that, so long as management is convinced that a festering problem like the seal problem is not likely to cause mission failure, there is little incentive for the company to spend resources to fix the problem. In fact, if the solution involves significant delays in delivery, there may be a strong financial dis-incentive for the company to pursue a short-term solution aggressively. For example, Thiokol engineer R.M. Boisjoly provided a clear warning of the seriousness of the O-ring problem in July, 1985, and Thiokol engineer A. R. Thompson laid out a plan for a possible short-term solution to the problem.221 Whatever its efficacy, why was Thompson's plan apparently dismissed so summarily? Part of the answer may be found in the June 18, 1986, exchange between Mr. Scheuer and Mr. Thompson:

Mr. SCHEUER. Would the research and development of your fixes have delayed the delivery of ths SRMs to NASA? Mr. THOMPSON. . . . It probably would have delayed it a month or two, at least for the hardware and some of the research work. . . .222

¶The Committee is certainly not suggesting that anyone in NASA or Thiokol would recommend launch or would refuse to spend resources fixing a problem if it was known that the problem consti- tuted a real threat to mission safety. However, in the case of the SRB joint, both NASA and Thiokol managers clearly misjudged the threat to mission safety. In situations of this sort, contractual provisions rewarding performance rather than cost and schedule would have provided a far stronger incentive to fm a long-festering problem. Ultimately, the balance between safety incentives and cost/schedule incentives in the SRB contract may illuminate a number of issues raised by the Challenger accident.

¶as1 Rugem Commission Report, Volume I, pp. 249-51.

¶Cmte Hgs, Transcript, June 18, 1986, p. 18.

CASING JOINT DESIGN

¶Discussion

¶(a)Introduction

¶The fact that the aft field joint of the right-hand Solid Rocket Booster failed at the 300 degree location is overwhelmingly supported by the evidence. Retrieval of two large pieces of the joint clearly show that they were destroyed by the heat and velocity of the gas flame emanating from the right-hand booster. Additional supporting evidence was found by reviewing the telemetry data and the photographs taken during launch and flight.'

¶For the purpose of redesigning the joint it is important that the way in which the joint failed be determined as closely as possible. This determination, however, is difficult, if not impossible, to make with one hundred percent certainty. The evidence to support progress of the failure through the joint is incomplete. However, based on the recorded history of the joint problems encountered in flight and in test, based on the laws of physics, and based on behavior of the materials used in the joint, the following PROBABLE CAUSE is offered.

¶(b) Probable Cause of Failure

Both the primary O-ring and the secondary O-ring were seated when the steel casings were mated. The pressure check verified this fact. However, from experience, the primary O-ring was seated in the upstream position as had been previously recognized by NASA and Thiokol engineers. (See Figure VII-1.)

¶Rogers Commission Report, Volume I, pp. 22-23 and 78-79.

¶(183)

184

. PRIMARY EEATED

/ -RING IN BUT

UPSTREAM WRONG) POSITION

0-R ING h E A T E D