8.3 SYSTEM EFFECTS: THE IMPACT OF HISTORY AND POLITICS ON RISKY WORK

8.3 SYSTEM EFFECTS: THE IMPACT OF HISTORY AND POLITICS ON RISKY WORK

¶The series of engineering decisions that normalized technical deviations shows one way that history became cause in both accidents. But NASAʼs own history encouraged this pattern of flying with known flaws. Seventeen years separated the two accidents. NASA Administrators, Congresses, and political administrations changed. However, NASAʼs political and budgetary situation remained the same in principle as it had been since the inception of the Shuttle Program. NASA remained a politicized and vulnerable agency, dependent on key political players who accepted NASAʼs ambitious proposals and then imposed strict budget limits. Post-Challenger policy decisions made by the White House, Congress, and NASA leadership resulted in the agency reproducing many of the failings identified by the Rogers Commission. Policy constraints affected the Shuttle Programʼs organization culture, its structure, and the structure of the safety system. The three combined to keep NASA on its slippery slope toward Challenger and Columbia. NASA culture allowed flying with flaws when problems were defined as normal and routine; the structure of NASAʼs Shuttle Program blocked the flow of critical information up the hierarchy, so definitions of risk continued unaltered. Finally, a perennially weakened safety system, unable to critically analyze and intervene, had no choice but to ratify the existing risk assessments on these two problems. The following comparison shows that these system effects persisted through time, and affected engineering decisions in the years leading up to both accidents.

¶The Board found that dangerous aspects of NASAʼs 1986 culture, identified by the Rogers Commission, remained unchanged. The Space Shuttle Program had been built on compromises hammered out by the White House and NASA headquarters.14 As a result, NASA was transformed from a research and development agency to more of a business, with schedules, production pressures, deadlines, and cost efficiency goals elevated to the level of technical innovation and safety goals.15 The Rogers Commission dedicated an entire chapter of its report to production pressures.16 Moreover, the Rogers Commission, as well as the 1990 Augustine Committee and the 1999 Shuttle Independent Assessment Team, criticized NASA for treating the Shuttle as if it were an operational vehicle. Launching on a tight schedule, which the agency had pursued as part of its initial bargain with the White House, was not the way to operate what was in fact an experimental vehicle. The Board found that prior to Columbia, a budget-limited Space Shuttle Program, forced again and again to refashion itself into an efficiency model because of repeated government cutbacks, was beset by these same ills. The harmful effects of schedule pressure identified in previous reports had returned.

¶Prior to both accidents, NASA was scrambling to keep up. Not only were schedule pressures impacting the people who worked most closely with the technology – technicians, mission operators, flight crews, and vehicle proces- sors – engineering decisions also were affected.17 For foam debris and O-ring erosion, the definition of risk established during the Flight Readiness process determined actions taken and not taken, but the schedule and shoestring budget were equally influential. NASA was cutting corners. Launches proceeded with incomplete engineering work on these flaws. Challenger-era engineers were working on a permanent fix for the booster joints while launches continued.18 After the major foam bipod hit on STS-112, management made the deadline for corrective action on the foam problem after the next launch, STS-113, and then slipped it again until after the flight of STS-107. Delays for flowliner and Ball Strut Tie Rod Assembly problems left no margin in the schedule between February 2003 and the management- imposed February 2004 launch date for the International Space Station Node 2. Available resources – including time out of the schedule for research and hardware modifications – went to the problems that were designated as serious – those most likely to bring down a Shuttle. The NASA culture encouraged flying with flaws because the schedule could not be held up for routine problems that were not defined as a threat to mission safety.19

¶The question the Board had to answer was why, since the foam debris anomalies went on for so long, had no one recognized the trend and intervened? The O-ring history prior to Challenger had followed the same pattern. This question pointed the Boardʼs attention toward the NASA organization structure and the structure of its safety system. Safety- oriented organizations often build in checks and balances to identify and monitor signals of potential danger. If these checks and balances were in place in the Shuttle Program, they werenʼt working. Again, past policy decisions produced system effects with implications for both Challenger and Columbia.

¶Prior to Challenger, Shuttle Program structure had hindered information flows, leading the Rogers Commission to conclude that critical information about technical problems was not conveyed effectively through the hierarchy.20 The Space Shuttle Program had altered its structure by outsourcing to contractors, which added to communication problems. The Commission recommended many changes to remedy these problems, and NASA made many of them. However, the Board found that those post-Challenger changes were undone over time by management actions.21 NASA administrators, reacting to government pressures, transferred more functions and responsibilities to the private sector. The change was cost-efficient, but personnel cuts reduced oversight of contractors at the same time that the agencyʼs dependence upon contractor engineering judgment increased. When high-risk technology is the product and lives are at stake, safety, oversight, and communication flows are critical. The Board found that the Shuttle Programʼs normal chain of command and matrix system did not perform a check-and-balance function on either foam or O-rings.

¶The Flight Readiness Review process might have reversed the disastrous trend of normalizing O-ring erosion and foam debris hits, but it didnʼt. In fact, the Rogers Commission found that the Flight Readiness process only affirmed the pre-Challenger engineering risk assessments.22 Equally troubling, the Board found that the Flight Readiness process, which is built on consensus verified by signatures of all responsible parties, in effect renders no one accountable. Although the process was altered after Challenger, these changes did not erase the basic problems that were built into the structure of the Flight Readiness Review.23 Managers at the top were dependent on engineers at the bottom for their engineering analysis and risk assessments. Information was lost as engineering risk analyses moved through the process. At succeeding stages, management awareness of anomalies, and therefore risks, was reduced either because of the need to be increasingly brief and concise as all the parts of the system came together, or because of the need to produce consensus decisions at each level. The Flight Readiness process was designed to assess hardware and take corrective actions that would transform known problems into acceptable flight risks, and that is precisely what it did. The 1986 House Committee on Science and Technology concluded during its investigation into Challenger that Flight Readiness Reviews had performed exactly as they were designed, but that they could not be expected to replace engineering analysis, and therefore they "cannot be expected to prevent a flight because of a design flaw that Project management had already determined an acceptable risk."24 Those words, true for the history of O-ring erosion, also hold true for the history of foam debris.

¶The last line of defense against errors is usually a safety system. But the previous policy decisions by leaders described in Chapter 5 also impacted the safety structure and contributed to both accidents. Neither in the O-ring erosion nor the foam debris problems did NASAʼs safety system attempt to reverse the course of events. In 1986, the Rogers Commission called it "The Silent Safety System."25 Pre-Challenger budget shortages resulted in safety personnel cutbacks. Without clout or independence, the safety personnel who remained were ineffective. In the case of Columbia, the Board found the same problems were reproduced and for an identical reason: when pressed for cost reduction, NASA attacked its own safety system. The faulty assumption that supported this strategy prior to Columbia was that a reduction in safety staff would not result in a reduction of safety, because contractors would assume greater safety responsibility. The effectiveness of those remaining staff safety engineers was blocked by their dependence on the very Program they were charged to supervise. Also, the Board found many safety units with unclear roles and responsibilities that left crucial gaps. Post-Challenger NASA still had no systematic procedure for identifying and monitoring trends. The Board was surprised at how long it took NASA to put together trend data in response to Board requests for information. Problem reporting and tracking systems were still overloaded or underused, which undermined their very purpose. Multiple job titles disguised the true extent of safety personnel shortages. The Board found cases in which the same person was occupying more than one safety position – and in one instance at least three positions – which compromised any possibility of safety organization independence because the jobs were established with built-in conflicts of interest.

¶8.4 ORGANIZATION, CULTURE, AND