Columbia Accident Investigation Board Public Hearing
Tuesday, March 25, 2003
1:00 p.m.
Radisson Hotel
8701 Astronaut Boulevard
Cape Canaveral, Florida
Reporting: Keith L. Vincent, CSR
Esquire Deposition Services
Houston, Texas
* See errata notes at end of transcript
Board Members Present:
Admiral Hal Gehman
Rear Admiral Stephen Turcotte
Brigadier General Duane Deal
Mr. G. Scott Hubbard
Mr. Steven Wallace
Dr. Douglas Osheroff
Dr. John Logsdon
Witnesses Testifying:
General Roy Bridges
Mr. William Higgins
Lieutenant General Aloysius Casey (Ret.)
ADM. GEHMAN: Good afternoon, members of the board. We'll continue our fourth in a series of public hearings. This afternoon we're going to be looking at processes and procedures down here at Kennedy Space Center; and we're going to lead off with the director of KSC, General Roy Bridges.
General Bridges, welcome. Thank you for being here this afternoon. Before we begin, I would like to ask you, Director Bridges, to affirm that the information you provide the board today will be accurate and complete, to the best of your current knowledge and belief.
GEN. BRIDGES: I so affirm.
ADM. GEHMAN: All right. Thank you very much. Would you please give us a brief statement as to your background and how you got to be the director of KSC and how long you've been here.
ROY BRIDGES testified as follows:
GEN. BRIDGES: Yes, sir. I took the job in March of 1997. I had previously been on active duty in the United States Air Force for a little over years, having retired in 1996, in July.
During part of my 31 years with the Air Force, I served as an astronaut, with a six-year assignment in Houston at the Johnson Space Center. I flew once on the Challenger, Mission STS 51F.
On my return to the Air Force after the Challenger mishap, I was the Test Wing commander at Edwards, was the Eastern Space and Missile Center Commander here at Patrick Air Force Base. That was the predecessor organization to the 45th Space Wing, and I was also the commander of the Air Force Flight Test Center at Edwards.
ADM. GEHMAN: Thank you very much. If you have an introductory statement, we'd like to ask you to go ahead; and we're all ears.
GEN. BRIDGES: Well, thank you, Admiral Gehman, for the opportunity to make a statement to the Columbia Accident Investigation Board; and then afterwards I would be pleased to respond to your questions.
The Kennedy Space Center is actively involved in assisting the CAIB with recovery efforts, with approximately 250 people in the field in East Texas. We have an average of 120 others on reconstruction in the hangar here at KSC and 100 working on the engineering investigation.
KSC's role in the nation's space program derives from our two assigned mission areas -- space launch operations and spaceport and range technologies. We're responsible for processing the space shuttle from wheel stop until launch, when we hand over the reins to the Johnson Space Center for mission operations. All orbiter major modifications or OMM since March of '02 are performed at KSC, as well. We're also responsible for providing the facilities and capabilities for the processing of shuttles, the International Space Station, and expendable launch vehicle payloads.
These payload processing services vary with the desires of the customers, which can range from being a host to doing detailed testing and assembly. We provide host support, processing, and testing services for a wide variety of microgravity research payloads. As a consequence, we often become involved in assuring the success of these science missions in every way we can where we have resident expertise.
We're also NASA's agent for the procurement of ELV launch services for all NASA payloads and managing ELV launch campaigns for our customers at various launch locations such as Cape Canaveral, Vandenberg Air Force Base, and Kodiak, Alaska.
Briefly, in our role as provider of spaceports and range technologies, we design, develop, and sustain ground facilities and ground support equipment for customers as well as science research payloads and advance technology development projects focused in the areas of fluid systems, spaceport structures and materials, process and human factors, command control and monitoring technologies, range technologies, and biological sciences. We're experts in applying advanced technology to solve our customers' problems.
From here on, I'm going to focus on the space shuttle program exclusively; and let me detail how we're organized to support the program, as well as summarize my role and responsibilities and that of my direct reports. All of the support that we provide to the shuttle program from a vehicle processing perspective is performed by the Shuttle Processing Directorate, led by Mr. Mike Wetmore, who is my direct report or a direct report to me.
Mike and his organization, consisting of 7 civil servants, provide government insight and oversight at KSC of the shuttle contractor, United Space Alliance, or USA. USA performs all of the hands-on work until we enter the final countdown at approximately three days before launch. At that point our launch director, Mr. Mike Leinbach, who reports to Mr. Wetmore, takes charge and directs the final countdown and launch as a NASA-led activity. The one other NASA-led activity or mission activity is the post-landing operation from wheel stop until we have the vehicle safe and towed to the processing facility. The NASA landing recovery director or LRD leads that task. The LRD reports to the launch director.
As you know, the USA contract is managed at the Johnson Space Center. We provide technical management representative or TMR services. That's in the contracting officer's vernacular. The specific duties are delegated to us, and we provide a final assessment of the contractor's performance at KSC to the award fee board run by the shuttle program. The essence of these duties is that we are responsible for day-to-day insight and oversight of USA for the shuttle program at KSC, as well as for leading the specific activities that I've mentioned above.
In addition, we host several JSC and Marshall Space Flight Center directed activities. These include such things as the Marshall Space Flight Center directed recovery and refurbishment of the solid rocket boosters and the JSC-directed Shuttle Program Integration Office and Orbiter Project Resident Office, which provide program level and design center support at KSC.
Several of my direct reports are responsible for providing typical installation services to the Shuttle Processing Directorate, such as communications, facility maintenance, and propellants. Finally, KSC provides independent safety and health oversight of the Shuttle Processing Directorate and its activities via the Safety, Health and Independent Assessment Directorate.
As the center director, I'm responsible for the activities I've outlined above. I receive frequent status reports of major activities involving the shuttle program from Mr. Wetmore and a detailed summary of our status before each Flight Readiness Review or FRR. I sit as a senior member of the FRR with other Office of Space Flight Center directors, and I sign the Certificate of Flight Readiness or COFR after that review.
As you know, I report directly to Mr. Bill Readdy, associate administrator of the Office of Space Flight. I have frequent contact with not only him but with the shuttle program director, Ron Dittemore, and his boss, General Mike Kostelnik. I view JSC as a customer service organization with respect to our relations with the program. I speak with all of these gentlemen about how well we're meeting their expectations as well as how to address typical problems that arise in a complex program such as this. All of the day-to-day business is conducted between the program and my people at the appropriate level.
KSC's No. 1 guiding principle is safety and health first. I'm very active in leading activities to improve our safety performance in all areas of our operation on a daily basis. Our formal tag-up on these activities occurs on a quarterly Safety and Health Council, which I chair. The council consists of the heads of our civil service and contractor organizations such as USA.
Finally, let me summarize briefly by saying that I'm honored to be a part of the KSC work force. It comprises the best launch team anywhere. Our reputation is for making a system work and keeping it safe, and we're all eager to find the cause of this accident so that we can return to flight.
Again, thank you for giving me the opportunity to address the CAIB. As I told you earlier, Admiral Gehman, I'm fully committed to serving you and the CAIB in doing your important work. I believe that everyone at KSC shares my commitment and stands ready to respond to your call for service and information, as needed.
Thank you.
ADM. GEHMAN: Thank you very much, General Bridges. I'll ask the first question, and then we'll pass it around the board here.
I'm interested in chain-of-command responsibilities and authority kinds of questions, and you mentioned the people who are direct reports to you and that you report to Mr. Readdy. Is that correct?
GEN. BRIDGES: That's correct.
ADM. GEHMAN: I understand that. Now, my question is, in parallel to that line, the authority line, could you describe where you get your money from and how you and your -- first of all, does it follow the exact same chain and how do you justify or compromise or adjudicate differences in priorities, and who does that?
GEN. BRIDGES: Well, the budgeting process is complicated, as you, no doubt, realize; but it does involve an iteration of our requirements to the shuttle program via Mr. Wetmore and his business office and a feedback from the program of how they receive those requirements and where they felt that they fit within the overall set of priorities for the entire program. There are several iterations of that as we hone the budget to the point where it's ready to go to Mr. Readdy at the enterprise level. If there are any disconnects, typically I discuss them with my counterparts in Houston at my level; and if we are unable to resolve them, then I typically give a briefing either to Mr. Readdy as a preparation for briefing the administrator. And typically I'll have two or three budget issues that I'd like to see done differently. I think I've been noted for being a champion and an advocate for KSC's top-level issues here that I thought merited that kind of support.
ADM. GEHMAN: Then as far as your responsibilities to the shuttle program, then, you essentially -- if I'm not phrasing this correctly, you go ahead and put it in your own terms -- but you essentially charge the shuttle program for the work you do here -- or "charge" may not be the right word -- but you and the shuttle program agree on the size of the portion of your budget that they're going to pay for to do so much work?
GEN. BRIDGES: Yes, sir. That's generally true. It will certainly be true under the full cost environment, that they pretty much get what they pay for. There are some complexities under the so-called business-as-usual budget structure in that my group of civil servants are funded as a whole funding category and then it's up to me to decide where to deploy those civil servants in order to get the total job done.
ADM. GEHMAN: The second half of my question, then, is whether or not you receive any funding directly from NASA headquarters for perhaps infrastructure or something in here that's not directly related to the shuttle program.
GEN. BRIDGES: Yes, we do. Our construction-of-facilities budget in the past, we on the institutional side have covered a lot of the shuttle infrastructure. They covered some in so-called program direct. As we move into the full cost environment, most all of those things have been rationalized again and things that are uniquely serving the shuttle program are going to be handled as program direct, but over the past few years I've been responsible for quite a few construction-of-facilities projects on behalf of the shuttle program.
ADM. GEHMAN: Okay. Thank you for that. That's responsive. That's what I'm trying to get at.
Can you elaborate more on the kinds of programs that you feel are necessary down here to support our space program that you get funded directly from headquarters rather than the space shuttle? I mean, for example, does the shuttle pay for the guards on the gate, do they pay to have your grass mowed, or do you get that right from headquarters?
GEN. BRIDGES: Well, we charge the shuttle program for everything that I can direct charge them for. Anything that we can meter, we're already direct charging; and we do feel like that's the best way to go because then they're in charge of the consumption and have a self-interest in helping us regulate that. But there are a number of things that I provide as an institution. Security is one of those things. I do get money from the headquarters as part of my installation budget to take care of security. And as you know, over the time since September the 11th, those requirements have been reassessed and we have improved our security environment significantly, at some cost. I maintain a fleet of four helicopters here which are primarily used for supplementing our security force; and those things do, of course, come at the expense of some other things that I could do with that installation money. So that's one example.
We run a number of laboratories here where, for example, we can do non-destructive evaluation of materials, other chemistry and physics type evaluations. Those are partially supported by the shuttle program, but in the past we had a fund called ETB, another acronym, Engineering Tech Base, that provided some of the upfront funding for those laboratories and it was up to me to keep those healthy for our program. So I'm just giving you a couple of examples out of the whole portfolio of things that we do for all the programs here.
ADM. GEHMAN: Okay. Thank you very much.
MR. WALLACE: General Bridges, as a former director of the Air Force Flight Test Center, we've heard a lot of discussion about the relative risks associated with operating the shuttle and whether it is correctly perceived as developmental or flight test activity or whether it's operational or somewhere in between. I would just like your thoughts on that, particularly bringing the perspective of someone who ran the Air Force Flight Test Center.
GEN. BRIDGES: Well, this is a difficult one to answer because, frankly, flying in space and flying in the air are totally different and the vehicles are totally different. There's a small part of the time from 50,000 feet down to the surface which involves a few minutes of shuttle flight where things are pretty much the same. The rest of it is a different ball game, from my perspective.
The shuttle is a combination of some things that are operational and some things that we are still learning about because, after all, we only have a little over 100 flights on the vehicle; and as you well know, in a typical flight test program, that's just barely getting started.
Some of the just avionics equipment that we fly on our aircraft now such as our forward-looking infrared sensors and targeting devices that we use, we flew 2,000 sorties on those pods, getting them ready for a combat environment. So modern airplanes do take an awful lot of ringing-out before we're ready to put somebody in them on a dark and stormy night with somebody shooting at them.
We don't have that opportunity in the space business. So it's quite a bit different in that respect.
MR. WALLACE: I'm going to switch topics here. The simple explanation we've been given as to where control shifts from KSC to JSC is T minus zero; but KSC has a role, we understand, in the immediate post-launch video analysis. My question is: Do you then have a role in identifying and making sort of a final call on something that is irregular or an anomaly or a funny or any of those terms that you use?
GEN. BRIDGES: Well, certainly we are an element of the program and we do have certain responsibilities such as foreign object damage, inspections before flight, and then analyzing the film to see if we see anything in it and reporting that to the program. If there are problems perceived, obviously the program brings in other resources to make engineering judgments about how serious those things are.
You're all well aware that we do write up these debris reports of what we see as well as what we observe on the vehicle once it comes back. And those things are documented and I think you've all seen copies of those. That's all certainly of concern to us, any type of damage to the vehicle that we see after a flight and where it came from. So I'd say our people are pretty intense about doing that.
MR. WALLACE: You know, I understand. Of course, your people are heavily focused, and have been, on this famous falling foam. In addition to providing the video expertise, I mean, do you have a role, then, in deciding whether this thing ultimately gets specifically identified as an in-flight anomaly or not?
GEN. BRIDGES: Not to my knowledge. I'm, of course, aware of those kinds of discussions going on within the program. During this mission I was certainly aware that we had some debris that caused a shower of particles on the wing. I saw the photographs during the mission and I was also advised once that judgment had been made about how the program felt about potential for damage. To my knowledge, we didn't have any direct role in that particular analysis.
GEN. DEAL: I'd like to ask you one general question about being center director, then I'll follow up on Mr. Wallace. Can you kind of describe your relationship with the Marshall Space Flight Center and Michoud in particular with regard to the external tank and, if you have any out-of-family conditions or problem reports that are generated here, how your center deals with them?
GEN. BRIDGES: Well, they are a design center, just like JSC is for the orbiter. So when we find something that's so-called "out of family," we would be dealing with the Marshall Space Flight Center on those items. In an Air Force vernacular, we're kind of the maintenance organization here. If we can take care of something within the tech order, we do it. If it's something out of the ordinary, then we have to get back with the engineers at the design center to figure out how to disposition those particular types of problems. So we work with engineers at Marshall, just like we do those at JSC, to try to resolve any problems we see with the engines or the tanks.
GEN. DEAL: The other is a follow-up to Mr. Wallace. Not as center director but your experience at Edwards and also as an astronaut. If you think that you had, for example, a test aircraft that's flying 112 flights and it's had five panels fall off, you'd probably stand down your fleet, in my opinion, to fix it so you didn't have those five panels fly off. I wanted to try and get your perspective of how we may have had five or more pieces of a particular part of the external tank fall off, yet we continued to fly.
GEN. BRIDGES: Well, certainly we're interested in anything that falls off of test aircraft and anything that could cause a problem, but I will tell you that the desert floor around Edwards is littered with so-called F15 tail feathers which were little flaps around the engine nozzles and other things like that that did not work out too well on aircraft but were not thought to cause damage. And while we really didn't like dropping things on the desert out there, in order to get the test program moving forward, we did not ground the fleet every time we had some minor thing like that happen.
So really, I think, it depends on what the potential for damage was. We have engineers out at Edwards, as well as the program office. If it was a safety issue and I thought it was a severe safety issue, certainly I would engage and recommend that we stop flying until we fix it. If it's not a safety issue, we certainly tried to come up with some kind of a fix to keep them on there because of the potential for hitting somebody or just, well, let's just take them off, you know, until we can figure out how to fix this thing, if we can fly without them. So, amazingly, with developing airplanes, I think we've been through all of those scenarios two or three times during my tenure out there.
GEN. DEAL: So you had a level of comfort, I guess, based upon the analysis presented, that the bipod ramp was not really a safety-of-flight type of issue.
GEN. BRIDGES: To be honest, I did not think that the bipod foam coming off had caused any significant damage in the program to date. I believe it came off about four times before that we knew of. I personally looked at every shuttle that's come back during my tenure here. I've seen no significant damage from any of the foam coming off. It has certainly been a maintenance concern. It's a lot of work to go out and have to repair all of those things, and we don't take that lightly. I mean, we want to get to the root cause of those things and get them fixed.
I personally was not aware there was any safety-of-flight concern with the ramp foam coming off prior to this flight. Had I been aware of that, I certainly would put my hand up at the FRR that we would stop flying. I think this is certainly a surprise to all of us.
GEN. DEAL: Thank you, sir.
ADM. GEHMAN: General Bridges, I'd like to go back and follow up on a question that was asked before -- that is, the role of KSC, the role that KSC has in the processing and the preparation for flight of the external tank. The external tank, it's my understanding, essentially comes here almost ready for flight but there are some processes that KSC does, is responsible for, having to do with the foam insulation on the tank. Am I not correct, that you do do some foam work on the tanks?
GEN. BRIDGES: I'm not familiar with the details of that. So I'm not going to try to get into it; but, yes, I am aware that we have done work on foam. We do do foam repairs. We have dented foam. We have sanded foam in trying to take care of problems. We do inspect to make sure the foam is okay. So there are a lot of things like that we do, but I'm not aware of the exact details of all those particular operations that have gone on.
ADM. TURCOTTE: Good afternoon, sir. Getting back to what we were talking a little bit about your role as essentially the mayor of the center. A lot of facilities. A lot of planning goes into the maintenance of those facilities. A lot of programmatic responsibilities across several lines. Over the last eight years or so, a lot of programs have been up and down. There's been extensions on the orbiter. There's some other programs' deadlines come and gone. A lot of facilities there have been there quite a while. Could you explain to the board today the process by which you have been able to stay in front of this process and planning to keep the ageing facilities going or your lack of ability to do that or the funds that you have that both come through programmatic ends and also through the direct line through NASA headquarters?
GEN. BRIDGES: Well, in preparing for that potential question today, I did review a few things; and I'll have to say that we've been beating the drums pretty loudly and rapidly, since the time I've been here, over what we saw as a coming problem with facilities that need some major maintenance and are going to require a lot of dollars. I did that with the full cognizance of my boss -- first of all, Mr. Rothenburg that was there before Mr. Readdy.
We were getting on average about $19 billion a year for the four years '96 through '99 in our construction facilities budget, which we could tell was just not going to handle this problem, particularly when you have something like a VAB that by itself can eat up over $100 million to get siding and roofs and doors fixed.1 So we started beating the drum and in '00 through '03 we've averaged over $60 million a year in construction-of-facilities funding. While I don't totally trust the so-called BMAR or backlog of maintenance and repair, because there are some squirrels as far as how different people count things, we keep a metric on that and, amazingly, over the last four years the BMAR has been steady or declining.
The one other thing that I took on as a personal vendetta was the large number of square feet of trailers, trailers that have been here for 20 years and we have people living in them. I took a tour of some of those when I first came down here and, frankly, I was appalled and believed that it was a safety issue not only with the facilities themselves but I thought that when you have your maintenance technicians working out of delapidated and rundown facilities where they have their breaks and have their offices and then you walk over into a pristine facility where we keep the flight hardware, there was just some kind of disparity there that I thought was not right and would probably bleed over into maintenance after a while because, after all, our people are our most important asset here for maintaining the safety of the overall system.
So we started going after these trailers; and we now, with programs under construction, buildings under construction, and buildings completed, we've got over 500,000 square feet down to 50,000 square feet. The biggest of those buildings, we just started the construction process. So it will be about two years before people move in, but we've been able to make a big dent into that and we have already cut the ribbon on many of our operational facilities that support people in the shuttle program here.
So I think we have prioritized things pretty carefully. We have gone after things that would have a tendency to pay back full-time. Like if I can quit doing repairs on delapidated trailers, that's more money in repair that I can put in on my more permanent facilities.
So we've done a lot of things like that. We've really charged hard at energy efficiency in order to reinvest that money into maintenance. And I won't bore you with a lot of the other details and programs but we have worked this very hard to stay out in front and I believe that the program and the agency understood what was going to happen and they began to program more resources to go against my facilities -- although I'll have to tell you that it was a thing I laid awake at night a few times, wondering how I was going to get some of these things done. But we did get them done and I think things are on the right track now.
MR. HUBBARD: I'd like to turn to a more general management issue now and talk a little bit about the concept of insight and oversight, especially in dealing with a large contractor work force. Years ago some interpreted oversight as almost a shadow work force in relation to the contractor; and, of course, that's evolved a great deal. Can you tell us a little bit about how you would define those terms of insight and oversight and maybe a little bit about how it's changed with time in your six years?
GEN. BRIDGES: Well, we had to really write the textbook on that, I think, when we decided to go with the Space Flight Operations Contract and turn that into a performance-based contract and move NASA out of the hands-on, you might say, with a level of effort support contractor into doing insight and oversight of a contractor that's leading all the day-to-day activities. Well, we just had to understand this. We did a lot of benchmarking of people and did come up with a risk-based insight-and-oversight system which I think I call world-class surveillance; and it is an overall surveillance system.
The oversight is, simply put, a place where we have in-line approval. That is, the contractor does not do the work before we either approve the document or before we have a set of eyeballs there to watch the work. That was oversight.
Insight is a series of techniques, depending on the criticality. It could be in-depth observation where we want to observe a critical process in depth, you might say, from beginning to end, all the way down to customer feedback where, you know, you send out a survey and find out how somebody likes something. And there are a number of things in between as part of the surveillance plan.
What we have done within the shuttle program is written up a number of implementation plans for our surveillance program that define exactly where we employ each of these techniques, depending on the risk in each of our procedures. Those systems are a closed loop in that we get feedback on the critical ones into our COFR process; and the COFR signature depends on us having completed those things. So, for example, if we're supposed to do 8500 government-mandatory inspection points per flow, if we miss one, that will be an anomaly that we have to explain when we get to the COFR process.
MR. HUBBARD: Okay. To follow that up a little bit, over this same period of time that you migrated one way of managing the contract to another, how has the civil service and support service contractor work force changed in quantity or in types of work that are done?
GEN. BRIDGES: Well, the civil service work force has gone down dramatically because of the shift in our relationship with the contractor and how many hands we need to do the work. The contractor work force has gone down slightly, primarily due to efficiencies we found, just better ways of doing things. And it was a big cultural change for us, as well. We had to work this very hard, and the transition from NASA to the contractor was something that was done very deliberately and with quite a bit of discussing and making sure that they met criteria before we turned things over to them.
So I would say, frankly, making this change is something I doubt that any other government agency has been able to do with a system this complex; and I personally am very proud of the work force here, that I think they have done this extraordinarily well, both on the civil servant as well as on the contractor side. But we worked this very hard.
MR. HUBBARD: As a final follow-up, then, how do you maintain currency or develop new government and engineering talent if they are at arm's length from the hands-on work?
GEN. BRIDGES: Well, it's a difficult problem. I don't think we've totally solved that problem yet. We're still working it. We have tried things such as taking co-ops and letting them work with the contractor down on the floor where we have very young people, fresh-outs; and we have made liberal use of cherry-picking the contractor by take a mid-career person and hiring them after they have a lot of hands-on experience. And I would anticipate we'd make liberal use of that in the future.
MR. HUBBARD: Okay. Thank you.
DR. LOGSDON: I want to talk a little bit about flight rates, Roy. What has been the average flight rate for the shuttle over the past two or three years?
GEN. BRIDGES: Well, we've gone down to as low as three and, I believe, as high as seven.
DR. LOGSDON: What was scheduled for '03 and through core complete on the station?
GEN. BRIDGES: We had initially made some plans to go down as low as four; and I believe now, with the recent budget decisions, that will be five.
DR. LOGSDON: Weren't there more than that planned for between January 1 of '03 and the end of February '04 in order to get all U.S. parts of the station up?
GEN. BRIDGES: You know, we have changed the manifest so many times this year, I'm afraid to say a number; but I do believe at one time we were about six in this fiscal year.
DR. LOGSDON: I guess what I'm getting at is: Was there any sense of schedule pressure with the date, Mr. O'Keefe stressing the date of core complete so strongly as a management tool?
GEN. BRIDGES: Well, it certainly was something that I was aware of as I was trying to make sure that we did not lapse back into that mode. I was, of course, an active astronaut before Challenger and was watching the flight rate go up to one a month about the time I was flying and was aware of the intense schedule pressure during that time frame. So I would say I was pretty highly tuned to trying to make sure we didn't fall back into that situation and worked with my direct reports here on a weekly basis to make sure that we were letting our people know that when we saw anything that was of concern, that our culture was we could put up our hand and stop. Of course, you all know the story here. We saw little cracks in the flow liners, and we stopped. That's just probably the best example of something that we saw and we put the fleet down until we had it fixed.
So I saw a completely different reaction and attitude on the part of not only the work force but all the way to the top-level management in our program of how we dealt with problems that could impact a schedule. So, yes, in fact, we did want to finish the station; and we were on a roll. We would have liked to have finished it in February of '04. It would have been, frankly, a brilliant achievement if we could have done that; but we were not going to let things like flow liner cracks or any other items like that that popped up be, you might say, squashed in order to meet that schedule milestone. I never felt any concern that if we brought this up to Bill Readdy or the administrator, Sean O'Keefe, that they would do anything except applaud us for letting them know that we have a serious problem and we need to take a timeout to fix it.
DR. LOGSDON: Shifting gears a bit, you said you had 377 civil servants overseeing the work of United Space Alliance. How many USA people are involved in shuttle processing?
GEN. BRIDGES: Well, the numbers I have on my sheet -- and you could ask them to get a better clue -- but the end of fiscal year '02 was 6557. That's USA plus subcontractors.
DR. LOGSDON: Here?
GEN. BRIDGES: Here.
DR. LOGSDON: What happens if your overseers are not satisfied with the performance of individual USA employees? Do you have any leverage?
GEN. BRIDGES: We can stop work. We can have the work done again. We can make sure they get a very poor award fee. We are not responsible for hiring and firing and any other discipline that USA might want to take, but certainly we don't have any problem bringing unsatisfactory performance to the attention of their management. I meet often with not only Mr. Pickens but also other heads of contracting organizations where we will discuss things that we're not happy with; and we do that outside of award fee boards.
DR. LOGSDON: Thank you.
ADM. GEHMAN: General Bridges, the number you gave, 6500 more or less, that's contractors?
GEN. BRIDGES: 557 was the USA plus subcontract number that I was able to glean.
ADM. GEHMAN: What is the government work force?
GEN. BRIDGES: The government work force for the shuttle program in Mr. Wettmore's organization is 354 full-time equivalents; but counting temps and terms and other things, we've right now got about 377 belly buttons or faces on board -- I guess that's a nicer way of saying it. And across the whole center, we have, people charging to the shuttle program, 49 civil servants.
ADM. GEHMAN: The trend obviously has been down, but how rapid is that trend? When did this start and what were the big years in transition?
GEN. BRIDGES: Well, it was a steady downward trend at the center from '92 through '99. We went from, in terms of faces, about 2498 people in '92 at the center, had a low point in '99 of 1687, and at the end of FY '02, we're at 7073. That's full-time permanent people, not full-time equivalents.
The shuttle program, primarily because of the shift in our relationship between the government and the contractor and not needing as many doers in the shuttle processing organization -- and it takes a little manipulation of numbers because we've reorganized a couple of times over the years -- we believe went from about 1075 down to 354 in terms of our full-time permanent work force over that period of time, and from about 1433 down to 549 from '92 to '02 in terms of people across the center charging to the shuttle program.
ADM. GEHMAN: I'm not asking for specific numbers here; but when the shuttle processing was shifted from Palmdale out to here, what happened to your government employee work force, in round numbers?
GEN. BRIDGES: I know that USA was on tap to hire several hundred people. I don't know the exact number. That was in negotiation with the program. We were assisting the program to try to make sure we had the right skills and the number of people here, and it was primarily USA hire-up.
ADM. GEHMAN: What about the government side?
GEN. BRIDGES: We did not hire up anything.
DR. OSHEROFF: This is my first question ever on one of these things.
Given the fact that there are roughly USA employees for every NASA oversight person, I'm interested in what the relationship that you have with USA and with the parent organization, NASA, with regard to innovation and changes perhaps in procedures reflecting new information that has come to light.
GEN. BRIDGES: Oh, NASA to date has been a champion of innovation. That was certainly more true in the early days than it is today. We believe that as the contractor got more experience with leading rather than waiting on NASA to tell them what to do that they became a lot more innovative in employing new information technology and other procedures in order to improve how they did work. They were strongly incentivized to do that, particularly if it would save them money.
We in NASA have been very, you might say, pushy in terms of some of the more high-risk technology where you have to make an investment and prototype the technology before someone would be willing to put it on the vehicle. And those are typically things in the upgrade area where you're talking spending several hundred million dollars in order to prototype something and get it qualified before you put it on the vehicle. USA has been less interested in those type of things.
DR. OSHEROFF: So when it comes to, for instance, figuring out how one could deliver larger payloads in highly inclined orbits, who's taking the lead on that job?
GEN. BRIDGES: That's a NASA job; and NASA, as we began to improve the shuttle so that we could do a good job of building the station, went through a number of shuttle upgrades such as the super-lightweight tank that would give us a lot more cargo-carrying capability so we could do the station job. And I would say the shuttle program did an excellent job of that.
DR. OSHEROFF: What part did your center play in those activities?
GEN. BRIDGES: In terms of all of those upgrades, we'll tend to have some impact on how we process the shuttle. For example, if you're putting in a glass cockpit rather than what we call steam gauges, there are going to be changes in maintenance procedures for taking care of those. So our people have to be trained. We have to rewrite our procedures and go through a process of making sure that we understand the new technology so that we can turn it around very reliably.
DR. OSHEROFF: In that process of doing that, where, for instance, does the information tend to come from that procedures have to be changed? Is it from the USA people or from the Kennedy Space Flight Center people here?
GEN. BRIDGES: Well, I would say it's a team effort. We work on these upgrades together. We have gotten far past the throw-things-over-the-fence era; and these days we are working very close together, NASA, USA, Boeing, and whatever other vendor is helping us with this particular upgrade, to put a team in that's looking at the total life cycle of how to do this. So typically things like that that are not a big surprise and are handled fairly seamlessly here. I can't remember one, single big problem with the new glass cockpit on this first launch. Very smooth.
DR. OSHEROFF: Thank you.
DR. LOGSDON: Roy, I think you said in your statement that civil servants take over three days before launch.
GEN. BRIDGES: Yes.
DR. LOGSDON: Let's expand on that a little bit. I mean, does USA totally go away at that point and the ice inspections, the on-pad inspections, and then the actual launch control is all civil servants?
GEN. BRIDGES: No, what I meant to say is it was a NASA-led activity, whereas the day-to-day processing activities are USA-led activities where we only become involved in the insight and oversight. During the last three days of launch, our launch director is directing what amounts to a badgeless team. The team is made up primarily of USA employees taking direction from NASA in the role of a launch director.
DR. LOGSDON: These are different USA employees than the ones doing the processing?
GEN. BRIDGES: They're the same people that sit on console during the processing. They're our first team.
MR. HUBBARD: I'd just like to follow up a little bit more on the changes in the work force over the last six or seven years and where the reduction of some 700 people occurred in the insight oversight of the contract and the contractor. Were those changes primarily in engineering areas, operations, SR&QA, or was it across the board?
GEN. BRIDGES: It was across the board. In fact, this morning I was curious as to that. I really hadn't looked at the numbers in a while and I tried to roughly see whether or not we had downsized the S&MA work force more than, you might say, the average downsizing. Surprisingly, from the numbers I read you earlier, the S&MA people charging to the shuttle program back in this '92 time frame was about percent of the processing work force. Today it's percent. So it actually went up a little bit within the shuttle program of S&MA people.
I would say we're really focused on trying to find the right number for the shuttle processing organization. We went too far. In the summer and fall of '99, I was on guard channel with our headquarters that we're having serious critical skill problems. We had had seven years of downsizing, five buyouts, and we were well down below 1700 people overall; and I began, like I said, making emergency transmissions that I needed to have hiring authority for critical skills.
In December '99, I was advised that I could do critical-skill hiring and, in fact, that my downsizing had been terminated. The next spring we reorganized the center and stabilized the shuttle work force at around this number that I've given you, around 5 people. I think you'll find that since that time we have been pretty rock-solid steady.
My comment has been, well, you know, I think we have distilled this number by fire in terms of what we need. Certainly there can be changes that cause us to reassess this, problems that come up, new work, work that goes away, whatever. So, of course, we have to periodically look at it. But assuming the work requirement doesn't change, then those 375 people approximately will be here and I will be, you might say, the last guy to turn the lights out before we start dipping down into that 375. But we've been holding the line on this.
MR. HUBBARD: Just as follow-up to that. As we know, the space exploration business is terribly unforgiving and part of where a lot of added value can come as you're preparing for a launch or developing a mission is not only looking at the mainstream of the program but also thinking about off-nominal situations. Given that you've gone down to this 375, where does that thinking occur now? And is there still enough to do this in the civil service work force or is it in some other piece of the contractor work force?
GEN. BRIDGES: Well, I think it's both. Certainly we want the contractor to be more proactive in dealing with all types of situations like that. We have certainly encouraged it. I think, as I've indicated by an earlier statement, they've come along and are doing very well.
Our launch director though, as far as contingencies on launch day, we constantly train the entire team with some very high-fidelity simulations about how to handle any and all types of things that we might observe during that time. Of course, time is critical on launch day if we want to preserve the launch attempt -- and there are safety risks, once you put fuel in a tank, for just standing down, although that is always our bailout option. If we can't figure it out, we'll not launch that date; but nevertheless there are a number of minor things that if we really have trained well for them, we can safely accommodate and preserve a launch opportunity. And we have invested considerably more resources into training a team to do that and do some of the thinking.
As you well know, there's also a lot of intellectual time that goes into hazard analyses and FEMA cells and updating of procedures and things like that not only to accommodate minor incidents or close calls that we have but also try to just improve them and make them more robust so that we don't have problems like that.
We have also experimented and done a number of so-called process FEMAs where we will go and look at a fairly difficult process where we seem to be putting people at risk of maybe a sprain, you know, because, you know, they're having to handle a piece of equipment that's too heavy or trying to reach too far. And we've used some of our simulation capability to go out and actually redesign the support equipment to make it easier to do those kinds of operations. So all of those things are part of trying to be more proactive, look ahead, and try to decrease our incident mishap and in-flight anomaly rate.
MR. HUBBARD: Thank you.
MR. WALLACE: General Bridges, my understanding is there's this Launch Readiness Review done here two or three days typically before a launch and the formal Flight Readiness Review is typically a couple of weeks earlier. My question is: Where are the most likely sort of stop points? Because we've been told that in the Launch Readiness Review, there's so much that's gone into the preparation up to that point that it's sort of usual that at the Launch Readiness Review there would be something raised that you weren't already working, something new that stops it. I'm not talking about weather or something that's inherently a last-minute thing. Even issues like you mentioned the flow liner cracks and the BSTRA balls. Where are the most likely stop points in this whole process?
GEN. BRIDGES: Well, the stop points are whenever you realize that you can't make it or that you just have to reassess your approach to a particular launch operation. So they can happen at any time from two seconds before the SRBs light to weeks before the launch. Anytime we run into a problem that is new to us or is going to cause us to have to reassess our plans, if we think we can get that problem solved before launch, we may continue with the Flight Readiness Review and give a progress report on how well we are along with solving that problem, with an understanding that typically at the 0-minus-2 review we have to have the work finished or we will have to delay. And I have seen a number of situations like that where we will run down fairly close to launch, usually not past that point, certainly not past the tanking. We don't tank unless we're ready to go fly.
MR. WALLACE: Most of us never do anything that approaches the complexity of launching a space shuttle. So all the processes involved are almost overwhelming if you come in from outside, look at all these processes and all these check points and all these cross-looking organizations and processes. I mean, my question is whether you can almost get to a point of dilution with so many processes that there comes to be almost an assumption that it will get caught somewhere. I really don't mean to ask a question that's judgmental. I mean, I just want your thoughts on that.
GEN. BRIDGES: Well, the process depends on having very good people of high integrity that are very passionate about their work and don't pass work unless it's been done correctly. I think we've seen over and over through this program that we do have people like that that are working here. That's what makes every flight safe, and we have obviously over 100 examples of that.
We do miss things from time to time; and, you know, we'd like to make our processes more robust, less likely that some miss, some distraction might cause us to do something or omit something that would be important to us. And I would say we are constantly reviewing and trying to make sure that we have the right person at the right time focused on the job to make sure that we have good information that tells us that a process has been completed, all the data from the process is in family, and it's just a matter of checking off each one of those things, using this work force of very high integrity, very focused people.
Yes, it's certainly quite an accomplishment that we are able to do this safely; and it would be nice if we could find ways to use new technology that would make it less cumbersome, less labor intensive, and less prone to human error. Sometimes those new techniques or tools bring their own complexity, certainly in trying to integrate them into something like the processing operation we have at KSC. For example, if you tried to take our current systems while we're flying and replace them, it is sort of like getting a heart transplant while running a marathon. So we have to be very, very careful about how well we test and those kind replacement systems; and we have to be very deliberate about any changes we made. But I think in comments that we've gone over today, I believe that we have demonstrated that we have been able to do relatively major changes in a very safe way.
ADM. GEHMAN: General Bridges, did I understand you to say that your current government work force is something like 350 people, civil servants?
GEN. BRIDGES: My current KSC work force is 1850 people.
ADM. GEHMAN: But in the shuttle program.
GEN. BRIDGES: In the shuttle program, we have, counting temps, terms, and co-ops, 377 people.
ADM. GEHMAN: Once again, this is not a test. How many of them approximately are in the S&MA world?
GEN. BRIDGES: We charge about 100 of those.
ADM. GEHMAN: About 100 of them.
GEN. BRIDGES: Right.
ADM. GEHMAN: Would you estimate that, by and large, most of those 100 are oversight kinds of people -- I mean they're checkers, they're people who sign off on processes and procedures?
GEN. BRIDGES: These are primarily our safety and quality assurance technicians and their management.
ADM. GEHMAN: My question is: Of those hundred, would you say that most of them are people who are involved in the signing-off of processes and procedures?
GEN. BRIDGES: They're there observing and, yes, stamping and signing off things; but I would like to, if I could, just add to that. Since we've gone to this performance-based contracting approach, all the rest of the people in the organization are involved in some type of insight or oversight activity. That's all we do other than, like I said, the two NASA-led activities that we have. So this is why we felt comfortable in reorganizing our safety and mission assurance organization, is to try to get more synergy between our traditional safety and quality assurance technicians. Now with those engineers they are also out observing the contractor and doing the insight and oversight role, trying to increase the team work and the communication among those because, in essence, that entire organization now is doing an S&MA type activity.
ADM. GEHMAN: However that's organized, is the safety and mission assurance person a direct report to you?
GEN. BRIDGES: We have split out our safety and mission assurance so that the people that are involved in stamping and doing things and supervising the contractor, like all the other people in that organization, report to Mr. Wetmore, that people. We have an independent assessment organization with a direct report to me that does the independent assessment of how well they're doing their insight and oversight job, and that's additional people beyond that 100.
ADM. GEHMAN: That's a nice lead-in. What exactly are the duties and responsibilities and size of this independent assessment office?
GEN. BRIDGES: The total office, we call it Safety, Health, and Independent Assessment, is on the order of 65 people. At the time of STS 107, we had a very experienced senior executive service leader of the organization. We also in the organization have other high-grade people, SESs or similar high grades, that, for example, one is our chief safety officer for the center and our safety ombuds. We also have our chief systems engineer in that organization that does engineering oversight of all of our development projects, and we have an organization that does all of the audits and assessments for all types of audits and assessments. And we draw on those resources, whether it be for safety or for an ISO 9001 business system or some other type of program.
ADM. GEHMAN: And they are all government employees? None of this is contract?
GEN. BRIDGES: These are all government employees, and we have tried to be selective in that the grade of the organization is a cut above the average in our work force and all of the people are highly skilled so that they will be sought out for their consulting ability as well as, you know, they occasionally have to render a judgment on whether or not folks are complying with things.
ADM. GEHMAN: I'm going to change subjects on you now. In the SFOC, the Space Flight Operations Contract, how are awards to the contractor determined?
GEN. BRIDGES: I'm not the expert on this. So it's a program function.
ADM. GEHMAN: First of all, it's a program function.
GEN. BRIDGES: Yes, it is. So it's not a function that I do here, although Mr. Wetmore does make an input into the program of how well the contractor has done.
ADM. GEHMAN: Even the processing part of it is a program function, not a center function?
GEN. BRIDGES: That's correct. There's a consolidated award fee process for the shuttle program. We have one of the inputs into that. That goes together with the other inputs, and a score is recommended to the fee-determining official, who is General Kostelnik at the headquarters.
ADM. GEHMAN: Okay. So the award levels are determined at NASA headquarters, based on inputs from lots of people.
GEN. BRIDGES: Right. The fee-determining official is General Kostelnik, who, of course, is over both the shuttle and station programs but who's stationed over in Washington.
ADM. GEHMAN: Okay. Is there anybody besides the shuttle processing manager, Mr. Wetmore, from here, who makes a formal award fee input?
GEN. BRIDGES: We also make an award fee input on logistics, integrated logistics from here; and at one time when we were doing the checkout and launch control system project, we were making an input on that. But that's no longer being done. That project was canceled.
ADM. GEHMAN: I'm going to change subjects again on you. The shift from shuttle processing from Palmdale to here, the board has been told that the number of employees who moved with the function was something in the order of 15 to 20 percent of the work force. I haven't got that number pinned down, but does that sound like what you've been informed?
GEN. BRIDGES: I couldn't say.
ADM. GEHMAN: Are you aware of any work centers, KSC shuttle processing work centers that, due to lack of experienced, mature workers, were in any way under closer supervision or closer scrutiny just because they just didn't have the experience when you started processing shuttles? Were there any procedures to identify work centers in which you had essentially all new employees?
GEN. BRIDGES: Well, I'm trying to make sure I've got this correct. Now, I know there was some concern over the movement of Boeing personnel from Huntington Beach to Houston where people were given extra supervision. That really didn't have anything to do with me here; and while I was insistent on having those metrics as a member of the Flight Readiness Review Board and certainly followed them to make sure that we had a good skill base for doing that work, I think it was a completely different situation with regard to the OMM. We have a very highly skilled work force here for doing the type of work we do at OMM, and to me it was a matter of just supplementing the work force that we have to take on the extra work when we were going to be processing all four orbiters here. I don't think that we were underskilled in any particular area nor were we at risk in any area. Had we been, it would have been a schedule issue rather than any type of safety issue.
DR. LOGSDON: You mentioned earlier, a little bit, facilities. We all know that there are discussions, certainly pre-accident, of flying the shuttle 10 to 20 more years. What kind of facilities investments and improvements will you need to be able to do that?
GEN. BRIDGES: Well, we had a conference on that last Wednesday and Thursday in New Orleans where we are looking in depth at the shuttle life extension program. This is the first year that we've taken a very rigorous look at it, although there have been many studies on this from time to time in the program. I believe the new process that we have kicked off will be very useful in making sure that we really get the highest priority capital improvements in the program to make sure that we can safely get to 2020. So I was very impressed with the process that General Kostelnik inaugurated, and I believe that it will serve us very well.
So what kind of things do we know of here? Frankly, we have some big dollar items that are not very sexy, like a new roof and siding and doors on the VAB. That's a very, very large dollar item. Those type of things did not get much discussion at the conference last week because they're pretty cut and dry. As I mentioned earlier, I think that we're getting pretty good support for those here.
Activities that I spoke of at the conference that I feel like we need more attention to are things that would help us be more predictive and proactive. For example, I would like to see a much stronger fleet leader program in other areas than the engine so that we could predict things like flow liner cracks and not have those be a surprise to us downstream. So as a general category, I would put that at the very top of the list to try to make some investments in those type of test facilities and additional resources to make sure we do that very well.
ADM. GEHMAN: General Bridges, these orbiters are now 20-plus years old; and as they go through processing, it's possible that you will begin to see symptoms in these orbiters, as they go through the KSC processing facility, that are similar to what you had in your previous experience in the case of ageing military aircraft. The most obvious is corrosion, which is already well inspected for. All of us have had our heads into wing spars and things like that where corrosion is looked for; but there are many, many other signs of ageing aircraft. Do you believe that you have the infrastructure in place, that is, the non-destructive test equipment, the non-intrusive types of measuring devices, and the time to make an evaluation of whether or not these aircraft are ageing?
Someone told me, for example, just informally, that Columbia, for example, had spent, if you added up all the time she sat out on the launch pad, she was out there for over 2 1/2 years altogether -- not continuously, obviously. And in between every time, she was gone over with a fine-tooth comb. Nevertheless, that's a lot of time to sit out there in the Atlantic Ocean environment. So are you content, or are there some things you're going to have to do in the processing facility in order to make sure these shuttles are safe to fly for this extended period that's been proposed?
GEN. BRIDGES: Well, I think, to answer your question very directly, that we do need to invest in additional non-destructive evaluation equipment and have state of the art here in order to do a very good job of that; and that was one of the projects put on the list at this select panel last week. I am a little more concerned, though, about the more, you might say, nontraditional things. I think we tend to know how to inspect for corrosion; and, yes, it would be nice to have the latest equipment to do that so we don't have to tear the vehicle down any more than absolutely necessary and so that we can get in some of the difficult environments that we have to get into. But I think this issue of this being a first of a generation of reusable launch vehicles, that the fleet leader program being done more comprehensively would tend to help us spot things that could be very long lead recoveries.
This flow liner thing was -- it took the best in the agency for us to be able to pull that through that in a few months. And it was a spectacular achievement but you can imagine in some cases if we had to go re-manufacture some of the parts we have here, if they're not on the shelf, it could be quite a lengthy downtime. So we would like to get more out in front of that, as well as to avoid some kind of a nasty surprise which would not be just grounding but perhaps would have resulted in some kind of a mishap.
ADM. GEHMAN: Well, the board thanks you very much, General Bridges. I hope that you will pass on to your entire work force the respect and admiration that we have for how hard and how diligently people are working on this tragedy. We spent the morning at the J hangar, looking at debris, and came away quite impressed with the zeal and the professionalism, the energy that's being displayed out there and in the OPF and every other place that we've been. So please pass on our thanks and admiration for the hard work, and I know that you have got 250 or 235 of your people spread out all over Louisiana and Texas that are also helping in the debris recovery effort. They're away from home. So we realize how much effort is going into this. So thank you very much.
GEN. BRIDGES: Certainly will pass it along. Thank you.
ADM. GEHMAN: We will take about a four-minute break while we seat Mr. Higgins.
(Recess taken)
ADM. GEHMAN: We're going to hear from Mr. Bill Higgins from the KSC Safety Division.
First of all, Bill, before we start, I would like for you to affirm to this board that the information you provide today will be accurate and complete, to the best of your current knowledge and belief.
MR. HIGGINS: I so affirm.
ADM. GEHMAN: Would you please tell us who you are and what your job is and how long you've been there.
BILL HIGGINS testified as follows:
MR. HIGGINS: My name is Bill Higgins. I am currently the chief of the Safety and Mission Assurance Division and the Shuttle Processing Directorate at Kennedy Space Center. I've been at KSC since 1987. I started with NASA in 1983. All of those years have been in various safety and reliability and quality engineering and management positions.
ADM. GEHMAN: So you are the chief of safety in the shuttle processing division?
MR. HIGGINS: Yes, sir.
ADM. GEHMAN: Is there also a KSC chief of safety?
MR. HIGGINS: Yes, sir. In the Safety, Health and Independent Assessment Office, the associate director for Safety and Mission Assurance is in that office; and that is the chief safety officer also.
ADM. GEHMAN: What's your relationship to that person?
MR. HIGGINS: They do an assessment of our performance and --
ADM. GEHMAN: Maybe I'm getting ahead of you here. You probably are going to cover it.
MR. HIGGINS: No, that won't be covered. This is just about us. Their job is just to watch and see what we're doing and we take some advice from them and if they find deficiencies or noncompliances, we'll correct those.
ADM. GEHMAN: Before I launch into questions, why don't I go ahead and invite you to make an opening statement and then we'll save our questions.
MR. HIGGINS: I don't really have an opening statement. I was asked to provide an overview of safety, and I have a few slides here. If you'd like, I could go over those.
ADM. GEHMAN: Yes.
MR. HIGGINS: All right. I'm going to go over the safety and mission assurance roles that we have at KSC. This is very brief. The KSC Safety and Mission Assurance function, we have just a couple of significant deliverables, even though there are quite a few different things that we do, and I'm going to show you briefly what our KSC shuttle processing S&MA organization is.
The roles that we have, there are two main players in safety and mission assurance and shuttle processing at Kennedy Space Center. The first one is United Space Alliance. They are the Space Flight Operations Contractor. This is a performance-based contract, as Mr. Bridges stated. They are responsible for the vehicle processing and they are responsible for quality control. When they step up and talk about the vehicle is ready, they're the ones who state the vehicle is ready.
They are also responsible by contract for all the personnel safety in the USA areas. So for all of the personnel that is, for instance, in the vehicle assembly building or the processing facilities, those are USA facilities and they provide the institutional safety responsibility in those areas, including the NASA people that go in there. The NASA people that go in there must follow their rules.
The NASA KSC, we're responsible for final acceptance of designated critical hardware at specific points in the processing and we do that through the government mandatory inspection points and we are responsible for evaluating the contractor performance of their assurance function. And that's our insight function. We utilize those inspection points in that assessment, but we do other assessments and audits of their programs and processes to make that determination.
On the KSC side, we have three main functions. The first one is a Certificate of Flight Readiness. The requirements for that flight readiness come from NSTS 08117. That is the space shuttle requirements and procedures, and also the KPD 8630, which is a Kennedy Space Center document, which describes how KSC shuttle processing certifies and reports to the LRR and the FRR.
We also do the shuttle safety and mission assurance award fee, and there are two processes that we use. KBP-P is a Kennedy process. We have a surveillance plan for the Space Flight Operations Contract and then our particular division has its own implementation plan for that and that is what provides the information to the technical management representatives as to how the contractor has performed in this award fee area. We provide an input to Mike Wetmore in terms of ground operations, and to (unintelligible) in terms of logistics, and also to Bill Harris, the safety and mission assurance TMR for the program on our view of the safety and quality of the program here at KSC.
We also have in my organization another function which is the procurement quality. That is governed by the Federal Acquisition Requirements and the NASA FAR supplement. The vast majority of the people that are working in the procurement quality group do shuttle procurement quality. They go to vendor sites. They manage the DCMA delegations to those sites, in addition to being there themselves.
ADM. GEHMAN: Okay. Let me interrupt you, Bill. I'll admit to being a little confused. Is this a center function you're talking about here, or is this a program function?
MR. HIGGINS: These functions are all in support of the program.
ADM. GEHMAN: They're in support of the program, but are they part of the program?
MR. HIGGINS: It is a delegated function from the program.
ADM. GEHMAN: From the program manager?
MR. HIGGINS: The program manager. Yes, sir. There's a letter of delegation to Mr. Wetmore on safety and mission assurance and -- well, actually for his entire ground operations. There is also a delegation from Bill Harris, the TMR for safety and mission assurance, to Mr. Wetmore. That delegation basically flows directly to me. It's a program delegated function that we're providing.
ADM. GEHMAN: What you got me confused here is this referencing of Kennedy processes rather than program processes.
MR. HIGGINS: The Kennedy Space Center is ISO certified and our business practices include the use of documented procedures. So in order to keep a consistent process for the development of those products, our particular organization at Kennedy Space Center develops those procedures. They are reviewed and accepted to make sure they meet both the business practices at KSC and the program requirements; and then when they're approved, that is what we execute.
ADM. GEHMAN: Go ahead.
MR. HIGGINS: Okay. Our significant deliverables. I provide a signature not on necessarily the Certificate of Flight Readiness -- there are quite a few endorsements that are required in that. I actually sign two of them -- one for the ground operations. That is for Mike Wetmore. I support his signature to Certificate of Flight Readiness. And I also sign the safety and mission assurance readiness statement for the program. All of the centers sign -- all of the center S&MA people sign that one also. That Certificate of Flight Readiness signature is based on program requirements, and what we are stating in that particular signature is that we have completed our required activities. There is a long list of activities that we are required to do through our delegation; and if we have completed those, then we can sign that delegation. We do not sign stating that the vehicle is ready to fly. We sign that we have completed our activities. That activity includes the hardware inspection that we have done. If the hardware has not passed all of the inspections or the inspections have not been dispositioned appropriately and they have not passed, we would not be able to sign that certificate.
The other deliverable that we have is an award fee evaluation. That is based upon our evaluation of USA's performance versus the contract requirements, and that is subjective and objective in nature. We have some metrics that we review. We also have objective looks at different programs and different things that USA does for safety and mission assurance and provide that input, like I said, to the program S&MA manager, the ground operations TMR, and also the logistics lead at KSC.
This is the organizational structure. This is my organization. I report to Mike Wetmore, as Mr. Bridges said. We have 107 authorized people in this division. The numbers are going to be a little different than what Mr. Bridges reported, basically because he's talking about the actual charges. We have people that are on military leave and leave without pay and other things, which drops the numbers a little bit; but the people, actually I'm authorized to have people on the rolls. And right now I do have people on the rolls, even though they're not all necessarily at work at their desk every single day.
The Mission Assurance Engineering Branch is headed up by Russ DeLoach. He has the safety and quality engineering functions, and we will get into a little bit about what they do. The Safety and Process Assurance Branch headed up with Ronnie Goodin has people. That is ostensibly the safety specialists, the operational safety people who go out on the floor and monitor the operations of United Space Alliance to make sure that they follow the rules in terms of performing safely.
The Supplier Quality Branch is headed by Terry Smith. That is our procurement quality function. There are thirteen people there. Several of those people are located around the United States and closer to the vendor sites, mostly for shuttle vendors.
The Quality Assurance Branch has 3 people. It's far and away the largest people. It's headed by Bob Hammond; and that is the branch of our quality assurance specialists, the folks who go out on the floor, review the work being performed, and stamp the work paper attesting to the work properly being performed.
I have two charts here. Basically they show our program. This is basically our quality program. The system engineers are also in the same directorate we're in. We consider them a partner in terms of what we do in terms of quality. Basically it starts with them. They determine what's important about the systems that they are responsible for. They will modify the OMRSD, which is the Operations and Maintenance Requirements Support Document. If I have that wrong -- we talk in acronyms all the time now. They'll modify work authorization documents; and they provide the purpose, any rationale, and acceptance criteria associated with things that are important about the system which they need assured to be correct in order for us to fly safely.
That information is partnered with the quality engineering folks. We have four quality engineers and one quality engineering technician. Given that information, they are the ones, in conjunction with the systems engineering, they will modify the QPRD, the Quality Processing Requirements Document. That tells the contractor where to put the inspections in their work paper.
They'll determine the surveillance method. Inspection may not be the methodology utilized. They may use a sampling method in auditing. We may use a different type of assessment. In some cases where the risk is low, we may wait for a customer complaint, even though that's a very rare occurrence and hardly ever happens on an on-flight hardware piece of equipment. And they also do risk assessments associated with the decisions that are made in terms of how we're going to do our quality.
That information then, if there is an inspection performed, then that is done by the quality assurance specialists over here in this block. That's the mandatory inspection points. We have 62 quality assurance specialists who actually have stamps, who can stamp the paper and "buy the work" is the terminology. They can accept or reject the hardware and/or the procedure based upon the work authorization document and/or contract requirements. There may be specifications, other measurements and things that are in that work authorization document that the work has to meet. If it meets it, they accept it. If it is not met, they do not accept it; and unless it's accepted, we do not press on. Often when they have work that's not accepted, a problem report is generated on the hardware, the hardware is fixed, the problem report is dispositioned, and then the hardware can be accepted.
Two other things we can do in our quality program associated with the processing is that we do some hardware surveillance. It is done as available. As you might expect, that is done by our quality assurance specialists. However, their main priority is the mandatory inspection points. So they do not have the luxury of being able to meet random activities associated with hardware. They can only go and look at hardware when they are not being utilized for mandatory inspection points. So when they are out, we do not create a surveillance trending type of program, statistically based. It is merely a matter of going out and looking in areas where work is going on, looking for an improper hardware condition, and then they will initiate a resolution.
If they find something wrong, a PR will be generated. It's an additional set of eyes to go see some things not necessarily generated by an in-flight inspection. They look for improper hardware environment. Also it could be something from the hardware or it could be that people are working, for instance, without their certification cards demonstrating their training, that they have been trained to perform certain tasks.
Another thing that we have -- and this has been added in the last couple of years -- is what we call process surveillance. The process surveillance are audits, both scheduled audits that take place on probably a three-year basis or a one-year basis, depending upon the risks associated with the activity, assessments which are similar to the audits, generally not as broad. We do have some process surveillance that we use in surveillance of the processing of the main engines. And we'll do some -- the PRACA is the Problem Report And Correctible Action system data. We have that, and we review the metrics that the contractor generates to see if there is anything in there that would constitute for us a reason to take a look deeper.
One of the things here we'll see is you see a little note there's an E-mail concern to PHP management. What we have found is that if we're looking at these vast amounts of data that are being developed in PRACA or any other data sources you look at, things look alike pretty much all the time. It's the same types of things and the same types of systems. You know, we're going to see wiring scuffs. We're going to see corrosion, those types of things; and any processes that generally cause us problems, they generally are covered through our scheduled audits. So what we also do is if there's any type of concern that our quality assurance specialist sees on the floor and they don't understand why it's what it is -- or it could come from engineering or actually anybody else -- we will initiate an assessment and that assessment will look at the processes associated with it and the requirements of those processes and see if the contractor's in compliance.
So we don't wait to see trends necessarily. If we see a trend, it can kick off an assessment. Literally, we tell people if you feel that something is awry, we will authorize an assessment to go look at it. Since 2000, when we started this program, we have never told anyone, no, we will not take a look at that. We have told some people that it's already been looked into, but we haven't turned that down at all.
The other thing up here is the procurement quality, and they develop and manage the DCMA delegations. They do audits and risk assessments associated with vendor activities.
ADM. GEHMAN: Why don't you spell out what DCMA is.
MR. HIGGINS: Defense Contract Management Agency. It is the defense quality assurance function that we hire.
DR. LOGSDON: Can I ask you a question about this slide before we leave?
MR. HIGGINS: Yes, sir.
DR. LOGSDON: Over in the corner. Hardware Surveillance. How often do you find an improper hardware condition or improper environment?
MR. HIGGINS: It happens. I would not say it's a routine occurrence, but it does occur. We don't find a lot of improper hardware conditions in the mandatory inspections, and we have 8500 of those in a flow. There is not a large number of discrepancies found. Then when we go off and look on our own and generally -- and all of the critical activities are covered with the mandatory inspection points. These are less critical activities. However, we do find some things. It does happen. We have not found anything I would say is a show-stopper in the hardware surveillance.
DR. LOGSDON: No mission-critical kind of stuff that have showed up in this process.
MR. HIGGINS: We've found some things that have to be fixed. Okay. You know, we fix everything we find. Are there some things? Yeah, there have been some things that could have caused us some problems. Mission critical? Really critical? I wouldn't go that far, but they were important and, you know, we don't treat them trivially.
DR. LOGSDON: So your mandatory inspections are not 100 percent?
MR. HIGGINS: No, sir. There's 500 points in a shuttle flow that we will look. There are several hundred thousand actual steps that are worked in the processing.
DR. LOGSDON: So the surveillance is kind of your safety net?
MR. HIGGINS: Yeah. The United Space Alliance has responsibility for quality control, and they inspect considerably more work steps than we do. As a matter of fact, on all of the mandatory inspection points, United Space Alliance has already been there. Often it's done side by side, but it's never done without them. They've either done it first or they've done it with us. And they're always responsible first. We are, for the mandatory inspection points, another set of eyes for those critical items that are deemed necessary to look at.
GEN. DEAL: If I can address that real quick. It's noted on there as variables, which kind of throws out the meaning of "random" perhaps. When we go back to the Shuttle Independent Assessment Team report, they talked about the diving catches that they had to make on some different things and that's probably what that applies to. I guess the bottom line of my question is: Do you have enough people? Would you prefer to have more people so that you can accomplish more hardware surveillance?
MR. HIGGINS: Well, if you can convince Mr. Bridges to provide me with more people, I would be more than happy to accept them. However, basically what happens is that if you look at the flow of a vehicle -- and I'll get to the answer to your question, but I just have to meander a little bit. If you look at the flow of the vehicle, there are a lot of mandatory inspections toward the end of the flow. There are considerably fewer at the beginning of the flow. As a result, the workload of our quality assurance specialists ebbs and flows. There are times when literally our quality assurance specialists are not called upon to do mandatory inspection points. When that is happening, they can do that. There are other times, when it lines up just right in terms of vehicles and flow at the right times, that I don't have enough quality assurance specialists to meet the demand; and literally they shut down work and wait for us. It's a cueing theory problem. So the only way I could do that to the point that I wouldn't hold up work would be to have so many quality assurance specialists I would always have -- except for that rare occasion where everything lined up exactly right, I would always have idle people. They could do hardware surveillance. However, if we look at the concept of mandatory inspection, mandatory inspections are on the critical hardware. It's a risk-based inspection process that determined that that was the appropriate time and place for them to do it.
The other hardware surveillance that we're doing is being done on things that have been deemed to be less critical. They are certainly still important, but they're less critical. So it's a matter of how much resource would you like to put into the activity. We like to put in all that we can, is basically what we do. There are times when we have quite a few people that can do hardware surveillance, and there are times that we don't have enough for our mandatory inspection. Does that answer your question?
GEN. DEAL: Sure.
ADM. GEHMAN: Can you go back one more time here?
MR. HIGGINS: Sure.
ADM. GEHMAN: We heard from the chairman of the Shuttle Independent Assessment Team panel, Harry McDonald, who indicated in the assessment that they did, particularly of some main engine failures and things like that, that the PRACA data was not useful. You couldn't go back and trace a problem and you couldn't research into the data. It was hit or miss. It wasn't continuous. If I understand his testimony correctly, there were cases where things that were problems for a couple of years ceased being problems and you weren't able to do an audit to see who said that that's not a problem anymore. It just stopped being a problem. You don't own the PRACA process, but you use it. I would like to know what your experience is.
MR. HIGGINS: Well, my experience with PRACA is that each item, each problem that is found and documented on PRACA is a complete and total story in and of itself. It is dispositioned. It is either fixed or there is a reason why it cannot be fixed or it is basically brought back to print or there is a significant explanation.
ADM. GEHMAN: Or it's waived.
MR. HIGGINS: Yes, it could be waived.
ADM. GEHMAN: But in any case, there should be an audit trail.
MR. HIGGINS: For that particular problem, yes. I don't have any knowledge that any particular problem does not have all of its information or any particular process. Now, if you were to pile all those problems together, I can't tell you specifically if there is anything that's done to integrate that activity; but I do know that each problem is handled completely. I'm not familiar with the problems that Mr. McDonald saw. That was before I was a part of this process.
MR. WALLACE: If I can follow-up on Admiral Gehman's question. In the PRACA data, are there levels of severity or levels of urgency? Is an in-flight anomaly going to be in the PRACA data along with a bunch of other things?
MR. HIGGINS: Well, that's a difficult question to answer because it turns out that there are quite a few different instruments that document problems and, depending upon what you find when you find it and things like that, an in-flight anomaly could result in a PRACA being generated if it was determined that there was a hardware issue that PRACA was appropriate for. Some in-flight anomalies can be dispositioned without PRACA being generated. They work together; however, they're not necessarily one to one for that. But in-flight anomalies, they're handled similarly at the program level such that in-flight anomalies, when they're identified, they are dispositioned by the program with either corrective action or waived, if there's a requirement violation, or in some cases they could be unexplained but the risk was deemed to be minimal or nonexistent and therefore accepted.
MR. WALLACE: Does your organization, then, have a role in that disposition process?
MR. HIGGINS: We have the role in terms of IFAs or anything else that is deemed to have been originated with ground operations. If that's the case, then we will be involved in the disposition of that IFA, yes, as a participant in the board.
MR. WALLACE: The PRACA data base, is it somehow supposed to systematically feed into the FRR process?
MR. HIGGINS: That's a level of detail I'm not real familiar with. I can tell you what we do with it is that we review the process that generates the PRACA and we do sample records in the PRACA data base to assure that it is being done properly. As far as PRACA data automatically feeding into the Flight Readiness Review or the Launch Readiness Review, not as a data set but as an individual problem that was developed, if it's not dispositioned properly or is not dispositioned at the time of the LRR, it is discussed and could hold up the flight.
MR. WALLACE: Does PRACA, in a sense, become -- or is there another place where we sort of list questions or issues that need to be resolved prior to the next launch?
MR. HIGGINS: I don't want to be speaking as an expert on this because it's not really our function. We do participate in this, but it is the program function. And basically at the LRR and the FRR, what we do go through is all the in-flight anomalies and the closure of those anomalies that happened with the last flight and also for the last flight of this particular vehicle.
MR. WALLACE: So the LRR and the FRR, you go through a closure, you said, of in-flight anomalies. Does that mean, then, that something is identified as an in-flight anomaly will get specifically addressed perhaps more systematically than whatever else might be in the PRACA data?
MR. HIGGINS: I wouldn't say more systematically. I would say they follow a very similar process. It's just a different group of people responsible for that disposition.
DR. OSHEROFF: Well, I would like to get a bit more specific, if I could, because I frankly don't see where some of the kinds of problems that have been appearing are covered by the sorts of inspections and certifications that your people have been doing. An example is the shedding of foam, because it doesn't occur before launch and, in fact, I would guess that you would be hard pressed to find much evidence for anything wrong before launch in the first place. Could you tell me what the history is, as far as you're concerned, regarding foam shedding?
MR. HIGGINS: As far as we're concerned, Mr. Bridges talked about our involvement in the foam. I really can't speak any further on that. Ostensibly, the tank comes to KSC relatively ready. We do have to mate it. There is some foam repair that's done. There is some open work on that when it is turned over to ground processing.
Prior to ground processing, the program handles the tank through their Marshall program element; and they have safety and mission assurance functions with that. That's just not part of our contribution to the program. The Marshall Space Flight Center provides that safety and mission assurance function; and the disposition of the foam shedding, the risk assessment associated with foam shedding, the effect it has to the program is something that's worked between the program element at Marshall and their safety and mission assurance with the program itself. The Kennedy Space Center and our safety and mission assurance is not a player in that. If we identify defective foam, we identify that it needs repair, then it will be repaired; but the overall history of that is the element program at Marshall.
DR. OSHEROFF: So I would conclude that you had rather little to do with the issue of foam shedding in any way?
MR. HIGGINS: Yes, sir. If what we find through our activities is that the foam is meeting the specification as we look at it, then we press on.
DR. OSHEROFF: There was, of course, a launch video taken of STS 107, which showed a large piece of foam coming off; and presumably that was identified by people here at Kennedy Space Center. What happened after that?
MR. HIGGINS: My understanding is that the information is passed on to the Johnson Space Center because it would affect the orbiter. Then it's up to the orbiter element in the program to determine the risk associated with that event. The Kennedy Space Center -- and I'm not a part of that video review -- it's my understanding that the Kennedy Space Center has all that video and does the first review and then sends it to the Johnson Space Center for further analysis. I'm not familiar with the level and depth of the analysis that we do at Kennedy Space Center in total.
ADM. GEHMAN: Before we leave this -- eventually you will get off this viewgraph, I suspect. I don't see the words "probabilistic risk assessment" up there anyplace. Am I in the wrong church here or something, or is it just draftsmanship?
MR. HIGGINS: Probabilistic risk assessment has not been used much at the Kennedy Space Center in terms of ground processing. The reason that we have not really gotten involved in that too much is that, from a processing standpoint, I consider every activity to be basically binary. Either it passes or it fails, and 100 percent must pass or we don't fly. So when you get into probabilistic risk assessments and things like that, what's the probability of this thing not working or what's the probability of this thing failing, well, it is our premise that we have checked everything and every single thing that we have checked is ready to go. If it was not ready to go, we stopped until it was. I think that's the nature of the launch business where you basically can't come back. It has to work that time. There's plenty of redundancy built in. All those critical redundant systems are checked also. They all have to be performing, and it's either all or nothing in our launch decision.
So probabilistic risk assessments are generally not utilized in the ground processing. There have been some attempts to look at probabilistic risk assessment in terms of some activities. For instance, scrub turnaround and what is the probabilistic risk associated with scrubbing a flight, turning it around, and getting it ready for the next flight in the next day or two. There are some risks associated with that. You have to de-tank, tank it back up, and then the risks to people.
We approached that and there was some question with once you had that information, then what would you do with it. Obviously you're not going to fly if you're not ready, but you're going to have to turn it around if you're going to have to get it ready again. So it was difficult for to us find the appropriate place to put probabilistic risk assessment into the ground processing. It has been and is being used considerably with the vehicle system; but the ground processing and the ground hardware, we have not found a significant utilization of it.
MR. HUBBARD: Just a quick follow-up to something you said a minute ago. The tank and presumably all the other hardware that arrives here that is someone else's programmatic responsibility -- and particularly the external tanks since that's been the subject of a lot of discussion -- do any of those S&MA inspectors that were part of the fabrication come along with it and look at it here or they ship it to you and you take a visual inspection and say whether it's good to go or not?
MR. HIGGINS: There is work that's done here at the Kennedy Space Center that is not under the auspices of ground operations, associated with other elements; and they have inspections associated with that. In some cases they'll use DCMA to perform inspections. I'm not familiar with them bringing people from Michoud, for instance, to come with the hardware.
MR. HUBBARD: So, in general, the external tank, for example, again, would be shipped here, arrive here, and you start processing it and unless you see something that is obviously out of spec, it just goes through the flow?
MR. HIGGINS: Well, there could be open work.
MR. HUBBARD: Final closeouts.
MR. HIGGINS: Yes. There could be some work that needs to be done on it that wasn't done at its origin, that basically followed it -- you know, there was open paper, there was work to be done, it was decided that a better place to do that work would be at the Kennedy Space Center. So we will perform that work -- and I shouldn't say we. United Space Alliance would perform that work here at the Kennedy Space Center. But that particular activity, until it's turned over to ground processing for the stacking and that bit of repair that needs to be done, is under the auspices of the program at Marshall.
DR. LOGSDON: SSMEs and external tanks are not part of SFOC. They're separate contracts, I believe. When they get here, when the engines get here, when the tank gets here, are they integrated by USA people or somebody else?
MR. HIGGINS: Yes, they are integrated as a vehicle by the United Space Alliance and ground operations. That's a major function of ground operations is to prepare those items for integration and launch, and I believe it's a direct contract from Marshall for the tank. It's a direct contract to Lockheed for the tank.
DR. LOGSDON: But it's not Lockheed people that integrate, that make the tank; it's USA people here?
MR. HIGGINS: USA does the mating of all the elements in the stack, yes. That's correct.
ADM. GEHMAN: Why don't you proceed.
MR. HIGGINS: Sure. One last slide is basically the safety function that we have. We have safety engineering, we have an integration function, and we have safety specialists. The engineers manage their safety requirements, and the program does not prescribe safety operational requirements. That's up to the center to do that and we manage the requirements associated with how -- rules associated with processing to keep our facilities safe, people safe, those types of things. We will do risk assessments and reviews on anything that's deemed to increase risk in terms of hazards.
The Kennedy Space Center, the ground operations portion of the program is responsible for ground support equipment; and so we will develop and provide ground support equipment. That equipment has to be analyzed for safety, single failure points, the failure modes and effects analysis. That's done here at Kennedy by United Space Alliance, and we assure that those analyses are done properly and that the risks are properly accepted by the program. We're part of that process.
The S&MA integration basically is responsible for the development of those two major products, the COFR signature and the award fee and the other supporting products. And then the safety specialists are our eyes and ears on the floor associated with watching the operations of the contractor and assuring that they're following the rules. There used to be, I think, quite a few more of these people; and they used to be almost black-hat policemen type. We have only five safety specialists. We monitor specific hazardous operations and make sure that they're following the rules during those particularly hazardous operations, and they also provide significant amount of the launch and landing support on the runway, that type of thing for launch and landing.
That's the brief overview that I have for the program itself.
ADM. GEHMAN: Okay. Let me ask a question, going back to something you said earlier. I hate to be dense about this. You've attempted to tell me this twice already. Maybe the third time it will work. I'm still confused about who you work for and what your organization does, because what confused me was the answer to a question that you gave to one of the other board members when you said if General Bridges wanted to give you some more people, you would know how to put them to work. I thought this was a shuttle program. I thought this was shuttle program and shuttle funded, in which case you should have said: "If Mr. Dittemore wants to give me some more people." Or have I got it wrong?
MR. HIGGINS: Well, you've got me on this one. It's really Mr. Bridges gets the work force complement from the agency; and it's divvied up based upon customer requirements. So if Mr. Dittemore requests more people for the shuttle program, if additional funding is provided, then Mr. Bridges can hire more people and he can send them over to us.
ADM. GEHMAN: Or the other way around, I assume.
MR. HIGGINS: Or the other way around, yes, sir.
ADM. GEHMAN: Yes.
MR. HIGGINS: I'm not sure how it worked the other way where Mr. Bridges would sign up more people, then just ostensibly charge Mr. Dittemore for them, you know, added to that. I don't know how that would work. But Mr. Bridges basically is, I believe, the official associated with the overall head count at the Kennedy Space Center. There are customer requirements and requests that come in that can do that, but I believe that we're not under specifically a full cost accounting type of accounting for all of your people. So I'm not exactly sure the entire mechanism for getting people. But it's not so simple as, Mr. Dittemore, if you have a few extra dollars, we can get it. It's a complicated process, the civil service to do that. Because I'm not an expert on personnel but it does seem complicated to increase the head count associated with a center with the projects and programs that are going on. It's just not a simple correlation.
ADM. GEHMAN: All right. Let me thank you for that. Let me try this again then. Who is your direct reporting senior?
MR. HIGGINS: I report to Mike Wetmore, the director of shuttle processing.
ADM. GEHMAN: And he reports to Mr. Dittemore.
MR. HIGGINS: He reports to -- his supervisor is Mr. Bridges. He is delegated technical management responsibility for the shuttle program.
ADM. GEHMAN: Technical. Right.
MR. HIGGINS: From the shuttle program and Mr. Dittemore.
ADM. GEHMAN: All right. Thank you.
GEN. DEAL: I've got a few for you. You touched a little bit on the metrics that you do. Could you kind of give me an idea of what kind of metrics you review and then, more importantly, what levels are exposed to those metrics, all the way from the technicians up to management in Washington, D.C.?
MR. HIGGINS: Well, that's a broad question. I'll do the best I can. We review the metrics associated with institutional safety type of things first. Those come in routinely, how many injuries they're having and things like that. Some of the other metrics that are reviewed have to do with problem reports. Those are normalized to see if we're getting an increase in number of problem reports, PRACA generated for a particular flow. We'll look at work force maximum work time deviation where people work longer than 12 hours a day, 16 hours a day, longer than so many hours per week, per month. Those types of metrics are reviewed to see if we're stressing the work force. And we work those with the contractor in terms of if we see anything that appears to be a problem or could cause us some problems in the future, we'll talk to them about what they're doing about it.
United Space Alliance is quite a forward-leaning safety activity. They watch those metrics at a much lower level. They get right down into the units, the working units, and have generally quicker information than we do; and so we see it at a higher level. When we talk to them about it, they're generally already dealing with it at the lower levels where the specific supervisor and group of people is having some difficulties.
Some of the major metrics like lost time injuries and things are shared with headquarters. There's a report put out by the Safety and Health Independent Assessment Office that has a compilation of those and other metrics across the center that are sent to headquarters. Our review has to do with looking at them to see if we have any problems that we need to work with them prior to -- well, during a flow, if we see any problems, whether or not we need to initiate any assessments on our own. I'm not familiar with discussions or any other activity that would take place at another level. For instance, with the metrics that are sent to headquarters, I'm not familiar with the discussions that they have up there based on those metrics.
GEN. DEAL: Do you have a level of comfort that a technician, for example, working on the external tank would know about a safety concern on an SRM? I mean, is it that level of cross-tail?
MR. HIGGINS: I personally can't be certain of that. I'm not familiar with that level of communication on the floor. My general knowledge of what goes on out there is that they do have knowledge of what they are responsible for. The contractor does go to considerable effort to communicate information, and some of the people do move around somewhat. That kind of specific problem associated with that, if it was relatively major, we all know about it and the technicians would have it. I would say that, in general, that the information is available to the technician. How it's specifically handed to them, I think it varies on the severity of the problem; and if it's a severe problem, we'd all know about it. And if it was minor, it might just be available.
GEN. DEAL: One more follow-up on the GMIPs. It's kind of history of how we got to where we are. You talked about hundreds of thousands of steps, but the number of GMIPs has been decreased by about a third, down to 8500. Do you know of any examples of when we have increased the GMIPs and, if we did have more QASs, would we have more GMIPs?
MR. HIGGINS: Well, we have increased inspection points on wiring, for instance. We have recognized that certain aspects of wiring, the only way you can check it is by putting eyes to it. That has increased. If we had more quality assurance inspectors, I suppose that we would be more liberal in our look at what types of things would be inspected. I think I would characterize it differently, however, as that I would like to see more in terms of fine-tuning of the inspections that are done. I think you can go out to any quality assurance specialist that works in our division and they would legitimately tell you that they look at things that don't mean very much and they watch people do work that they're not invited to watch that they think is important. And I think every single one of them could give you an instance of that. I don't believe that we have, you know, thousands and thousands of instances like that. I think there are several. And I think if we could spend the time and energy honing in on those that need to be done and eliminating those that don't add much value, I think there will be a change in the number of inspection points. And I don't really believe it would be a significant jump in either direction.
The process that we used to come up with the 8500 was pretty rigorous and risk-based, based upon the criticality of the hardware and our ability to check it further in the flow. So they were basically limited to that, as close as we could get to the very end, the very last point, to make sure that what we were stamping off was good hardware, not some intermediate point for the NASA MIPs. So I think some fine-tuning would help. And if we did fine-tune it, we might need more quality assurance specialists. If we fine-tune it, we might need a few less. I would guess we would probably need a few more, as opposed to the other way around.
MR. HUBBARD: I would like to talk a little bit about the review process, just take on the Flight Readiness Review as an example but there are always a lot of others. I would like to have you talk a little bit about how minority viewpoints get surfaced, both on the government side as well as on the contractor side, and how are they disposed.
MR. HIGGINS: Well, the minority viewpoints are put on the table. I have not seen them suppressed. All of the information goes on. It is discussed. The right people review this -- the system engineering, the design centers. It's a pretty thorough process of a review.
When you get to the FRR, the expert people who do that have all had hours and hours and hours of discussions; and the FRR is generally, from my perspective as almost a spectator, it's basically a summary of all of that activity. The minority viewpoints that were discussed are generally, as far as I can tell, are put out for everybody to see and that they are told in that summary what was decided as a result of that opinion. Generally, what I have seen is that there is a significant amount of analysis and there's some work involved in putting away every single concern.
I think there are cases -- the BSTRA balls were one -- where someone, after all was over, said, "I'm still not comfortable. We can fly, but I'm not comfortable. I would prefer to see every single BSTRA ball." Okay. We heard that at the FRR. There was an awful lot of analysis on the table associated with what to do about the characteristic of the cracked BSTRA balls, the probability of BSTRA balls being cracked, what would be the failure modes. All that information was out there. So I don't see any suppression. I don't see any suppression, and I see a lot of conversation and discussion going on.
MR. HUBBARD: Now, how much insight do you have into the tiers of reviews that go on, leading up to the FRR? As someone who has signed a Certification of Flight Readiness, I know it's a big deal and there's a ton of reviews that lead up to that point. Within the contractor side of the house in which there are thousands of people and dozens of reviews getting up to the point where everybody decides that we can go fly, in those USA reviews or other contractor reviews, do you have somebody there; or are those done through the performance-based process and just brought forward to you as the government oversight?
MR. HIGGINS: I will try to answer that through the LRR process, which is the Kennedy Launch Readiness Review prior to the Flight Readiness Review that's done by the program. For the Launch Readiness Review, all of the different activities that need to sign that endorsement provide their status of their activities that led them to be able to sign; or they have to stand up and say why they can't sign if there's something that's wrong that has not been taken care of.
That being said, we are all pretty much focused on taking care of our activities to make sure that we can sign that COFR. We also do some insight into other people's signature of that COFR from an S&MA standpoint. For instance, the operations people have a pre-LRR review of metrics with USA; and we participate in that. We go to make sure that they do it and see how it's done. The engineering group will have a pre-Launch Readiness Review associated with their surveillance that they've done, the in-depth observations; and the in-depth observations that they were scheduled to perform and they didn't perform, they must provide rationale as to why they didn't perform and it and then why it's okay. You know, what did they do instead? It's not like, well, we missed it; forget about it. It's like, well, we missed it and so what we did is that we went back and reviewed all the test results, we checked the inspection record -- they have to go back and do something other than watch the activity. So we make sure that they have gone through that process. So we participate in some of the other groups that have to sign also.
We also participate in United Space Alliance's, their pre-readiness review activities for safety and mission assurance both for their Kennedy part and then we participate in the United Space Alliance safety and quality mission assurance. They call it SQ&MA. They have a program-wide review for USA, and we participate in that to get insight into whatever we can see for the entire program.
MR. HUBBARD: So at the lower-tier reviews, it is more -- spot-checking is not quite the right word -- it's selected participation as opposed to an across-the-board function?
MR. HIGGINS: Yeah, it's selected participation. You know, we concentrate on meeting our responsibilities first, and obviously we spend the vast majority of our efforts making sure that we have met our responsibilities. But we do spend time and energy participating with others who have to sign also to assure that the products they're providing is reasonable. Yes, we do support them.
MR. WALLACE: I'd like to shift to your role, your input into the SFOC award fee, the contract award fee. We have been told there are various safety thresholds that, if you go below, you won't get any fee at all. It seems it presents a dilemma in terms of you want full safety reporting, IFAs or whatever else. Are metrics like IFA something that are a part of that award fee determination?
MR. HIGGINS: I can't speak for the final scoring of the award fee associated with safety or quality. I have not participated in that other than provide input. That is done by the program in Houston and in Washington. I provide our objective and subjective input to that. It's possible that we could provide input on an in-flight anomaly that we thought USA handled improperly that would be a negative award fee hit. We could also provide input to in-flight anomalies that they handled well that we said would be a positive award fee input.
MR. WALLACE: There's never a perfect way to write a contract, but do you see a dilemma there, where there's some perhaps incentive to under-report safety issues?
MR. HIGGINS: This has been something that's been discussed and worked over many, many years; and if I can digress for just a second, if you go back quite a few years, you would have a culture at the Kennedy Space Center, if you were to ask that question, "Who's responsible for safety," they would point their finger over to the guy with the green hat that said "Safety" on it and said that's the person responsible for safety. In those days when they reported things, then you would have that kind of culture where people actually under-reported because they weren't responsible for safety, and so it was just a different culture associated with this. Today if you were to ask somebody, "Who's responsible for safety," the answer would be, "I am," from every single person out there. I think you would be hard pressed to find somebody who would give you an answer other than that.
Under that culture, reporting is rewarded to a certain aspect. There are rewards given to people who report things that turn into significant fixes or significant improvements, and never do we punish anyone for reporting anymore. That change in culture of "I'm responsible for safety" has permeated itself throughout the entire work force and the management structure and how we deal with reporting.
While we can deal with individual events and talk about whether or not that particular event was preventible, should it have been preventible, did you do a good job before the fact and after the fact -- those types of things can be dealt with on a positive and negative basis, but we do not treat the reporting of those activities as anything but positive. As a matter of fact, Mr. Bridges, well, at the quarterly that he mentions, if the numbers of your close calls is going up, Mr. Bridges notes that as a good thing. We want a reporting culture, and we encourage a reporting culture.
MR. WALLACE: We've been told also that, as opposed to award provisions, penalty provisions, severe penalties for loss of vehicle, that those penalties are dependent upon sort of a fault finding. Is there a different standard at work there?
MR. HIGGINS: I'm familiar with the clause in the contract that has that. I'm not familiar with the philosophy that is utilized to come up with that. I believe that there is some -- if there is an incentive out there to cut costs, I think the logic has to go in hand with that that there must be some incentive to remain safe. Given that as a quick base is that those types of penalty clauses were put in probably to achieve that balance in some form. You have to balance the incentive for saving money with the balance for being safe.
ADM. GEHMAN: Okay. I'll ask the last couple of questions, and then we're going to have to move on here. In a number of reviews, published reviews of NASA events -- for example, the Rogers Commission that looked at the Challenger explosion and this Harry McDonald study, the SIAT that we mentioned before -- there are editorial comments in there about a series of events that are attempting to send messages -- remember the famous O-ring seal leaks -- they had been leaking for many, many flights before the Challenger disaster -- and that the system either doesn't recognize or can't hear those messages. You have to stand back from the shop floor. Just like you said, there's 100,000 processes and 8500 check points; and you said it's a binary problem. If every one of those is done right, the thing will fly right. Not necessarily. That's what these reports tell us. So my question is: Where in the organization should we look for that group of people who are standing a while back from the shuttle and are not looking at it through a -power magnifying glass to find whether or not foam-shedding is a message that's being sent or something else, nuts and bolts falling off? I don't know what it is; but whether or not there are messages being sent to us, where is that organization and where is that place in the food chain that we should be looking at that?
MR. HIGGINS: That's a very good question. I'm not sure I can answer that specifically because that would be program and agency functions that are above me.
ADM. GEHMAN: That's a fair answer.
MR. HIGGINS: I can tell you my impression of where those types of things are is that there is activity that I can recognize that performs some of those functions in shuttle integration that takes place in Houston. There is some launch integration that takes operation at KSC. Flight integration that takes place at JSC that steps back a little bit from each individual element and looks at the whole, so to speak. There is also the independent assessment function that is performed by Code Q through center activities that is supposed to take a step back and take a look at some of those things and provide information.
ADM. GEHMAN: Thank you. That's a fair answer.
Another question. Take the BSTRA ball example as a case in point. Is your organization manned with sufficient people and money to independently review an engineering solution or an engineering analysis or, let's say, a disposition or a waiver which the program wants to grant? Are you manned with sufficient people and sufficient money to get outside experts to do a risk assessment in order that you can go to some of these councils? What I'm saying is when you go to one of these review boards, the engineers will come up with, you know, all this much data and say, "Okay, we're going to waive that problem because we've certified that this is okay." Do you also come in with 18 inches of studies and analysis and say, "Not so fast"?
MR. HIGGINS: No, that is not the responsibility that we have. Not to say that that responsibility doesn't exist in the program. It does. It just is not mine. That belongs to the assurance functions that are associated with the element and the element program. For instance, the BSTRA balls would be the orbiter and the orbiter safety and mission assurance function at Johnson Space Center.
ADM. GEHMAN: Actually I kind of misled you a little bit on that issue. I was referring to something that is in the shuttle processing universe. You're right, I should restrict my question to something that's in the shuttle processing universe.
Let me give you another hypothetical then -- and I know how dangerous hypotheticals are. One of the questions I asked earlier to Mr. Bridges about ageing aircraft. Ageing aircraft has safety ramifications, and the effects of ageing aircraft are very hard to detect. They're very subtle. So let's restrict ourselves to the universe of the processing facility. Are you managed and equipped to come in with independent studies to suggest whether or not all of these safety ramifications are being addressed or not?
MR. HIGGINS: The answer to that is probably yes and no. If you're looking for a large-scale, massive effort, immediately the answer is no. If the question is could I get that, the answer is yes. I do believe I could go both to the program, to the agency, through the center. We have other organizations at the center that have that. I do not normally have a funding line to go off and go purchase that type of activity. I would have to go request that and get it separately. I don't have any support service contractors that I could just add a task onto and say, okay, provide some experts and let's go off and do something. It could be done; it's just not routinely done for us.
ADM. GEHMAN: Okay. Now, I'm going to go down one more level and ask the same question. My understanding of how the system works is that there are certain things, certain kinds of repairs which are called standard repairs, and then there are others which require an engineering process -- and I don't remember what the name of the engineering process is. Does your team up here have sufficient manpower and ability to conduct independent analysis to second-guess or to challenge the engineering department from calling something a standard repair?
MR. HIGGINS: I think in some areas, yes, we have. It's not so much the staffing and so much the expertise. If you look at the organizational chart and you're looking at the engineering numbers, they're pretty small. So the engineering numbers being what they are, there are areas that our people have experience and knowledge in and can challenge quite reasonably well. There are other areas that we're just not the experts. With the six, eight engineers that I have, I just can't possibly have that many areas of expertise. Where we have a lot of expertise in is, for instance, lifting devices and we have significant expertise in lightning and we participate quite heavily in activities associated with that. When it comes to some of the other areas, we're not going to be as readily available to provide analysis. We would have to go off and get some funding and get some outside experts to come help us. We could use our Safety, Health and Independent Assessment organization to help us procure that activity. We might even request them to perform it, and they would go get it. That's another possibility. It can be done; it's just not something that I have a significant amount of in-house expertise on.
ADM. GEHMAN: Thank you very much for your patience with us this afternoon, Mr. Higgins. I know we've asked you a whole lot of what seems like pretty basic questions, but it's very helpful for us to get to the bottom of this. I certainly was struck by some of your introductory viewgraphs there where you indicated how important you and your people take this mission and how key safety and mission assurance is to the safety of the program. I certainly salute that and recognize it.
I will also tell you that as a group, every time we have gone to the shuttle processing facility, the logistics center, anyplace, we've all been impressed by how safety seems to be on everybody's mind. So thank you very much. Thank you for your help this afternoon.
We're going to go right on to the next witness, Mr. Al Casey, if he's here, and jump right in.
General Casey, thank you very much for helping us this afternoon. We appreciate it very much. As I did with the other witnesses, I will just ask you, before we begin, to affirm that the information you provide to the board today will be accurate and complete, to the best of your current knowledge and belief.
GEN. CASEY: I do so affirm.
ADM. GEHMAN: All right. Thank you very much. Would you tell us a little about your background and your area of expertise, please.
ALOYSIUS CASEY testified as follows:
GEN. CASEY: Yes. I had served 34 years in the Air Force, worked in several aircraft development programs; but of interest to your work here, I had three tours in the development of Minuteman 2, Minuteman 3, and MX or Peacekeeper missile. My last tour was as commander of the Space Division in the Air Force. I have 15 years consulting since then and have done a lot of work on a lot of different programs, looking at system engineering relative to both aircraft and missile systems.
One other thing, in my consulting work I was also on the board as an outside director and chairman of the board of NTS, a national testing organization for test specifications, mostly in aerospace hardware. I'm no longer with that. I'm an independent consultant. Today I have retired from there.
I have put my thoughts -- are we ready --
ADM. GEHMAN: Go ahead.
GEN. CASEY: I have put my thoughts into a short series, eight total, slides. It turns out that the shuttle -- I'd like to point out the upper left-hand corner, it shows an X. I had there a little cartoon of an MX, just to make sure that everybody knew that I was not masquerading as an expert in manned space systems. My expertise is all in expendable launch vehicles and ICBMs.
To talk about shuttle reliability, it is demonstrated at .984 -- that is, two failures in something a little bit over 100 flights. .984 is a factor of 2 better than most of our unmanned launch vehicles. On average, they've been about .95, or five failures for a hundred. That's pretty good. That shuttle record is really pretty good, considering that it is at risk both in the ascent and in the reentry, which we don't have to worry about on an ELV, an expendable launch vehicle.
I believe that very high reliability is achieved by two things: Redundancy and margins. Now, if everything is perfect in the assembly and tests, you still depend upon redundancy and margins for things that can happen in flight. And there are things that can happen relative to either the environment being more stressful than you thought it was going to be or the hardware not quite being up to the capability you thought was in it.
In the case of the shuttle, the redundancy has already been built in where it's practical, I believe. The margins have already been built and designed in, and they are verified in qualification tests. I'd like to talk a little bit more about that in the later viewgraphs.
I did say that .984 is pretty good; but, in fact, I don't think it's good enough for optional human flight operation.
Now, if you talk about what do you do about margins, the redesign of subsystems I really don't think is very practical for the shuttle fleet. Extensive analysis has already been done on vulnerabilities, and changes have been made and continue to be made where they're affordable. It's impossible, in my mind, for a system as large and as complex as is the shuttle to identify with any certainty the next most probable failure mode. So if you go around just trying to redesign the subsystems from today's baseline, you may very well spend a lot of money on things that are not really the next most probable failure cause.
I believe that redesign with greater margin is only practical for the whole system for the long term where, in fact, if you were trying to replace the shuttle, you would probably look at having criteria that would say you would have improved safety, reliability, and affordability and drive that in an organized system engineering concept for a replacement system.
Of course, there are other things that affect the way that a shuttle will fly -- the assembly, the tests, and the operational controls. Relative to assembly, I believe that NASA has repeatedly demonstrated effective assembly techniques, despite the fact that they have a very difficult job with a fairly complex system, both flight system and ground system. And it's pretty hard to improve on the record they have there. You heard a lot about that today. There's a lot of detail in that and yet we have had, as best I can tell, over 125 flights and I don't know that any failures can be attributable to the actual handling and processing.
Now the next point. I point out that I believe the Challenger failure was a case where there was operation beyond the qualification of the seal. In other words, the margin was negative in the environment that that particular rocket was subjected to at the time.
ADM. GEHMAN: Excuse me for interrupting, General Casey. While we're on that point, I want to make sure I understand. From my understanding, I would agree with you. In hindsight, the margin was negative. The question is: Can you determine that ahead of time?
GEN. CASEY: Well, I believe so. I believe that the qualification of the rocket motor was never subjected to the extended low-temperature condition; and, in fact, the only way you know that you have a margin is to stress the thing beyond what it's going to see in flight. That has to do with vibration, acoustics, temperatures, pressures, whatever you're going to see. I don't think you learn anything about margins from repeated flight. Where you learn about margins is in the qualification testing of the hardware.
ADM. GEHMAN: Essentially what you're saying is that occasionally you have to test to failure to find out what the margin is?
GEN. CASEY: No, I'm not saying you have to test to failure. I am saying you have to do qualification testing, which is stressing the article beyond the environment it's going to see in flight. Now, it may not be to failure; but I also believe that it's possible and, in fact, perhaps been demonstrated not only in the shuttle but probably in some of our other systems where we operated the system where the margin was driven negative by the conditions that we operated in, as opposed to the margin which you thought was there because of your testing because you violated the environment for which it was qualified.
In this particular case right now, you may find that the recurrence of a Columbia-type failure can be avoided by acceptance testing. I think you're pursuing that quite a bit in your discussions. What I show in the sub-bullet there is I'm thinking in terms about acceptance testing may preclude the debris coming down on the vehicle.
Let's do the next one. Relative to this cause of failure -- and I'm not going to act like I'm some expert in this particular failure, because I am not -- but I would make these observations. High-speed impacts of material on the shuttle wings are beyond the qualification envelope of the orbiter. The known debris from the tank hitting the left wing is incontrovertible. Regardless of the specific sequence and the details of the failure events, it seems to me that the remedy is to preclude debris from impacting critical systems during ascent or anytime they have to operate.
I believe that this was, doubtless, an original design requirement for the whole system, that you do not have debris impact down the vehicle systems in any kind of -- I should cut it there, that you do not impact down the vehicle's subsystems. However, I think this is a design requirement that was not achieved, demonstrably not achieved.
Now, what can you do to preclude debris impacts? One might consider looking at the amount of insulation that's on the tank. After all, it may be that the potential for having debris is reduced if you reduce the thickness of the insulation. I don't know whether that's true or not, but I would suggest that there ought to be lots of data now so you can rather precisely decide how thick that insulator must be for its functional use on the tank. And it may be that -- and this happens sometimes. It happened to us on some ELVs, expendable launch vehicles, where we had too much insulation on something and it caused another problem. In fact, we had a failure to separate in one case from the payload and the last upper stage just because it was over-insulated on the cable that was supposed to separate. So I think we ought to look carefully at that. And maybe there's nothing there. I don't know. NASA has an expert group of people to look at this sort of thing.
Clearly, I think that testing has to be developed to ensure that the integrity of the foam insulator and those pieces which are bonded on have, indeed, the integrity to stay on in flight if they're going to be in place at the launch. And, of course, that applies to any other debris that might come off the forward sections of the system.
I think it's absolutely critical that we retain the margins. A concerted effort needs to be made to operate within design margins. Again, I'm talking about margins that are verified in qual testing for each and every one of the subsystems. A series of successful flights does not verify a margin. You may be skating on the very edge, and you may come up to that flight where either the environment or the particular hardware causes you to go negative.
I made the point about rigorous qual testing. Special efforts should be made to preclude waivers or deviations in production or assembly or pre-flight checkout or any other kind of method that's used for accepting the things you've been talking about here today, that they do not, in fact, reduce the margin; and that's very difficult to decide. It requires expert system engineering judgment to look at that particular point, that how we buy this thing off does not, in fact, reduce our margin.
As you have pointed out here today, ageing or repeated use may also erode the margin, unbeknownst to the operators of the system. Ageing and surveillance programs have been used successfully in aircraft and in ICBMs to not only protect the margins in a given flight but also to predict the service life of the vehicle. It's important in the ICBMs because we build a rocket and we may want to use it 18 years later and want to have the same reliability or a good reliability. It's also an important discipline and doubly important here because of the fact of heating sequences both in ascent and descent in the repeated use cycles. I believe it's absolutely essential that a comprehensive system engineering effort is made to not only know what the margins are but be sure that we protect them in all ensuing operations.
The last observation is the next chart. In my view, it's important that we return to flight soon. Long delays incur loss of people and skills as well as the morale of the whole team; and all of the above may well reduce the reliability of the future flights, which is exactly what we're all interested in, increasing the reliability.
All reasonable steps to preclude debris impact is, in my judgment, the best approach to returning to flight. If we do all of that, I still believe that in the short-term -- I'm talking about lacking a full redesign as we talked about earlier -- protecting the reliability, in other words, trying to project that the reliability is better than .984 is very hard to guarantee. And it's my observation, therefore, that the crew size ought to be looked at as being a minimum and you should not use the shuttle where an expendable launch vehicle or robotic system can do the job.
Those are the thoughts I had. I'm perfectly willing to answer questions if I can be of help.
ADM. GEHMAN: Thanks very much. Your comments are very helpful because in some of the readings that we've all done as part of our review of some of these programs, that subject of successful flights don't re-establish margins has come back again and again. The other issue that's come up again and again is this question I asked before -- that is, as in the Challenger case where the leaking O-ring seals were trying to send us a message because they had been leaking many times before the Challenger disaster but yet they were sending messages but nobody was hearing it, the trick is to find those. And successful flights should not be used as evidence. They weren't evidence that the O-rings were working right, and they should not be used to indicate everything is okay here.
Our challenge is to receive those messages and do something about them. That's the tricky part, and I agree with you completely. Your presentation has made some of those things crystal clear.
GEN. CASEY: Sir, if I may on that point, I would say there really are two cases. There's one where you have the indicators and you have to act on them. That's true across the board. The other one is where, in fact, you're losing the margin and you don't have any indicators. Those are the really tough ones; but that's why I believe very strongly that it's very important that you keep a running system engineering accounting of what you think your margins are, because you can violate them, as I pointed out, either just by operating outside of your planned environment or by something squeezing through the acceptance testing, which doesn't give you the data that you're looking for.
ADM. GEHMAN: So when you use the term to qualify the system -- I think I understand what you mean by that -- if you take it in the case of the ET, for example, the external tank, if we were in agreement right now, we would agree that in its present situation that the ET is an unqualified system because it's shedding foam continuously. It wasn't designed to shed foam. We didn't design this thing to have the shuttle orbiter to be impacted by foam. Therefore it's currently not qualified in the sense that we're using in this room.
GEN. CASEY: Exactly. That's right. I believe that in your group that's looking at margins unless they, in fact, know that they're operating within the margins, there's no way, in my mind, that you can say I'm operating within margins if I have an unknown mass impacting the aerodynamic surface and it has unknown damage.
ADM. GEHMAN: We've heard that explained to us in other words; and I'll use those other words here to explain, just to see if you agree with this. That is, that what we should do is we should change the operative question on the table here. The present question is that you've got to prove to me that something is unsafe before I'll change it. What we need to do is we should require the system to prove it is safe. Particularly if we have something which appears to be exhibiting anomalies, the impetus should be to prove it's safe. The burden shouldn't be on me to prove what's not safe. The burden should be on the system to prove it is safe -- in other words, to qualify it.
GEN. CASEY: Yes, I would agree with that. Again, you point out these indicators you get. I think that obviously we have to give a lot of credence to any indicators you get; but I am equally as worried about those things which, in fact, are so subtle you haven't seen them yet but, in fact, the margin is there and you can lose it.
GEN. DEAL: General Casey, I'd like to springboard from something you said a while ago about the ageing and surveillance programs. You mentioned about the expendable vehicles that we've had -- in other words, your Gemini, your Mercury, your Apollo, your Minuteman and MX. This aircraft or spacecraft was on its 28th flight, yet it was more than two decades old. So we've kind of entered this arena of an ageing spacecraft in a research-and-development environment. What you didn't say in your biography is that you've got experience in the early days of the B1, which has been flying more than 20 years later, and the A10. So it would be interesting to know if there's any principles that you might apply to the shuttle and specifically what type of ageing and surveillance programs do you think NASA should pursue.
GEN. CASEY: Well, I agree with what Roy Bridges said, that it's quite a different thing for the aircraft than it is for the rockets where you don't have any ability to observe in repeated flight. More applicable, in my mind, is what the ICBM world does; and, in fact, they do detailed ageing and surveillance on each and every piece and part. They don't say we want the Minuteman to go till year 2010; what they do is they look at all the detailed parts and see if, in fact, they expect the reliability of the entire system to be the same at that time, based on the test data and analysis that's done.
Now, NASA, it sounds like I heard Roy Bridges mention a lead-the-fleet kind of thing. That's what I have in mind, something where you take the oldest pieces you have, or subsystems, and you put them through the environments that they are seeing in some kind of accelerated way you can, to get ahead of the curve, as I think Roy pointed out earlier, so that, in fact, you have some projection of whether or not you're losing margin or whether or not you have some reasonable idea of what the service life really is. I think it's a complex system of tests and analysis.
MR. WALLACE: General Casey, I'm from the world of civil aviation where, I guess, you might call that optional human flight, wherein we --
GEN. CASEY: You could fly those airplanes without people on them, too, if you like.
MR. WALLACE: Right, but it doesn't get the passenger around. In 2000, we operated 11 million flights, 32,000 a day, without a single fatality. And operating on this level of reliability, we would lose 40 of those airplanes every day. I'm asking you to maybe expand a little on this. This is a big question that this board has been sort of gingerly walking around and you plunged right into it, about who should fly. So I see your last two lines there sort of give the short answer to your question. Could you go on perhaps and discuss what you think would be an acceptable risk for various types of operations, even assuming a next-generation spacecraft? Because it sounds to me like, from what you've said, that the order of magnitude of safety of the shuttle is not going to change, given even with incremental system improvements.
GEN. CASEY: Well, I believe that new technology probably will allow us to go very close to .0 on reliability, but I think that's going to take a new system to do that, in my view. What I meant by the statement was that if, in fact, there's a mission where you can do the same thing with an ELV, don't use the shuttle. I know there are certain missions that NASA has, very important missions, that require the shuttle, there's nothing else that can do it, and I think that those obviously have to be done. I don't think you're saddled with .984. Maybe we won't have it that bad. What I'm trying to tell you is I don't think you can guarantee that it won't be .985 or .99 rather than 1.0 for the next ensuing hundred flights. That's what I'm trying to point out there.
MR. WALLACE: Another question on return to flight. You focused on fixing the falling foam issue. Do you have thoughts on other return to flight? I know NASA's working on things like on-orbiter/on-station inspection-and-repair capability.
GEN. CASEY: I believe that anything else you can do to enhance the safety of the mission -- I didn't try to explore all of those. There are a lot of things you can do. I was focusing my thoughts on how do you avoid catastrophic failures. I believe anything else you can do is good.
ADM. GEHMAN: Let me interrupt a second here. I thought you did address that. Maybe I misunderstood. What Mr. Wallace was talking about is not margin but redundancy. It seemed to me that these are two different things. In the case of redundancy, you have kind of given up on the system. In other words, you've said, okay, when this thing fails, at least I've got a backup -- whereas in the case of margin, you don't want the thing to fail in the first place.
GEN. CASEY: Well, there are certain things in this world, both in our more simple ELVs and clearly in the manned systems, where redundancy is used automatically. If a computer fails, we just automatically have another one to crank up; but you can't do that with a rocket motor nozzle or other things that are single-string failures. So that's the distinction I was drawing. Where redundancy can be done, I think NASA has already done it already on this vehicle.
DR. OSHEROFF: Well, actually both of the failures you talked about, of course, are failures which had not been anticipated that we were working outside the margin. What do you think should be changed about the way NASA has been assessing safety in the shuttle program which will, if not guarantee, certainly greatly increase the probability that, in fact, issues like this will be detected before another shuttle is lost?
GEN. CASEY: I don't claim to have explored the details of the program to know that. I'm saying from the top down you ought to demand that we know what the margin is; and that's a very complex set of things, as you know, because margin is expressed in different terms for virtually every subsystem in the whole lash-up. I think -- I don't know, maybe you've asked -- have you asked NASA what is the margin that they have across the board or by subsystem? I think that that's something that they ought to know, if they don't; and I think you ought to work to protect that. That's my point.
ADM. GEHMAN: In your previous experiences in the other programs like Minuteman and things like that, did you have the issue of unknown unknowns? How do you go after unknown unknowns?
GEN. CASEY: Well, there are two things I don't have much use for in the system. One is the word "robust," and the other is "unknown unknowns." To me, they're both so vague, I don't think they help. I believe that you need to use a very strict rule of qualification, and NASA probably has done so. I assume they have done so for the shuttles. You know, 6 dB in all of these environments is what we have used as a specification for spacecraft; and that's a very rigorous way of looking at acoustic environments or vibration environments and all the other things that these systems have to be able to operate through. It gets more complex if you're talking about rocket motors and things like that. You have a hard time really stressing to a margin of 25 percent above what it's going to see in its actual function. But you can always in every one of these systems test them with more stress than they're going to have in flight in virtually every case. In some cases you cannot do the combined environments that you would like to do, but, in fact, you do the best you can. To the extent you make estimates of those, you can get an overall assessment of what the margin is of the vehicle; and you try to protect that. That's my point.
DR. LOGSDON: You've got reliable out to three figures there: .984. How real do you think that number is, since it's two failures out of 113 flights? Statistically is that good enough to give you a three-digit reliability number?
GEN. CASEY: No, my calculation of reliability is 2 over 125. I mean, all I did was just divide the failures by the number of flights.
DR. LOGSDON: I don't think there have been 125. 13.
GEN. CASEY: Well, the answer to your question is I don't believe the reliability is static. In fact, when you go around and you make some of these changes -- they made significant changes relative to the seal after the seal failed.
DR. LOGSDON: The Challenger.
GEN. CASEY: And I think the new seal has changed that reliability a bit. Now, how good it is? My point about not knowing what you can get to is that it's very difficult to know that you're at 1.0.
DR. LOGSDON: I understand that, but I'm not certain that .984 is a good number either.
GEN. CASEY: No. I'm not either.
DR. LOGSDON: But you're basing a lot of recommendations on that. I mean, I look at your latest bullet. It says if it's this, don't do -- you know, crew size at a minimum. I gather "crew size at a minimum" and "optional human flight" on your first flight mean about the same thing.
GEN. CASEY: No, I don't think so. If you don't need to use the shuttle at all, then it's not crew size -- it's zero crew size.
DR. LOGSDON: But you're not saying don't fly more humans than you have to?
GEN. CASEY: That's correct. I am saying that.
DR. LOGSDON: You are saying that.
GEN. CASEY: Yes, I am saying that. For whatever the mission requires.
MR. HUBBARD: I would like to ask you to draw on your collective aircraft, expendable launch vehicle experience and what you know about the shuttle as a system and ask would you characterize the shuttle system as experimental, developmental, or operational?
GEN. CASEY: Well, I agree with what was said here earlier. I think it is all of those or both experimental and operational because they keep changing certain things; but, in fact, the bulk of it is operational, in my mind.
MR. HUBBARD: I'm sorry.
GEN. CASEY: The bulk of the system is operational. I think the changes are small in terms of the total system.
MR. HUBBARD: Okay. So now let's compare this to the ELV world where they've got thousands of launches by comparison with 100-plus here yet the success rate there, you know, fleet-wide is .96 or something like that. What kinds of ongoing system engineering are employed in the ELV world to try to push that number up closer to 1.0?
GEN. CASEY: Well, I think the recent systems have put a lot more emphasis on qualification and margin; but that won't be demonstrated until we get some history on them. In the past we've had a very large diversity among the various ELVs in the U.S. inventory; and most of them descended from ICBMs, which were greatly modified, sometimes not fully qualified in the changes. And they also have the difficulty in the launch vehicle world of ELVs where few of them are the same -- that is, you don't fly the same. We did not have the same problem in the ICBM. We flew the same over and over and over until we got very repeatable results, sometimes not as good as we'd like.
MR. HUBBARD: Last follow-on in this thread of what can you do to improve and what does it mean to have a comprehensive system engineering program. I think you may have answered this partially already, but can you give us a few more definitions or thoughts about what comprehensive system engineering approach means to you?
GEN. CASEY: Well, I do not claim to have looked at the shuttle system across the board or the NASA approach. I think the system is so large it has some of the aspects we heard here today where there's so many different delegations that it's hard to say that one system engineering group is, in fact, looking at the margin on this flight for all the things. That's the difficulty, in my mind. It's such a large system and so diverse in where the work is done that it's hard to pull this together. I would like to have, if I was managing this program, some confidence that there was a central system engineering group that had a good handle on what the margins are. Perhaps it exists. I don't know. I don't claim to know one way or the other, but I think your board should know.
MR. HUBBARD: Is your impression drawn from the hand-offs that occur between these various elements, the coordination between the elements?
GEN. CASEY: I can't criticize that. I have not looked at it.
ADM. GEHMAN: But in your experience as a program manager of these complex ICBM systems, you had the same or similar problems. I mean, even though it was an unmanned system in the Minuteman program and things like that, the nation expected more than just that the thing launched. It also had to hit what it was aiming at. So it is a complex system. So did you use any particular techniques to make sure that the system was integrated, the program was integrated?
GEN. CASEY: Oh, yes. In fact, in both Minuteman and the MX or, as we called it, Peacekeeper, the operational name, we were the integrating contractor. We had system engineering contractors supporting us; but we actually wrote the specifications, individually wrote the contracts for each of the rocket motors, the guidance system, and each of the parts. We were responsible for the specification at the level of the missile itself and, in fact, enforced the qualification test of each and every part before it ever met the other parts in the assembly process. So, yes, we were, in fact, very much involved, making sure that we had qualified all the hardware to levels that are significantly above what it was expected to see in flight or in operational ground operation.
ADM. GEHMAN: That's very interesting, and we could go on all evening about that because there are elements in the shuttle program which have demonstrated their reliability and there are certain qualification tests which have been backed off on due to success. So what you're suggesting is each component has to be qualified.
GEN. CASEY: Yes, sir. In fact, just one more thought on that whole area. I hear a lot from my own cohorts in the ELV world about "in family." In family is also a nice thing to watch. You can tell whether hardware is beginning to drift out of the way it was produced before; but again, it tells you nothing about margin because you might be in family right in the center and you might be very close to the edge if you were operating outside of what you qualified it to.
ADM. GEHMAN: General Casey, thank you very much for agreeing to help us work on this problem, which we haven't got quite solved here. Your insights strike a very good accordance with what we're feeling here, and you've paraphrased a couple of obscure concepts for us very nicely. We thank you very much. Thanks for your help.
GEN. CASEY: Thank you.
ADM. GEHMAN: Okay. This public hearing is closed for today.
(Hearing concluded at 4:18 p.m.)
1. Should indicate $19 million
Back to Event
|
