7.1 ORGANIZATIONAL CAUSES: INSIGHTS FROM HISTORY

¶NASAʼs organizational culture is rooted in history and tradition. From NASAʼs inception in 1958 to the Challenger accident in 1986, the agencyʼs Safety, Reliability, and Quality Assurance (SRQA) activities, "although distinct disciplines," were "typically treated as one function in the design, development, and operations of NASAʼs manned space flight programs."1 Contractors and NASA engineers collaborated closely to assure the safety of human space flight. Solid engineering practices emphasized defining goals and relating system performance to them; establishing and using decision criteria; developing alternatives; modeling systems for analysis; and managing operations.2 Although a NASA Office of Reliability and Quality Assurance existed for a short time during the early 1960s, it was funded by the human space flight program. By 1963, the office disappeared from the agencyʼs organization charts. For the next few years, the only type of safety program that existed at NASA was a decentralized "loose federation" of risk assessment oversight run by each programʼs contractors and the project offices at each of the three Human Space Flight Centers.

¶Fallout from Apollo – 1967

¶In January 1967, months before the scheduled launch of Apollo 1, three astronauts died when a fire erupted in a ground-test capsule. In response, Congress, seeking to establish an independent safety organization to oversee space flight, created the Aerospace Safety Advisory Panel

¶(ASAP). The ASAP was intended to be a senior advisory committee to NASA, reviewing space flight safety studies and operations plans, and evaluating "systems procedures and management policies that contribute to risk." The panelʼs main priority was human space flight missions.3 Although four of the panelʼs nine members can be NASA employees, in recent years few have served as members. While the panelʼs support staff generally consists of full-time NASA employees, the group technically remains an independent oversight body.

¶Congress simultaneously mandated that NASA create separate safety and reliability offices at the agencyʼs headquarters and at each of its Human Space Flight Centers and Programs. Overall safety oversight became the responsibility of NASAʼs Chief Engineer. Although these offices were not totally independent – their funding was linked with the very programs they were supposed to oversee – their existence allowed NASA to treat safety as a unique function. Until the Challenger accident in 1986, NASA safety remained linked organizationally and financially to the agencyʼs Human Space Flight Program.

¶Challenger – 1986

¶In the aftermath of the Challenger accident, the Rogers Commission issued recommendations intended to remedy what it considered to be basic deficiencies in NASAʼs safety system. These recommendations centered on an underlying theme: the lack of independent safety oversight at NASA. Without independence, the Commission believed, the slate of safety failures that contributed to the Challenger accident – such as the undue influence of schedule pressures and the flawed Flight Readiness process – would not be corrected. "NASA should establish an Office of Safety, Reliability, and Quality Assurance to be headed by an Associate Administrator, reporting directly to the NASA Administrator," concluded the Commission. "It would have direct authority for safety, reliability, and quality assurance throughout the Agency. The office should be assigned the workforce to ensure adequate oversight of its functions and should be independent of other NASA functional and program responsibilities" [emphasis added].

¶In July 1986, NASA Administrator James Fletcher created a Headquarters Office of Safety, Reliability, and Quality Assurance, which was given responsibility for all agency-wide safety-related policy functions. In the process, the position of Chief Engineer was abolished.4 The new officeʼs Associate Administrator promptly initiated studies on Shuttle in-flight anomalies, overtime levels, the lack of spare parts, and landing and crew safety systems, among other issues.5 Yet NASAʼs response to the Rogers Commission recommendation did not meet the Commissionʼs intent: the Associate Administrator did not have direct authority, and safety, reliability, and mission assurance activities across the agency remained dependent on other programs and Centers for funding.

¶General Accounting Office Review – 1990

¶A 1990 review by the U.S. General Accounting Office questioned the effectiveness of NASAʼs new safety organizations in a report titled "Space Program Safety: Funding for NASAʼs Safety Organizations Should Be Centralized."6 The report concluded "NASA did not have an independent and effective safety organization" [emphasis added]. Although the safety organizational structure may have "appeared adequate," in the late 1980s the space agency had concentrated most of its efforts on creating an independent safety office at NASA Headquarters. In contrast, the safety offices at NASAʼs field centers "were not entirely independent because they obtained most of their funds from activities whose safety-related performance they were responsible for overseeing." The General Accounting Office worried that "the lack of centralized independent funding may also restrict the flexibility of center safety managers." It also suggested "most NASA safety managers believe that centralized SRM&QA [Safety, Reliability, Maintainability and Quality Assurance] funding would ensure independence." NASA did not institute centralized funding in response to the General Accounting Office report, nor has it since. The problems outlined in 1990 persist to this day.

179

¶Space Flight Operations Contract – 1996

¶The Space Flight Operations Contract was intended to streamline and modernize NASAʼs cumbersome contracting practices, thereby freeing the agency to focus on research and development (see Chapter 5). Yet its implementation complicated issues of safety independence. A single contractor would, in principle, provide "oversight" on production, safety, and mission assurance, as well as cost management, while NASA maintained "insight" into safety and quality assurance through reviews and metrics. Indeed, the reduction to a single primary contract simplified some aspects of the NASA/contractor interface. However, as a result, experienced engineers changed jobs, NASA grew dependent on contractors for technical support, contract monitoring requirements increased, and positions were subsequently staffed by less experienced engineers who were placed in management roles.

¶Collectively, this eroded NASAʼs in-house engineering and technical capabilities and increased the agencyʼs reliance on the United Space Alliance and its subcontractors to identify, track, and resolve problems. The contract also involved substantial transfers of safety responsibility from the government to the private sector; rollbacks of tens of thousands of Government Mandated Inspection Points; and vast reductions in NASAʼs in-house safety-related technical expertise (see Chapter 10). In the aggregate, these mid-1990s transformations rendered NASAʼs already problematic safety system simultaneously weaker and more complex.

¶The effects of transitioning Shuttle operations to the Space Flight Operations Contract were not immediately apparent in the years following implementation. In November 1996, as the contract was being implemented, the Aerospace Safety Advisory Panel published a comprehensive contract review, which concluded that the effort "to streamline the Space Shuttle program has not inadvertently created unacceptable flight or ground risks."7 The Aerospace Safety Advisory Panelʼs passing grades proved temporary.

¶Shuttle Independent Assessment Team – 1999

¶Just three years later, after a number of close calls, NASA chartered the Shuttle Independent Assessment Team to examine Shuttle sub-systems and maintenance practices (see Chapter 5). The Shuttle Independent Assessment Team Report sounded a stern warning about the quality of NASAʼs Safety and Mission Assurance efforts and noted that the Space Shuttle Program had undergone a massive change in structure and was transitioning to "a slimmed down, contractor-run operation."

¶The team produced several pointed conclusions: the Shuttle Program was inappropriately using previous success as a justification for accepting increased risk; the Shuttle Programʼs ability to manage risk was being eroded "by the desire to reduce costs;" the size and complexity of the Shuttle Program and NASA/contractor relationships demanded better communication practices; NASAʼs safety and mission assurance organization was not sufficiently independent; and "the workforce has received a conflicting message due to the emphasis on achieving cost and staff reductions, and the pressures placed on increasing scheduled flights as a result of the Space Station" [emphasis added].8 The Shuttle Independent Assessment Team found failures of communication to flow up from the "shop floor" and down from supervisors to workers, deficiencies in problem and waiver-tracking systems, potential conflicts of interest between Program and contractor goals, and a general failure to communicate requirements and changes across organizations. In general, the Programʼs organizational culture was deemed "too insular."9

¶NASA subsequently formed an Integrated Action Team to develop a plan to address the recommendations from previous Program-specific assessments, including the Shuttle Independent Assessment Team, and to formulate improvements.10 In part this effort was also a response to program missteps in the drive for efficiency seen in the "faster, better, cheaper" NASA of the 1990s. The NASA Integrated Action Team observed: "NASA should continue to remove communication barriers and foster an inclusive environment where open communication is the norm." The intent was to establish an initiative where "the importance of communication and a culture of trust and openness permeate all facets of the organization." The report indicated that "multiple processes to get the messages across the organizational structure" would need to be explored and fostered [emphasis added]. The report recommended that NASA solicit expert advice in identifying and removing barriers, providing tools, training, and education, and facilitating communication processes.

¶The Shuttle Independent Assessment Team and NASA Integrated Action Team findings mirror those presented by the Rogers Commission. The same communication problems persisted in the Space Shuttle Program at the time of the Columbia accident.

¶Space Shuttle Competitive Source Task Force – 2002

¶In 2002, a 14-member Space Shuttle Competitive Task Force supported by the RAND Corporation examined competitive sourcing options for the Shuttle Program. In its final report to NASA, the team highlighted several safety-related concerns, which the Board shares:

180

Flight and ground hardware and software are obsolete, and safety upgrades and aging infrastructure repairs have been deferred.
Budget constraints have impacted personnel and resources required for maintenance and upgrades.
International Space Station schedules exert significant pressures on the Shuttle Program.
Certain mechanisms may impede worker anonymity in reporting safety concerns.
NASA does not have a truly independent safety function with the authority to halt the progress of a critical mission element.¹¹¹¹ Thompson, "The Risk of Groundling Fatalities;" Code of Federal Regulations (CFR) 14 CFR Part 415, 415, and 417, "Licensing and Safety Requirements for Launch: Proposed Rule," Federal Register Vol. 67, No. 146, July 30, 2002, p. 49495. 224 Report Volume I August 2003

¶Based on these findings, the task force suggested that an Independent Safety Assurance function should be created that would hold one of "three keys" in the Certification of Flight Readiness process (NASA and the operating contractor would hold the other two), effectively giving this function the ability to stop any launch. Although in the Boardʼs view the "third key" Certification of Flight Readiness process is not a perfect solution, independent safety and verification functions are vital to continued Shuttle operations. This independent function should possess the authority to shut down the flight preparation processes or intervene post-launch when an anomaly occurs.