Can Effort Be Sustained? : Doubts Linger on NASA’s New Emphasis on Safety

At the National Aeronautics and Space Administration’s white marble headquarters on Independence Avenue, the signs of new times in the Challenger-traumatized space agency are much in evidence.

“IF IT’S NOT SAFE, SAY SO,” commands a vivid poster of a shuttle launch promoting NASA’s newly established, anonymous system for reporting safety problems. “TAKE THE INITIATIVE, NOT CHANCES,” reads another.

In the 32 months since the shuttle Challenger exploded, NASA has undergone an internal transformation, less widely noticed but no less significant than the $1.1 billion it has spent on modifying the shuttle system itself. The once-complacent NASA has adopted a hypersensitivity to safety that, to one senior official, seems almost “a little schizoid” at times.

Yet in spite of the evident blossoming of a new safety ethos at NASA, doubts linger about the depth of its roots and its permanence.

Although NASA safely hurled the shuttle Discovery into orbit last Thursday, a variety of independent analysts have voiced concern that NASA will be unable to maintain the herculean effort that the launch required. Some believe institutional forces are still at work that are likely to erode NASA’s new emphasis on safety once a steady pace of shuttle flights resumes next year, at the scheduled rate of one every six weeks.

At least, in part, the space agency’s top management shares these concerns.

“Everyone is being so damn careful with this launch,” said Noel W. Hinners, NASA’s associate deputy administrator for strategic planning. “But I don’t worry about this launch. I worry about 20 launches down the line. How do you keep up a sustained effort? You can’t legislate human error out of the system. You just have to keep working at it.”

The immediate cause of the Challenger explosion 73 seconds after launch on Jan. 28, 1986, was the failure of a rubber O-ring seal on one of the two huge solid rocket boosters strapped to the side of the shuttle orbiter.

But the presidential investigating commission headed by former Secretary of State William P. Rogers found that the O-ring failure, which NASA had already recognized as a possibility, was a symptom of grave institutional weaknesses in an agency that had allowed expediency and the demands of an impossibly frenzied flight schedule to take precedence over safety.

Apollo Program Cited

If the agency had managed to preserve the “extensive and redundant” system of safety enforcement and quality assurance that prevailed during the Apollo moon landing program in the 1960s and early 1970s, the Rogers commission observed, it might have been able to withstand the “unrelenting pressures of an accelerating flight schedule.”

As it was, the exacting internal checks and balances put in place after the 1967 fire that killed three Apollo astronauts on the launch pad at Cape Canaveral in Florida had, by the 1980s, devolved into what the commission called NASA’s “silent safety program.”

Safety experts, deprived of autonomy within the agency and reduced in numbers by budget cuts, were found to be subordinated to the very organizations they were supposed to check.

Managers in a decentralized shuttle program anchored at the Marshall Space Flight Center at Huntsville, Ala., proved uncommunicative and disinclined to share problems with NASA headquarters. Astronauts, whose lives were on the line and who had played a central role in the Apollo safety program, had slipped to the periphery of shuttle management.

Institutional Flaws Remedied

In the 2 1/2 years since the Challenger disaster, NASA has followed the Rogers commission’s prescription for remedying these institutional flaws.

Shuttle management has been recentralized in Washington. A new senior position of associate administrator has been set up to enforce safety, reliability and quality assurance. Several hundred staffers have been added to shuttle safety and quality control organizations.

NASA has established a hot line for anonymous whistle-blowers, a proliferation of safety committees and a monumental flow of paper work intended to document multiple inspections of every critical part of the hugely complex shuttle orbiter, its solid rocket boosters and its mammoth expendable fuel tank. An intense review of the shuttle hardware has doubled from 748 to 1,475 the list of “Criticality 1” items, the failure of any of which would lead to loss of the shuttle or the lives of astronauts.

Most important, in the view of some experts, is the new role played by experienced astronauts in shuttle management. Rear Adm. Richard H. Truly, who flew aboard two shuttle missions, is now head of spaceflight at NASA. Robert L. Crippen, a veteran of four flights, holds final go-or-no-go authority as head of a 21-member panel that oversees each launch.

Sees NASA Shaping Up

“Yes, NASA has gotten its act together,” observed Rep. Bill Nelson (D-Fla.), chairman of the space, science and applications subcommittee of the House Science, Space and Technology Committee. “As evidence thereof, the fellas who put their little pink bodies on the line and ride it are involved in decision-making.

“On the other hand,” said Nelson, whose district includes Cape Canaveral and who flew aboard the last successful shuttle mission two weeks before the Challenger exploded, “NASA still displays tinges of the institutional arrogance that had crept in, and that led, in part, to the Challenger disaster.”

Several respected analysts outside the agency expressed concern in recent interviews that the bureaucratic forces behind the erosion of the old Apollo system of safety management remain at work in the agency.

“My impression is that they have probably gone overboard in terms of paper work and documentation,” said John Pike, a space policy analyst at the Federation of American Scientists in Washington.

“A lot of this paper work is along the lines of cover-your-ass, and it may not contribute much to safety,” Pike said. “Obviously, this is still a totally open question that’s going to require a careful look over the next year: How much have these changes contributed to paper work, and how much to safety?”

In-House Critique

One of the most detailed critiques of the space agency’s safety reforms has come from the agency’s own ad-hoc committee on risk assessment, whose two NASA members and four outside experts prepared a 70-page status report last July.

While noting a “remarkable improvement” in NASA’s emphasis on safety during the previous year and a rekindling of team spirit and pride, the committee found a number of disquieting weaknesses. Among them: uncertainty that the space agency would remain fully vigilant over safety beyond Discovery’s milestone mission.

The report pointedly observed that “many” managers in the shuttle and quality assurance programs had raised the question of “how to continue the safety effort at an adequate level beyond the (Discovery) launch.”

“It is certain that the level of effort exhibited in the respite between launches cannot be maintained,” the committee observed. It warned that a lasting system “must be set up to ensure that proper consideration of safety risks continues to be made for design modifications, operations and procedural changes.” Otherwise, it said, important aspects of the safety review process carried out for Discovery “may not be accomplished for future (shuttle) flights.”

Urges Long-Term Solution

Citing specific problems, the committee said some of the agency’s safety and quality control organizations had been “temporarily augmented” by borrowing engineers and technicians from elsewhere. It cited an “urgent” need for the long-term development of safety careers in NASA.

Panel Monitors Redesign

During the last two years, a committee of the National Academy of Sciences, the federal government’s premier source of independent scientific advice, monitored the redesign of the shuttle booster joints.

Committee Chairman H. Guyford Stever, former National Science Foundation director, acknowledged in a letter to James C. Fletcher, NASA administrator, that overall safety had been “substantially improved” and noted that there appeared to be “no basis for objection” to launching Discovery.

Beyond the Discovery mission, however, the committee raised several cautionary flags. Stever listed 10 unresolved questions about the boosters’ safety and reliability. He also expressed “disappointment” that, to save money, NASA planned to attach special instruments to the boosters only on the next three flights, rather than six, to study their flight performance.

Moreover, Stever found it necessary to “strongly reiterate” an earlier recommendation that NASA undertake a program to “reduce risks, enhance reliability and reduce costs” of the current boosters, which provide most of the lift the shuttle needs to reach orbit.

Some Voice Inadequacies

Some participants in the academy review came away with doubts about the adequacy and staying power of NASA’s overall efforts at safety reform.

“They have instituted a safety ethos and, from what I can judge, it seems more pervasive and more useful than before,” said one academy expert, who asked not to be named. “But I think it falls short of what people on the outside would like to see, in the sense that the safety people are still off to the side a bit.”

This expert noted that NASA had yet to assign priorities among the 1,475 “Criticality 1” items, based on the actual likelihood of failure. The result is that all are meant to receive equally intense inspection from a limited corps of inspectors whose stamina may be sorely tested by one flight every six weeks, as next year’s schedule demands.

“At some point,” the expert said, “somebody’s eyes are going to glaze over.”

In a still harsher assessment of NASA’s reborn safety program, a respected congressional analyst, who also asked not to be identified, contended that despite all the shuffling of lines of authority and the posters in the lobbies of NASA buildings, “nothing has changed.”

The clearest evidence of the agency’s continuing sense of invincibility, this analyst said, comes from the Kennedy Space Center’s disastrous decision in April, 1987, 16 months after Challenger, to launch an unmanned Atlas-Centaur rocket carrying a $160-million communications satellite during a violent thunderstorm. Lightning struck the vehicle less than a minute after launch, causing it to lurch out of control and break apart.

No Reprimands

Not only was no one fired or reprimanded, this analyst noted, but the senior space center official responsible for the launch was put in charge of the next one.

Hinners, chief of strategic planning, acknowledged that the loss of the Atlas-Centaur “was not a good scene,” but he said that it was one for which many shared responsibility.

“I’m not sure who you’d fire,” he said. “It was a group-think problem. You need clear lines of authority and responsibility, and this has since been cleared up across the system.”

More to the point, maintained Hinners, whose experience reaches back to the Apollo program, the notion that nothing has changed in NASA since the Challenger accident is “entirely wrong.”

A commitment to safety “has permeated NASA,” he said. The internal communications problems between NASA’s outlying field centers and headquarters, and between contractors and the agency, have been definitively fixed, he insisted.

“The lesson we’ve learned here, I hope, is that when we get into building the space station, we don’t repeat these problems,” he said.

As an indication that safety-related information is flowing through the system as it should, Hinners noted, the new, anonymous hot line for safety concerns has had little use. Moreover, he said, the budget constraints that had led NASA to put off fixing the O-ring problem have now disappeared, and the White House has allowed the agency’s safety organizations to expand when most federal agencies are under a hiring freeze.

Faces Personnel Problem

Even so, the agency faces a serious personnel problem: the impending exodus of the disproportionate number of NASA engineers and technicians who are now in their mid-50s to early 60s.

“All the experience is in the older group,” Hinners said. “When these people are gone, we’ve still got the shuttle and we’ve still got the space station. We’ve got to find a way to capture that experience and preserve it.”

The participant in the National Academy of Sciences review worries whether that will prove possible.

“NASA may be setting itself up for a return to the pre-Challenger mode,” he said. “A tremendous amount of authority for deciding what needs to be fixed and how to fix it is down in the hands of these senior engineering people. As they move on, the question is whether--20, 25, 30 launches down the road--when new people have come in, will they have the same appreciation for design safety?”