7.6 Findings and Recommendations

¶The evidence that supports the organizational causes also led the Board to conclude that NASAʼs current organization, which combines in the Shuttle Program all authority and responsibility for schedule, cost, manifest, safety, technical requirements, and waivers to technical requirements, is not an effective check and balance to achieve safety and mission assurance. Further, NASAʼs Office of Safety and Mission Assurance does not have the independence and authority that the Board and many outside reviews believe is necessary. Consequently, the Space Shuttle Program does not consistently demonstrate the characteristics of organizations that effectively manage high risk. Therefore, the Board offers the following Findings and Recommendations:

¶Findings:

¶F7.1-1 Throughout its history, NASA has consistently struggled to achieve viable safety programs and adjust them to the constraints and vagaries of changing budgets. Yet, according to multiple high level independent reviews, NASAʼs safety system has fallen short of the mark.

193

¶F7.4-1 The Associate Administrator for Safety and Mission Assurance is not responsible for safety and mission assurance execution, as intended by the Rogers Commission, but is responsible for Safety and Mission Assurance policy, advice, coordination, and budgets. This view is consistent with NASAʼs recent philosophy of management at a strategic level at NASA Headquarters but contrary to the Rogersʼ Commission recommendation.

¶F7.4-2 Safety and Mission Assurance organizations supporting the Shuttle Program are largely dependent upon the Program for funding, which hampers their status as independent advisors.

¶F7.4-3 Over the last two decades, little to no progress has been made toward attaining integrated, independent, and detailed analyses of risk to the Space Shuttle system.

¶F7.4-4 System safety engineering and management is separated from mainstream engineering, is not vigorous enough to have an impact on system design, and is hidden in the other safety disciplines at NASA Headquarters.

¶F7.4-5 Risk information and data from hazard analyses are not communicated effectively to the risk assessment and mission assurance processes. The Board could not find adequate application of a process, database, or metric analysis tool that took an integrated, systemic view of the entire Space Shuttle system.

¶F7.4-6 The Space Shuttle Systems Integration Office handles all Shuttle systems except the Orbiter. Therefore, it is not a true integration office.

¶F7.4-7 When the Integration Office convenes the Integration Control Board, the Orbiter Office usually does not send a representative, and its staff makes verbal inputs only when requested.

¶F7.4-8 The Integration office did not have continuous responsibility to integrate responses to bipod foam shedding from various offices. Sometimes the Orbiter Office had responsibility, sometimes the External Tank Office at Marshall Space Flight Center had responsibility, and sometime the bipod shedding did not result in any designation of an In-Flight Anomaly. Integration did not occur.

¶F7.4-9 NASA information databases such as The Problem Reporting and Corrective Action and the Web Program Compliance Assurance and Status System are marginally effective decision tools.

¶F7.4-10 Senior Safety, Reliability & Quality Assurance and element managers do not use the Lessons Learned Information System when making decisions. NASA subsequently does not have a constructive program to use past lessons to edu- cate engineers, managers, astronauts, or safety personnel.

¶F7.4-11 The Space Shuttle Program has a wealth of data tucked away in multiple databases without a convenient way to integrate and use the data for management, engineering, or safety decisions.

¶F7.4-12 The dependence of Safety, Reliability & Quality Assurance personnel on Shuttle Program support limits their ability to oversee operations and

communicate potential problems throughout the organization.

¶F7.4-13 There are conflicting roles, responsibilities, and

guidance in the Space Shuttle safety programs. The Safety & Mission Assurance Pre-Launch Assessment Review process is not recognized by the Space Shuttle Program as a requirement that must be followed (NSTS 22778). Failure to consistently apply the Pre-Launch Assessment Review as a requirements document creates confusion about roles and responsibilities in the NASA safety organization.

¶Recommendations:

¶R7.5-1 Establish an independent Technical Engineer-

ing Authority that is responsible for technical requirements and all waivers to them, and will build a disciplined, systematic approach to identifying, analyzing, and controlling hazards throughout the life cycle of the Shuttle System. The independent technical authority does the following as a minimum:

Develop and maintain technical standards for all Space Shuttle Program projects and elements

Be the sole waiver-granting authority for all technical standards

Conduct trend and risk analysis at the subsystem, system, and enterprise levels

Own the failure mode, effects analysis and hazard reporting systems

Conduct integrated hazard analysis

Decide what is and is not an anomalous event

Independently verify launch readiness

Approve the provisions of the recertification program called for in Recommendation R9.1-1

The Technical Engineering Authority should be funded directly from NASA Headquarters, and should have no connection to or responsibility for schedule or program cost.

¶R7.5-2 NASA Headquarters Office of Safety and Mission

Assurance should have direct line authority over the entire Space Shuttle Program safety organization and should be independently resourced.

¶R7.5-3 Reorganize the Space Shuttle Integration Office

to make it capable of integrating all elements of the Space Shuttle Program, including the Orbiter.

194

ENDNOTES FOR CHAPTER 7

¶The citations that contain a reference to "CAIB document" with CAB or CTF followed by seven to eleven digits, such as CAB001-0010, refer to a document in the Columbia Accident Investigation Board database maintained by the Department of Justice and archived at the National Archives.

195

Chapter 8: History As Cause: Columbia and Challenger

¶The Board began its investigation with two central questions about NASA decisions. Why did NASA continue to fly with known foam debris problems in the years preceding the Columbia launch, and why did NASA managers conclude that the foam debris strike 81.9 seconds into Columbiaʼs flight was not a threat to the safety of the mission, despite the concerns of their engineers?