chptten (Раздаточные материалы), страница 3

Developed by Bell Labsand the Air Force, the system sought to help decision-makers by providing aprobabilistic statement of risk. This computer-aided technique traced the causesof potential malfunctions back through every subsystem to identify parts mostlikely to fail.During the lunar program, however, the Agency had bad experiences with probabilistic risk assessment. When General Electric, using primitive techniques,determined that the chance of a successful landing on the Moon was less thanfive percent, NASA abandoned the practice. Will Willoughby, the head of theAgency’s quality office during Apollo, said “Statistics don’t account for anything.

They have no place in engineering analysis anywhere.” NASA engineerswere uncomfortable with probabilistic thinking and argued that meaningful risknumbers could not be assigned to something as complicated and subject tochanging stresses as the Space Shuttle. Thus the Agency did not normallyrequire statistical assessments for its hardware.NASA used a more qualitative approach called “failure mode effects analysis,”or FMEA, developed by the Agency and Boeing in the 1960s for the ApolloProgram.

It emphasized engineering analysis during the design stage ratherthan risk assessment in the operational stage. Rather than assign probabilityestimates to parts or systems, failure mode analysis identified worst case problems. Engineers could then design critical parts for reliability. Failure modeanalysis worked well during the Apollo Era because NASA had the money todevelop several different designs and then could choose the best.29398THE RECOVERY: INVESTIGATION AND RETURN TO FLIGHTWhen NASA began using numerical techniques, assessments of the solid rocketboosters became political. In 1982 the J.H.

Wiggins Company determined thatthe boosters were the highest risk on the Shuttle and likely to fail on 1 of 1,000flights. Challenging this, the Space Shuttle Range Safety Ad Hoc Committeesaid the study had included data from primitive military solid rockets and thatimprovements made the Shuttle’s boosters likely to fail on 1 of 10,000 flights.In 1983 Teledyne Energy Systems estimated the probability of failure was 1 in100 flights, but a 1985 study by JSC (Johnson Space Center) put the failure rateat 1 in 100,000 launches, a prediction which was 2,000 times greater than theperformance of any previous solid rocket.30 Presidential commission memberFeynman compared informal estimates from NASA engineers and managersand found that the engineers expected failure in 1 of every 200 or 300 launcheswhile the managers expected failure in 1 of every 100,000.

Feynman concludedthat the manager’s “fantastic faith in the machinery” precluded realistic judgments.31Some Marshall veterans attributed the poor judgments to a decline in the technical culture of the Agency. The abandonment of the Arsenal system and theadoption of contracting, the retired German rocket engineers observed, hadmeant a loss of “dirty hands engineering” at Marshall. Karl Heimburg, who hadheaded the Test Lab, believed that the in-house design and development ofprototypes produced more reliable technology than contracting and ensuredthat civil servants understood the hardware.

Walter Haeussermann, former chiefof the Guidance Lab, said that “if the engineer has only to supervise, withoutgoing and directing experiments, he is not as familiar with it. Finally, you get apaper manager.” A 1988 survey of NASA employees found that less than4 percent of professional workers spent most of their time at hand-on jobs and76 percent worked most of the time at office desks.32The presidential commission attributed some of the risky decisions to an “optimistic schedule” for Shuttle launches imposed by NASA and the Reagan administration. The commission found no “smoking gun” that showed that theReagan administration had applied pressure to any NASA official to launch51–L on 28 January.

However the administration and Agency had maximizedtotal flights in order to minimize the cost per flight and please commercialcustomers. The Shuttle had flown 9 missions in 1985, and officials had beenconfident that they could fly 15 in 1986 and 24 in 1990. Consequently they hadassumed the Shuttle was “operational” and safe rather than experimental andrisky, reduced tests to free up money for flying, accepted problems rather thanapply costly fixes, and subordinated reviews of past performance to planning399POWER TO EXPLORE: HISTORY OF MSFCfuture missions.33 After the accident, some in the news media acknowledgedthat they had applied pressure to NASA by criticizing the Agency for missingits schedules.34Marshall personnel were very aware of schedule pressures.

The RIFs of the1970s had made Center personnel sensitive to meeting schedule and budgetrequirements.35 Personnel evaluations in the Agency were based in part on schedule criteria and several Shuttle officials at Marshall and other Centers receivedsalary bonuses for staying within time constraints.36 Marshall engineers usedthe expression “get under that umbrella” to show desire to finish a task ontime.37 Moreover, when the Center had been the source of delays, such as withdevelopment work on the Space Shuttle main engines or launch postponementsdue to propulsion problems, NASA Administrator Beggs had been critical.38Time pressure affected the mentality and decisions of Center officials.

Sneed,assistant director for Policy and Review, recalled that Marshall had been “budgeting to fly” rather than to make long-term improvements. “Because we wereflying the thing at the rates we were,” he recalled, “most of our attention—ourmanagement attention, our engineering attention—was on flying the next vehicle. Maybe more so than looking and saying, ‘Well, how did that last onefly?’ and ‘What is wrong with the last one, and what do we do to make it better,to make it more reliable?’” The Center, Sneed said, “didn’t have time to stopand fix and end flight; you had to continue to fly and try to get your fixes laidand incorporated downstream.”39The pressures had intensified by late 1985.

In December 1985, Jesse Moore,Level I Shuttle manager, set a goal of 20 flights per year by FY 1989 and requested that this objective be the principal item for discussion at the FebruaryManagement Council Meeting. In the meantime Moore suggested that betweenflights NASA should only make modifications that were “mandatory for reliability, maintainability, and safety.” After Marshall had delayed launch of 61–Cbecause of a troublesome auxiliary power unit in the SRB, Arnold Aldrich, theLevel II manager, wrote that the Shuttle program was “proud of calling itself‘operational.’ In my view one of the key attributes of an operational program isto be able to safely and consistently launch on time.”40 During the 27 Januaryteleconference, Allan McDonald of Thiokol recalled, Lawrence Mulloy observed that the 53-degree criteria would jeopardize NASA’s plans to launch24 shuttle flights per year by 1990, especially those scheduled from VandenbergAir Force Base in northern California.41400THE RECOVERY: INVESTIGATION AND RETURN TO FLIGHTNevertheless, Marshall officials denied that they had sacrificed safety to meetthe schedule.

They believed that they had carefully reviewed the joint problemsthroughout the Shuttle’s flight history and that schedule pressures had notaffected their decisions. No Center employee who participated in the 51–L teleconference believed that schedule pressure had affected decisions. George Hardy,the highest ranking engineer present, said Science and Engineering was responsible for safety, not for schedule or the flight manifest. Ben Powers saidthat lab engineers referred to the schedule and money concerns of the programoffice as “bean counting.” Center Director Lucas observed that “there is alwaysschedule pressure,” but “I don’t know of anybody at Marshall who woulddeliberately, knowingly, take a chance just for the sake of schedule.

We hadnever done that before. We’d been called down from launches, and I didn’t feelany pressure and I didn’t think that [for 51–L] there was any pressure.”42Finally, the presidential commission attributed the accident to Marshall’s “management isolation” and a failure to communicate bad news, especially with theLevel II office in Houston. The commission found it “disturbing” that “contrary to the testimony of the Solid Rocket Booster Project Manager [Mulloy],the seriousness of concern was not conveyed.”Aldrich, and Jesse Moore, the Level I manager, said they had not been informedof the launch constraint, the O-ring anomalies on flights late in 1985, the temperature concerns, or the teleconference.

They admitted that NASA had confusing communications requirements, but thought the NASA custom was toreport concerns about criticality 1 hardware. Aldrich also said he had not knownthat the Center had ordered steel SRB cases with the capture feature lip in July1985; the budget channel for Marshall’s Shuttle work came through Headquarters rather than the Shuttle Program Office at JSC.43Although the commission report did not explain the communications problems,Commissioner Feynman did in his autobiography. Center rivalry and budgetpressures, he reasoned, led NASA managers to think like businessmen whowanted only good news.44 In any event, the commission recommended thatNASA improve its communications requirements, strengthen Shuttle management, and “take energetic steps to eliminate this tendency [to isolation] atMarshall Space Flight Center, whether by changes of personnel, organization,indoctrination or all three.”45401POWER TO EXPLORE: HISTORY OF MSFCThe notion that Marshall had a closed culture and had tried to hide the O-ringproblems was believed throughout the Agency.