Reports that Matter

Columbia Accident Investigation Board Report, Volume I

8.6 CHANGING NASAʼS ORGANIZATIONAL SYSTEM

Section 87 of 106

8.6 CHANGING NASAʼS ORGANIZATIONAL SYSTEM

The echoes of Challenger in Columbia identified in this chapter have serious implications. These repeating patterns mean that flawed practices embedded in NASAʼs organizational system continued for 20 years and made substantial contributions to both accidents. The Columbia Accident Investigation Board noted the same problems as the Rogers Commission. An organization system failure calls for corrective measures that address all relevant levels of the organization, but the Boardʼs investigation shows that for all its cutting-edge technologies, "diving-catch" rescues, and imaginative plans for the technology and the future of space exploration, NASA has shown very little understanding of the inner workings of its own organization.

NASA managers believed that the agency had a strong safety culture, but the Board found that the agency had the same conflicting goals that it did before Challenger, when schedule concerns, production pressure, cost-cutting and a drive for ever-greater efficiency – all the signs of an "operational" enterprise – had eroded NASAʼs ability to assure mission safety. The belief in a safety culture has even less credibility in light of repeated cuts of safety personnel and budgets – also conditions that existed before Challenger. NASA managers stated confidently that everyone was encouraged to speak up about safety issues and that the agency was responsive to those concerns, but the Board found evidence to the contrary in the responses to the Debris Assessment Teamʼs request for imagery, to the initiation of the imagery request from Kennedy Space Center, and to the "we were just ʻwhat-iffingʼ" e-mail concerns that did not reach the Mission Management Team. NASAʼs bureaucratic structure kept important information from reaching engineers and managers alike. The same NASA whose engineers showed initiative and a solid working knowledge of how to get things done fast had a managerial culture with an allegiance to bureaucracy and cost-efficiency that squelched the engineersʼ efforts. When it came to managersʼ own actions, however, a different set of rules prevailed. The Board found that Mission Management Team decision-making operated outside the rules even as it held its engineers to a stifling protocol. Management was not able to recognize that in unprecedented conditions, when lives are on the line, flexibility and democratic process should take priority over bureaucratic response.47

203

During the Columbia investigation, the Board consistently searched for causal principles that would explain both the technical and organizational system failures. These principles were needed to explain Columbia and its echoes of Challenger. They were also necessary to provide guidance for NASA. The Boardʼs analysis of organizational causes in Chapters 5, 6, and 7 supports the following principles that should govern the changes in the agencyʼs organizational system. The Boardʼs specific recommendations, based on these principles, are presented in Part Three.

Leaders create culture. It is their responsibility to change it. Top administrators must take responsibility for risk, failure, and safety by remaining alert to the effects their decisions have on the system. Leaders are responsible for establishing the conditions that lead to their subordinatesʼ successes or failures. The past decisions of national leaders – the White House, Congress, and NASA Headquarters – set the Columbia accident in motion by creating resource and schedule strains that compromised the principles of a high-risk technology organization. The measure of NASAʼs success became how much costs were reduced and how efficiently the schedule was met. But the Space Shuttle is not now, nor has it ever been, an operational vehicle. We cannot explore space on a fixed-cost basis. Nevertheless, due to International Space Station needs and scientific experiments that require particular timing and orbits, the Space Shuttle Program seems likely to continue to be schedule-driven. National leadership needs to recognize that NASA must fly only when it is ready. As the White House, Congress, and NASA Headquarters plan the future of human space flight, the goals and the resources required to achieve them safely must be aligned.

Changes in organizational structure should be made only with careful consideration of their effect on the system and their possible unintended consequences. Changes that make the organization more complex may create new ways that it can fail.48 When changes are put in place, the risk of error initially increases, as old ways of doing things compete with new. Institutional memory is lost as personnel and records are moved and replaced. Changing the structure of organizations is complicated by external political and budgetary constraints, the inability of leaders to conceive of the full ramifications of their actions, the vested interests of insiders, and the failure to learn from the past.49

Nonetheless, changes must be made. The Shuttle Programʼs structure is a source of problems, not just because of the way it impedes the flow of information, but because it has had effects on the culture that contradict safety goals.

NASAʼs blind spot is it believes it has a strong safety cul-

dent, robust capability to protect the systemʼs fundamental requirements and specifications inevitably compromised those requirements, and therefore increased risk. The Shuttle Programʼs structure created power distributions that need new structuring, rules, and management training to restore deference to technical experts, empower engineers to get resources they need, and allow safety concerns to be freely aired.

Strategies must increase the clarity, strength, and presence of signals that challenge assumptions about risk. Twice in NASA history, the agency embarked on a slippery slope that resulted in catastrophe. Each decision, taken by itself, seemed correct, routine, and indeed, insignificant and unremarkable. Yet in retrospect, the cumulative effect was stunning. In both pre-accident periods, events unfolded over a long time and in small increments rather than in sudden and dramatic occurrences. NASAʼs challenge is to design systems that maximize the clarity of signals, amplify weak signals so they can be tracked, and account for missing signals. For both accidents there were moments when management definitions of risk might have been reversed were it not for the many missing signals – an absence of trend analysis, imagery data not obtained, concerns not voiced, information overlooked or dropped from briefings. A safety team must have equal and independent representation so that managers are not again lulled into complacency by shifting definitions of risk. It is obvious but worth acknowledging that people who are marginal and powerless in organizations may have useful information or opinions that they donʼt express. Even when these people are encouraged to speak, they find it intimidat- ing to contradict a leaderʼs strategy or a group consensus. Extra effort must be made to contribute all relevant information to discussions of risk. These strategies are important for all safety aspects, but especially necessary for ill-structured problems like O-rings and foam debris. Because ill-structured problems are less visible and therefore invite the normalization of deviance, they may be the most risky of all.

Challenger launches on the ill-fated STS-33/51-L mission on January 28, 1986. The Orbiter would be destroyed 73 seconds later. ture. Program history shows that the loss of a truly indepen-The citations that contain a reference to "CAIB document" with CAB or

204

CTF followed by seven to eleven digits, such as CAB001-0010, refer to a document in the Columbia Accident Investigation Board database maintained by the Department of Justice and archived at the National Archives.

Turner studied 85 different accidents and disasters, noting a common pattern: each had a long incubation period in which hazards and warning signs prior to the accident were either ignored or misinterpreted. He called these "failures of foresight." Barry Turner, Man-made Disasters,

(London: Wykeham, 1978); Barry Turner and Nick Pidgeon, Man-made Disasters, 2nd ed. (Oxford: Butterworth Heinneman,1997).

Changing personnel is a typical response after an organization has some kind of harmful outcome. It has great symbolic value. A change in personnel points to individuals as the cause and removing them gives the

false impression that the problems have been solved, leaving unresolved organizational system problems. See Scott Sagan, The Limits of Safety.

Princeton: Princeton University Press, 1993.

Diane Vaughan, The Challenger Launch Decision: Risky Technology,

Culture, and Deviance at NASA (Chicago: University of Chicago Press.

1996).4 See also comments by Robert F. Thompson, Columbia Accident Shuttle Development," June 8, 1986, p. 1-7. Investigation Board Public Hearing, April 23, 2003, in Appendix G. 16 The 1971 cost-per-flight estimate was $7.7 million; $140.5 million dollars "Report of the Advisory Committee on the Future of the U.S. Space Program," December 1990, p. 2. 212 Report Volume I August 2003 JSC Form 564 (March 24, 2003).

William H. Starbuck and Frances J. Milliken, "Challenger: Fine-tuning the Odds until Something Breaks." Journal of Management Studies 23 (1988), pp. 319-40.

Report of the Presidential Commission on the Space Shuttle Challenger

Accident, (Washington: Government Printing Office, 1986), Vol. II,

Appendix H.

Alex Roland, "The Shuttle: Triumph or Turkey?" Discover, November 1985: pp. 29-49.

Report of the Presidential Commission, Vol. I, Ch. 6.8 The only actual flight tests conducted of the Orbiter were a series of Printing Office, 1998) for an account of the aftermath of the accident. Approach and Landing Tests where Enterprise (OV-101) was dropped Much of the account in this section is drawn from this source. from its Boeing 747 Shuttle Carrier Aircraft while flying at 25,000 feet. 19 Logsdon, "Return to Flight," p. 348. These tests – with crews aboard – demonstrated the low-speed handling 20 Presidential Commission on the Space Shuttle Challenger Accident capabilities of the Orbiter and allowed an evaluation of the vehicleʼs (Washington: Government Printing Office, June 6, 1986). landing characteristics. See Jenkins, Space Shuttle, pp. 205-212 for more information. 26 Report Volume I August 2003

Turner, Man-made Disasters.9 R. J. Gomex et al, "STS-107 Foam Transport Final Report," NSNS- 60506, August 2003. 84 Report Volume I August 2003

Vaughan, The Challenger Launch Decision, pp. 243-49, 253-57, 262-64,

350-52, 356-72.10 The civil aviation study indicates that the risk to groundlings is significantly 25 Julie Kramer, et al., "Minutes from CAIB / Engineering Meeting to higher in the vicinity of an airport. The average annual risk of fatality Discuss CAIB Action / Request for Information B1-000193," April 24, within 0.2 miles of a busy (top 100) airport is about 1 in a million. 2003. CAIB document CTF042-00930095.

Turner, Man-made Disasters.

U.S. Congress, House, Investigation of the Challenger Accident,

(Washington: Government Printing Office, 1986), pp. 149.12 Howard E. McCurdy, Inside NASA: High Technology and Organizational 27 Demingʼs management philosophy was not the only new notion that Change in the U.S. Space Program (Baltimore: The Johns Hopkins Goldin attempted to apply to NASA. He was also an advocate of the University Press, 1993), p. 24. "Total Quality Management" approach and other modern management 13 schemes. Trying to adapt to these various management theories was a Garry D. Brewer, "Perfect Places: NASA as an Idealized Institution," in Radford Byerly, Jr., ed., Space Policy Reconsidered (Boulder, CO: source of some stress. Westview Press, 1989), p. 158. Brewer, when he wrote these words, 28 For a discussion of Goldinʼs approach, see Howard McCurdy, Faster, was a professor of organizational behavior at Yale University with no Better, Cheaper: Low-Cost Innovation in the U.S. Space Program prior exposure to NASA. For first-hand discussions of NASAʼs Apollo-era (Baltimore: The Johns Hopkins University Press, 2001). It is worth noting organizational culture, see Christopher Kraft, Flight: My Life in Mission that while the "faster, better, cheaper" approach led to many more Control (New York: E.P. Dutton, 2001); Gene Kranz, Failure is Not an NASA robotic missions being launched after 1992, not all of those Option: Mission Control from Mercury to Apollo 13 (New York: Simon & missions were successful. In particular, there were two embarrassing Schuster, 2000); and Thomas J. Kelly, Moon Lander: How We Developed failures of Mars missions in 1999. the Apollo Lunar Module (Washington: Smithsonian Institution Press, 29 2001). Lambright, Transforming Government, provides an early but 14 comprehensive evaluation of the Goldin record. The quote is from p. Brewer, "Perfect Places," pp. 159-165. 28.

Report of the Presidential Commission, Vol. I, p. 148; Vol. IV, p. 1446.

Vaughan, The Challenger Launch Decision, p. 235.

Report of the Presidential Commission, Vol. I, pp. 1-3.15 As NASA human space flight personnel began to become closely 30 Goldin is quoted in Bill Harwood, "Pace of Cuts Fuels Concerns About involved with their counterparts in the Russian space program after Shuttle," Space News, December 19-25, 1994, p. 1. 1992, there was grudging acceptance that Russian human space flight 31 personnel were also skilled in their work, although they carried it out McCurdy, Faster, Better, Cheaper. rather differently than did NASA. Report Volume I August 2003 119

Howard E. McCurdy, "The Decay of NASAʼs Technical Culture," Space Policy (November 1989), pp. 301-10.

Report of the Presidential Commission, Vol. I, pp. 164-177. 17

Report of the Presidential Commission, Vol. I, Ch. VII and VIII. 18

Report of the Presidential Commission, Vol. I, pp. 140. 19

For background on culture in general and engineering culture in particular, see Peter Whalley and Stephen R. Barley, "Technical Work

in the Division of Labor: Stalking the Wily Anomaly," in Stephen R. Barley and Julian Orr (eds.) Between Craft and Science, (Ithaca: Cornell University Press, 1997) pp. 23-53; Gideon Kunda, Engineering Culture:

Control and Commitment in a High-Tech Corporation, (Philadelphia: Temple University Press, 1992); Peter Meiksins and James M. Watson, "Professional Autonomy and Organizational Constraint: The Case of Engineers," Sociological Quarterly 30 (1989), pp. 561-85; Henry Petroski, To Engineer is Human: The Role of Failure in Successful Design (New York: St. Martinʼs, 1985); Edgar Schein. Organization Culture and Leadership, (San Francisco: Jossey-Bass, 1985); John Van Maanen and Stephen R. Barley, "Cultural Organization," in Peter J. Frost, Larry F. Moore, Meryl Ries Louise, Craig C. Lundberg, and Joanne Martin (eds.) Organization Culture, (Beverly Hills: Sage, 1985).

Report of the Presidential Commission, Vol. I, pp. 82-111. 21

Harry McDonald, Report of the Shuttle Independent Assessment Team. 22

Report of the Presidential Commission, Vol. I, pp. 145-148. 23

Vaughan, The Challenger Launch Decision, pp. 257-264. 24

U. S. Congress, House, Investigation of the Challenger Accident, (Washington: Government Printing Office, 1986), pp. 70-71.

Report of the Presidential Commission, Vol. I, Ch.VII.

Mary Douglas, How Institutions Think (London: Routledge and Kegan Paul, 1987); Michael Burawoy, Manufacturing Consent (Chicago: University of Chicago Press, 1979).

Report of the Presidential Commission, Vol. I, pp. 171-173. 28

Report of the Presidential Commission, Vol. I, pp. 173-174. 29

National Aeronautics and Space Administration, Aerospace Safety Advisory Panel, "National Aeronautics and Space Administration Annual

Report: Covering Calendar Year 1984," (Washington: Government Printing Office, 1985).

Harry McDonald, Report of the Shuttle Independent Assessment Team. 31

Richard J. Feynman, "Personal Observations on Reliability of the Shuttle," Report of the Presidential Commission, Appendix F:1.

Howard E. McCurdy, "The Decay of NASAʼs Technical Culture," Space

Policy (November 1989), pp. 301-10; See also Howard E. McCurdy, Inside NASA (Baltimore: Johns Hopkins University Press, 1993).

Diane Vaughan, "The Trickle-Down Effect: Policy Decisions, Risky Work, and the Challenger Tragedy," California Management Review, 39, 2,

Winter 1997.

Morton subsequently sold its propulsion division of Alcoa, and the company is now known as ATK Thiokol Propulsion.

Report of the Presidential Commission, pp. 82-118. 36

For discussions of how frames and cultural beliefs shape perceptions, see, e.g., Lee Clarke, "The Disqualification Heuristic: When Do Organizations Misperceive Risk?" in Social Problems and Public Policy, vol. 5, ed. R. Ted Youn and William F. Freudenberg, (Greenwich, CT: JAI, 1993); William

Starbuck and Frances Milliken, "Executive Perceptual Filters – What They

Notice and How They Make Sense," in The Executive Effect, Donald C. Hambrick, ed. (Greenwich, CT: JAI Press, 1988); Daniel Kahneman,

Paul Slovic, and Amos Tversky, eds. Judgment Under Uncertainty: Heuristics and Biases (Cambridge: Cambridge University Press, 1982);

Carol A. Heimer, "Social Structure, Psychology, and the Estimation of

Risk." Annual Review of Sociology 14 (1988): 491-519; Stephen J. Pfohl, Predicting Dangerousness (Lexington, MA: Lexington Books, 1978).

Report of the Presidential Commission, Vol. IV: 791; Vaughan, The Challenger Launch Decision, p. 178.

Report of the Presidential Commission, Vol. I, pp. 91-92; Vol. IV, p. 612.

Report of the Presidential Commission, Vol. I, pp. 164-177; Chapter 6, this Report.

Report of the Presidential Commission, Vol. I, p. 90.

Report of the Presidential Commission, Vol. IV, pp. 791. For details of

teleconference and engineering analysis, see Roger M. Boisjoly, "Ethical Decisions: Morton Thiokol and the Space Shuttle Challenger Disaster," American Society of Mechanical Engineers, (Boston: 1987), pp. 1-13.

Vaughan, The Challenger Launch Decision, pp. 358-361. 43

Report of the Presidential Commission, Vol. I, pp. 88-89, 93. 44

Edward Wong, "E-Mail Writer Says He was Hypothesizing, Not Predicting Disaster," New York Times,11 Thompson, "The Risk of Groundling Fatalities;" Code of Federal Regulations (CFR) 14 CFR Part 415, 415, and 417, "Licensing and Safety Requirements for Launch: Proposed Rule," Federal Register Vol. 67, No. 146, July 30, 2002, p. 49495. 224 Report Volume I August 2003 March 2003, Sec. A-20, Col.1 program. NASA actually spent $9.9 billion in real year dollars to George Mueller, Associate Administrator for Manned Space Flight, take the Shuttle through design, development and initial testing. This NASA, "Honorary Fellowship Acceptance," address delivered to the sum, when converted to fixed year 1971 dollars using the aerospace British Interplanetary Society, University College, London, England, price deflator, equals $5.9 billion, or a 15 percent cost overrun on August 10, 1968, contained in John M. Logsdon, Ray A. Williamson, the original estimate for phase one. Compared to other complex Roger D. Launius, Russell J. Acker, Stephen J. Garber, and Jonathan L. development programs, this was not a large cost overrun." See Howard Friedman, editors, Exploring the Unknown: Selected Documents in the McCurdy, "The Cost of Space Flight," Space Policy 10 (4) p. 280. For History of the U.S. Civil Space Program Volume IV: Accessing Space, a program budget summary, see Jenkins, Space Shuttle, p. 256. NASA SP-4407 (Washington: Government Printing Office, 1999), pp. 11 202-205. STS stands for Space Transportation System. Although in the years just Report on the Commission on the Future of the United States Aerospace Industry, November 2002, p. 3-3. NASA Agency Contingency Action Plan for Space Flight Operations, January 2003, p. D-2. (excerpts from press conference, Col. 3).

Report of the Presidential Commission, Vol. I, pp. 92-95. 46

Report of the Presidential Commission, Vol. I, p. 152. 47

Weick argues that in a risky situation, people need to learn how to "drop their tools:" learn to recognize when they are in unprecedented situations in which following the rules can be disastrous. See Karl E. Weick, "The Collapse of Sensemaking in Organizations: The Mann Gulch Disaster." Administrative Science Quarterly 38, 1993, pp. 628-652.

Lee Clarke, Mission Improbable: Using Fantasy Documents to Tame Disaster, (Chicago: University of Chicago Press, 1999); Charles Perrow, Normal Accidents, op. cit.; Scott Sagan, The Limits of Safety, op. cit.; Diane Vaughan, "The Dark Side of Organizations," Annual Review of Sociology, Vol. 25, 1999, pp. 271-305.

Typically, after a public failure, the responsible organization makes

safety the priority. They sink resources into discovering what went wrong and lessons learned are on everyoneʼs minds. A boost in resources goes

to safety to build on those lessons in order to prevent another failure. But concentrating on rebuilding, repair, and safety takes energy and resources from other goals. As the crisis ebbs and normal functioning returns, institutional memory grows short. The tendency is then to

backslide, as external pressures force a return to operating goals. William R. Freudenberg, "Nothing Recedes Like Success? Risk Analysis

and the Organizational Amplification of Risks," Risk: Issues in Health and

Safety 3, 1: 1992, pp. 1-35; Richard H. Hall, Organizations: Structures, Processes, and Outcomes, (Prentice-Hall. 1998), pp. 184-204; James G. March, Lee S. Sproull, and Michal Tamuz, "Learning from Samples of

One or Fewer," Organization Science, 2, 1: February 1991, pp. 1-13.

205

Part Three

When itʼs dark, the stars come out … The same is true with people. When the tragedies of life turn a bright day into a frightening night, Godʼs stars come out and these stars are families who say although we grieve deeply as do the families of Apollo 1 and Challenger before us, the bold exploration of space must go on. These stars are the leaders in Government and in NASA who will not let the vision die. These stars are the next generation of astronauts, who like the prophets of old said,

"Here am I, send me."

– Brig. Gen. Charles Baldwin, STS-107 Memorial Ceremony at the National Cathedral, February 6, 2003

As this report ends, the Board wants to recognize the outstanding people in NASA. We have been impressed with their diligence, commitment, and professionalism as the agency has been working tirelessly to help the Board complete this report. While mistakes did lead to the accident, and we found that organizational and cultural constraints have worked against safety margins, the NASA family should nonetheless continue to take great pride in their legacy and ongoing accomplishments. As we look ahead, the Board sin- cerely hopes this report will aid NASA in safely getting back to human space flight.

In Part Three the Board presents its views and recommendations for the steps needed to achieve that goal, of continuing our exploration of space, in a manner with improved safety.

Chapter 9 discusses the near-term, mid-term and long-term implications for the future of human space flight. For the near term, NASA should submit to the Return-to-Flight Task Force a plan for implementing the return-to-flight recommendations. For the mid-term, the agency should focus on: the remaining Part One recommendations, the Part Two recommendations for organizational and cultural changes, and

A Look Ahead on the long-term future of human space flight, the Board addresses the need for a national vision to direct the design of a new Space Transportation System.

Chapter 10 contains additional recommendations and the significant "look ahead" observations the Board made in the course of this investigation that were not directly related to the accident, but could be viewed as "weak signals" of future problems. The observations may be indications of serious future problems and must be addressed by NASA.

Chapter 11 contains the recommendations made in Parts One, Two and Three, all issued with the resolve to continue human space flight.

the Part Three recommendation for recertifying the Shuttle for use to 2020 or beyond. In setting the stage for a debate

206

Columbia in the Vehicle Assembly Building at the Kennedy Space Center being readied for STS-107 in late 2002.

207

Implications for the Future of Human Space Flight

And while many memorials will be built to honor Co- speed. There is great risk in placing human beings atop a lumbiaʼs crew, their greatest memorial will be a vibrant machine that stores and then burns millions of pounds of space program with new missions carried out by a new dangerous propellants. Equally risky is having humans then generation of brave explorers. ride the machine back to Earth while it dissipates the orbital speed by converting the energy into heat, much like a meteor – Remarks by Vice President Richard B. Cheney, Memorial entering Earthʼs atmosphere. No alternatives to this pathway

Ceremony at the National Cathedral, February 6, 2003 to space are available or even on the horizon, so we must set our sights on managing this risky process using the most advanced and versatile techniques at our disposal.

The report up to this point has been a look backward: a single accident with multiple causes, both physical and organizational. In this chapter, the Board looks to the future. We take the insights gained in investigating the loss of Columbia and her crew and seek to apply them to this nationʼs continuing journey into space. We divide our discussion into three timeframes: 1) short-term, NASAʼs return to flight after the Columbia accident; 2) mid-term, what is needed to continue flying the Shuttle fleet until a replacement means for human access to space and for other Shuttle capabilities is available; and 3) long-term, future directions for the U.S. in space. The objective in each case is for this country to maintain a human presence in space, but with enhanced safety of flight.

In this report we have documented numerous indications that NASAʼs safety performance has been lacking. But even correcting all those shortcomings, it should be understood, will not eliminate risk. All flight entails some measure of risk, and this has been the case since before the days of the Wright Brothers. Furthermore, the risk is not distributed evenly over the course of the flight. It is greater by far at the beginning and end than during the middle.

This concentration of risk at the endpoints of flight is particularly true for crew-carrying space missions. The Shuttle Program has now suffered two accidents, one just over a minute after takeoff and the other about 16 minutes before landing. The laws of physics make it extraordinarily difficult to reach Earth orbit and return safely. Using existing technology, orbital flight is accomplished only by harnessing a chemical reaction that converts vast amounts of stored energy into Columbia launches as STS-107 on January 16, 2003.

208

Because of the dangers of ascent and re-entry, because of the hostility of the space environment, and because we are still relative newcomers to this realm, operation of the Shuttle and indeed all human spaceflight must be viewed as a developmental activity. It is still far from a routine, operational undertaking. Throughout the Columbia accident investigation, the Board has commented on the widespread but erroneous perception of the Space Shuttle as somehow comparable to civil or military air transport. They are not comparable; the inherent risks of spaceflight are vastly higher, and our experience level with spaceflight is vastly lower. If Shuttle operations came to be viewed as routine, it was, at least in part, thanks to the skill and dedication of those involved in the program. They have made it look easy, though in fact it never was. The Board urges NASA leadership, the architects of U.S. space policy, and the American people to adopt a realistic understanding of the risks and rewards of venturing into space.

9.1 NEAR-TERM: RETURN TO FLIGHT

The Board supports return to flight for the Space Shuttle at the earliest date consistent with an overriding consideration: safety. The recognition of human spaceflight as a developmental activity requires a shift in focus from operations and meeting schedules to a concern for the risks involved. Necessary measures include:

  • Identifying risks by looking relentlessly for the next eroding O-ring, the next falling foam; obtaining better data, analyzing and spotting trends.
  • Mitigating risks by stopping the failure at its source; when a failure does occur, improving the ability to tolerate it; repairing the damage on a timely basis.
  • Decoupling unforeseen events from the loss of crew and vehicle.
  • Exploring all options for survival, such as provisions for crew escape systems and safe havens.
  • Barring unwarranted departures from design standards, and adjusting standards only under the most rigorous, safety-driven process.

R9.1-1 Prepare a detailed plan for defining, establishing,

transitioning, and implementing an independent Technical Engineering Authority, independent safety program, and a reorganized Space Shuttle Integration Office as described in R7.5-1, R7.5- 2, and R7.5-3. In addition, NASA should submit annual reports to Congress, as part of the budget review process, on its implementation activities.

The complete list of the Boardʼs recommendations can be