SPACE STATION

Russian Compliance

With Safety

Requirements

Statement of Allen Li, Associate Director, National Security and

International Affairs Division

United States General Accounting Office

GAO Testimony

Before the Subcommittee on Space and Aeronautics,

Committee on Science, House of Representatives

For Release on Delivery

Expected at

10:00 a.m.

Thursday

March 16, 2000

GAO/T-NSIAD-00-128
1

Mr. Chairman and Members of the Subcommittee:

We are pleased to be here today to discuss our ongoing work on the National Aeronautics

and Space Administration’s (NASA) International Space Station. We are currently

responding to a request from the Committee Chairman to review Russian compliance with

space station safety requirements. We plan to finalize our work and report on this issue next

month. Today, we will address (1) significant areas where the Russian-built Zarya and

Service Module do not comply with safety requirements, (2) NASA’s review and approval of

noncompliances, and (3) whether NASA was due any compensation from the Zarya

contractor for noncompliance or performance problems.

NASA invited Russia to participate in the International Space Station program in 1993 with

the expectation that Russian involvement would reduce the cost, speed up the schedule, and

increase the usefulness of the space station. The Russian-built Zarya and Service Module are

critical to the early stages of the space station’s assembly. The Zarya module, launched by

Russia in November 1998, provides the initial propulsion and guidance functions for the

space station. Zarya was funded by NASA and is therefore considered a U.S. element of the

space station. The Service Module, whose launch has been delayed until at least July 2000,

will provide living quarters, life support systems, and guidance functions after docking with

Zarya. Russia is funding, building, and launching the Service Module as part of its

contribution to the space station. Russia also plans to contribute Progress resupply vehicles,

Soyuz crew transfer and emergency return vehicles, a power platform, docking and stowage

modules, and research modules.

Working with the Russian space agency and other international partners, NASA is

responsible for establishing overall space station safety requirements. NASA is also

responsible for certifying that all elements and payloads, and the space station as a whole,

are safe. Russia agreed that its elements would meet or exceed the overall safety

requirements established by NASA. Russia also agreed to provide NASA with data to support

safety reviews and certifications. NASA must approve any noncompliance with safety

requirements before it can approve launches of U.S. and partner elements.

RESULTS IN BRIEF

Although Russian elements have complied with the majority of space station safety

requirements, Zarya and the Service Module still do not meet some important requirements.

According to NASA safety officials, significant areas of noncompliance include (1)

inadequate shielding from orbital debris on the Service Module, (2) inability of Zarya and the

Service Module to operate after losing cabin pressure, (3) lack of verification for the design

and service life of the Service Module windows, and (4) excessive noise levels in Zarya and

the Service Module. NASA officials said that shortfalls in Russian funding, designs based on

existing Russian hardware, and technical disagreements with Russian engineers are the

main reasons these modules do not comply with safety requirements.

NASA approved noncompliance with safety requirements after determining the risks were

acceptable, allowing Zarya to be launched, but it has not yet approved all noncompliance

cases for the Service Module. NASA approved noncompliance with requirements for ability
2

to operate after loss of pressure and noise levels on Zarya. NASA approved noncompliance

with requirements for debris shielding on the Service Module but has not yet approved

noncompliance with requirements for ability to operate after loss of pressure, noise levels,

and window design and service life. NASA approves noncompliance with safety

requirements when it determines that the risks are acceptable because plans are in place to

mitigate risk or the deficiencies will last only a limited time. NASA and the Russian space

agency plan to correct safety deficiencies in orbit with future space station assembly and

logistics flights. However, the period of higher risk to the crews and the modules may

increase if corrections are delayed for any reason. Correcting deficiencies in orbit may also

be more difficult than on the ground and may take up time that the crews could spend on

other activities such as research.

According to NASA, the four most significant cases in which Zarya did not meet safety

requirements or had performance problems did not warrant compensation from the

contractor. Two of the cases—inability to operate after loss of pressure and excessive

noise—involved noncompliance with safety requirements. The other two cases—defective

batteries and crew health problems attributed to poor air quality—involved performance

problems in orbit. The contractor agreed to reduce noise levels and replace the batteries at

no charge to NASA. The two other problems did not result from failure to meet contractual

requirements: the specifications for Zarya exempted the module from fully meeting space

station requirements to operate after loss of pressure, and NASA determined that air quality

inside Zarya was not the cause of health symptoms reported by the crew.

RUSSIAN ELEMENTS DO NOT COMPLY

WITH SOME KEY SAFETY REQUIREMENTS

According to NASA safety officials, Russian-built elements comply with the majority of

space station safety requirements, but Zarya and the Service Module still do not meet some

important requirements. Significant areas of noncompliance include (1) inadequate shielding

from orbital debris on the Service Module, (2) inability of Zarya and the Service Module to

operate after losing cabin pressure, (3) lack of verification for the design and service life of

the Service Module windows, and (4) excessive noise levels in Zarya and the Service

Module. These shortcomings increase the risk of health hazards and of what NASA terms

“catastrophic” failure of the modules.1

NASA officials said that shortfalls in Russian funding,

designs based on existing Russian hardware, and technical disagreements with Russian

engineers are the main reasons these modules do not comply with safety requirements.

Service Module Is Not Adequately

Protected From Orbital Debris

The Service Module does not meet space station requirements for protection against

penetration from orbital debris. Depending on the location of the penetration and the size of

the debris, a penetration could harm the crew and cause the loss of the space station. The

Service Module was supposed to have no more than a 2.4-percent probability of a

1

NASA defines catastrophic failure as any condition that may cause a disabling or fatal personal injury or loss

of the shuttle, space station, or major ground facility.
3

penetration over a 15-year period, but it has been assessed as having a 25-percent probability

with current shielding. Debris protection for the Service Module is based on the existing Mir

space station’s shielding, which does not meet the International Space Station’s

requirements.

In 1995, NASA and the Russian space agency agreed that the Service Module’s shielding

would have to be improved in order to meet safety requirements and that they would add

more shielding in orbit. NASA and the Russian space agency are currently planning to

complete shielding upgrades in 2004, 3.7 years after the planned launch of the Service

Module. The shields cannot be installed prior to launch because they would make the

Service Module too heavy to lift into orbit. NASA estimated the probability of a penetration

without fully upgraded shielding during the first 3.7 years to be 5 percent. The additional

shields should reduce the probability of a penetration to 3.8 percent over the remaining 11.3

years of the 15-year period; this still does not meet the original target requirement.

Zarya and the Service Module Will Not

Operate After Losing Cabin Pressure

The space station program requires that equipment located in pressurized modules be

capable of functioning if cabin pressure is lost. Pressure loss can be caused by leaking seals

or valves or by penetration by orbital debris. Russian-built modules are based on existing

designs that do not meet this space station requirement. Much of the equipment in the

modules requires air for cooling and will eventually fail in a vacuum. When NASA procured

Zarya “off-the-shelf,” NASA specifically exempted the module from fully meeting this

requirement. Consequently, loss of pressure in Zarya and failure of its guidance systems

would result in the loss of the space station.

The Service Module is scheduled to dock to the space station in July 2000 and take over

from Zarya critical guidance functions for maintaining the space station in orbit. But the

Service Module equipment would also fail after losing cabin pressure, and if it did, the space

station would be lost. NASA plans to install global positioning system hardware and other

guidance, navigation, and control equipment on its laboratory module and on a truss

segment, allowing the Service Module to maintain control even if it lost pressure. This

equipment is not planned for installation until the end of 2001.

Service Module Windows Have Not Been Verified

NASA has not verified that the Service Module’s windows meet space station requirements

because it did not receive sufficient test data from Russian engineers until very recently.

NASA officials said that they received additional data from Russian engineers during

meetings that ended in Moscow on March 10, 2000, and they are currently assessing whether

the data is sufficient to verify the design and service life of the windows.

Space station windows must be designed to prevent catastrophic loss if a window pane

breaks. According to space station officials, if a window were to fail, it would cause rapid

loss of pressure, most likely resulting in the loss of the crew and of the space station.

Service Module windows have two panes. Until the March meeting, Russian engineers had
4

not provided data to show that one window pane would withstand the sudden change in

pressure if the other pane were to break—for example, after being struck by orbital debris.

NASA engineers recognize that there can be legitimate disagreements on technical design

issues but added that without verification data, they would not be able to determine if the

design meets safety requirements.

Space station windows must also be certified to last at least 15 years. However, the Service

Module windows are based on the same design used for the existing Mir space station and

are designed to last 5 years. The Russian space agency had not provided NASA with

sufficient test data to verify that the windows would last for 15 years, citing instead the fact

that no windows failed during the Mir’s 14 years in orbit. But space station program officials

have noted that the Mir’s windows show evidence of damage from orbital debris. NASA is

concerned that over the years, the outer pane may become damaged to the point of cracking

and breaking. The Russian space agency has developed metal covers that can be installed

over damaged windows.

Zarya and the Service Module Are Too Noisy

Noise levels in the two modules exceed specifications. The general space station

specification set by NASA states that noise levels should not exceed an average of 55

decibels over a 24-hour period. NASA relaxed the requirement to 60 decibels for Russianbuilt elements because Russian space officials would not agree to meet the general

specification. However, after launch in November 1998, noise levels in Zarya measured

between 65 and 74 decibels. Recognizing that noise levels were too high, Boeing and its

Russian subcontractor provided noise reduction devices that were installed aboard Zarya in

orbit in May 1999. Noise levels subsequently dropped to an average of 62 to 64 decibels.

Boeing and the subcontractor are planning additional corrective actions during a future

shuttle flight to the space station.

Projections are that the Service Module will be in the 70- to 75-decibel noise range. NASA

officials are particularly concerned about excessive noise levels in the Service Module

because it will serve as the crew’s living quarters. High noise levels could affect operations

if crew members have difficulty in communicating with each other or with ground

controllers. Officials are also concerned that working and sleeping in a noisy environment

could increase crew fatigue. To lower the Service Module’s noise levels, the Russian space

agency agreed to a plan calling for hearing protection equipment, mufflers, barriers,

isolators, and quieter fans. However, implementation of the plan has been slow, primarily

due to lack of funding. To protect themselves until noise levels are reduced, the crew will

have to wear hearing protection equipment because long-term exposure to such noise levels

can cause temporary or permanent hearing damage. However, wearing hearing protection

devices could affect the crew’s ability to hear caution and warning signals and to

communicate with each other. In addition, NASA officials are concerned that the crew will

not use these devices if they are uncomfortable.

The Service Module is essentially the same vehicle as the core module of the Mir. The Mir

space station noise levels have been measured at 59 to 72 decibels. A study of 50 Mir

cosmonauts showed that virtually all suffered temporary hearing damage, and some had
5

permanent damage that disqualified them from future space flights. At least one NASA

astronaut who stayed aboard Mir for an extended time also suffered significant temporary

hearing loss. The crew that suffered hearing damage did not wear hearing protection

equipment because of comfort problems.

NASA’S APPROVAL OF NONCOMPLIANCE

WITH SAFETY REQUIREMENTS

NASA must approve any noncompliance with safety requirements before approving the

launch of space station elements. NASA has established a formal review process for

certifying the safety of space station elements and approving noncompliance with safety

requirements. NASA believes that the higher risks from noncompliance are acceptable if

mitigation plans are in place and if deficiencies last only a limited time. Part of NASA’s

rationale for approving noncompliance is that NASA and the Russian space agency plan to

correct safety deficiencies in orbit during future space station assembly and logistics flights.

However, there are potential problems with deferring corrective actions until after modules

are launched.

Process for Reviewing Safety Hazards

and Approving Noncompliance

NASA has established a formal process for reviewing and approving the safety of space

station elements. Each partner is responsible for analyzing its own hardware and software

for potential hazards. NASA space station personnel, working with other partners, can also

identify safety hazards. When a potential safety hazard is identified, the element provider

prepares a hazard report. The report describes the severity of the potential hazard and the

likelihood of the hazard actually occurring. It also includes a description of the potential

causes of the hazard and the controls necessary to mitigate or eliminate it. The hazard

report must also identify the method for verifying that the controls will mitigate the hazard.

All hazard reports must be reviewed and approved by NASA’s Safety Review Panel, which is

composed of senior NASA officials from both within and outside the space station program

and includes representatives from NASA’s international partners. The panel can also identify

hazards and request hazard reports from the element providers. When the panel is satisfied

that a potential hazard is understood, that effective controls are in place to mitigate it, and

that the controls can be verified, the panel chairman signs the hazard report, thus indicating

that safety requirements have been met.

When a potential hazard cannot be eliminated or controlled enough to meet safety

requirements, NASA can prepare a noncompliance report to document the rationale for

accepting the risk of not fully complying with the requirements. NASA’s Safety Review Panel

approves such noncompliance only after thoroughly reviewing the issue and determining

that the risks are acceptable. All relevant hazard reports must be signed (“closed”) and all

noncompliance reports approved by NASA before launch of a space station element is

approved.
6

Noncompliance Must Be Approved Before

Service Module Can Be Launched

NASA has approved a noncompliance report for debris shielding on the Service Module but

has not yet approved noncompliance for ability to operate after loss of pressure and noise

levels on the Service Module and has not closed the hazard report for the Service Module’s

windows. NASA approved noncompliance for ability to operate after loss of pressure and

noise levels on Zarya prior to its launch. The status of each noncompliance is as follows:

• NASA approved a noncompliance report in August 1999 for the Service Module’s inability

to meet requirements for protection against orbital debris. The space station program

was willing to accept a higher risk during the 3.7 years that are scheduled to pass from

the initial launch of the Service Module until additional shielding is attached. In

approving the noncompliance, NASA recognized that even after additional shielding is

installed, the probability of a penetration will still be above original target requirements,

but this will be a considerable improvement over the 25-percent probability if shielding is

not augmented.

• NASA is considering approving a noncompliance report for the Service Module’s inability

to operate after loss of pressure because extensive reviews determined that controls to

prevent leaks from seals and valves were satisfactory. In addition, the time of higher risk

should be limited to the time between the launch of the Service Module and the launch of

NASA’s guidance equipment at the end of 2001, about 15 months. Using guidance data

from NASA’s equipment, the Service Module will be able to maintain control of the space

station even after pressure is lost.

• NASA is considering approving a noncompliance report for the Service Module’s noise

levels because a remedial action plan has been developed. But, before they will approve

the noncompliance, NASA officials want the Russian space agency to provide a schedule

for implementing the action plan. The officials said they believe the period of

noncompliance should be limited to the first long-term crew’s stay aboard the space

station, scheduled to begin in October 2000. The crew is supposed to install noise

reduction devices during its 3-month stay.

• NASA has not signed a hazard report for the Service Module windows. NASA engineers

said they will not be able to close the report until they have determined that data

recently received from Russian engineers proves the window design meets safety

requirements and the windows can last 15 years.

• NASA approved a noncompliance report in August 1998 for Zarya’s inability to operate

after losing pressure because extensive reviews determined that controls to prevent

leaks from seals and valves were satisfactory and that the module is adequately

protected from penetration by orbital debris. At the time, NASA was also expecting the

Service Module to take over Zarya’s critical functions relatively soon because the Service

Module was scheduled to be launched in April 1999, about 5 months after Zarya. But
7

according to the latest estimates, the Service Module will not be launched until at least

July 2000, or about 20 months after Zarya.

• NASA approved a noncompliance report in November 1998 for Zarya’s noise levels

because the crew could limit its time in the module and its exposure to the higher noise

levels. If the crew needs to increase the time spent in the module, they could wear

hearing protection.

NASA must close all hazard reports and approve all noncompliance reports before it can

approve the launch of the Service Module. Had the Russian space agency been prepared to

launch the Service Module as scheduled in July 1999, NASA might have had to withhold

launch approval because the hazard and noncompliance reports for pressure loss, windows,

and noise had not been approved at the time. However, because completion of the Service

Module was delayed beyond July 1999, NASA was not put in this position. Because the

Service Module is critical for continuing the assembly of the space station, withholding

launch approval could delay the program’s schedule and increase NASA’s costs. Delays in

critical Russian space station elements have already had a significant impact on NASA’s

costs. A January 1999 space station program office analysis estimated that delays in Russian

elements could add $3 billion to NASA’s program costs through completion of assembly.

Potential Problems With Deferring

Corrections Until After Launch

Part of NASA’s rationale for approving the launch of elements that do not fully comply with

safety requirements is that deficiencies will be corrected after the modules are in orbit and

that exposure to increased risk will last only a limited time. However, correcting

deficiencies after modules are launched can take longer than planned, can be more difficult

than on the ground, and can affect other activities such as research.

• Over the years, the space station assembly schedule has stretched out, and the total

period of higher risk of losing the space station in the event pressure is lost in Russian

elements has grown from 7 to 35 months. When Russia first joined the space station

program in 1993, the Service Module was supposed to be launched 2 months after Zarya,

and NASA’s guidance equipment was to be launched 5 months after that. Now, the

Service Module may be launched 20 months after Zarya, and NASA’s guidance equipment

15 months after that.

• The period of higher risk could increase if development and production of the

corrections are delayed. Because of funding shortages, the Russian space agency is

behind schedule in developing items to address noise levels in the Service Module. NASA

officials cited Russian funding problems as a major reason for delays in designing and

testing the additional debris shields for the Service Module.

• The period of higher risk may be longer if corrective actions do not bring the modules in

compliance with safety requirements. For example, the initial round of remedial actions

implemented on Zarya did not fully correct noise problems, and the module will not

comply with noise requirements until additional actions are taken. Because some noise
8

countermeasures are still being designed for the Service Module, it is not clear how many

will be in place when the first long-term crew arrives on the space station in October

2000 or how effective they will be. Although Russian space officials have committed to

reducing the probability of orbital debris penetrating the Service Module, the

effectiveness of the additional shields will not be known until the designs are completed

and tested.

• Implementing corrections in orbit can be more difficult than on the ground. The shuttle

crew on the space station in May 1999 had difficulty wrapping mufflers on Zarya’s air

ducts. According to NASA officials, the crew did not receive adequate training and

instructions on how to install the mufflers and could not get them to fit properly. In

attempting to force the mufflers around the ducts, the crew crimped the ducts. NASA

officials believe that installing some noise reduction devices on the Service Module will

be difficult in orbit and have suggested to their Russian counterparts that installation be

done on the ground.

• Performing corrections in orbit could divert crew time from other planned tasks such as

research. Crews will have to perform extensive work inside the Service Module to install

mufflers, baffles, and other noise reduction materials. Crews will also have to prepare for

and conduct at least four space walks to install additional debris shields on the exterior

of the Service Module. It is not yet known what the safety issues may be or what

corrections may have to done in orbit for the other elements (such as docking and

research modules) Russia will supply later in the assembly sequence.

COMPENSATION TO NASA FOR

PERFORMANCE PROBLEMS

The four cases we reviewed in which Zarya did not meet requirements or had performance

problems did not warrant compensation from the contractor. These cases involved

excessive noise, defective batteries, inability to operate after loss of pressure, and crew

concerns about air quality.

The Boeing Company, NASA’s space station’s prime contractor, is responsible for delivering

the Zarya module to NASA. In 1995, Boeing signed a fixed-price subcontract for $190 million

with Russia’s Khrunichev State Research and Production Center to build and launch the

Zarya module for NASA. The contract value increased to $222 million with modifications.

Boeing accepted Zarya from Khrunichev when the module was launched in November 1998.

NASA will accept Zarya from Boeing when the Service Module successfully docks to Zarya.

NASA procured Zarya as an “off-the-shelf” module knowing that some of its design

characteristics did not conform with all space station requirements. According to NASA

contracting officials, NASA can request compensation from Boeing if it determines that

performance of the Zarya module is degraded or if additional costs are incurred to fix a

problem.

• Although noise levels in Zarya exceeded NASA’s safety requirements, the agency did not

ask for compensation because Boeing and its Russian subcontractor agreed to fix the
9

problems at no charge to NASA. Khrunichev developed noise-limiting devices that were

installed during a shuttle flight in May 1999 and significantly reduced noise levels.

However, because noise levels still exceed safety requirements, Boeing and Khrunichev

plan to provide additional devices that can be installed on a shuttle flight scheduled for

later in 2000.

• The Zarya module experienced battery problems four times while in orbit, but

Khrunichev is fixing these problems at no charge to NASA. The module uses six

batteries, but only three are needed to keep Zarya operational. In the first instance, the

battery failed due to defective hardware, which Khrunichev replaced. The cause of the

other battery problems is still under investigation, but NASA officials stated that

Khrunichev has already agreed to provide the hardware to fix the problems.

• NASA did not seek compensation for Zarya’s failure to meet the space station

requirement for operation after loss of cabin pressure because NASA specifically

exempted Zarya from this requirement. When NASA and Boeing procured Zarya, they

knew that the module was not designed to operate after losing pressure. NASA did

require the module to maintain structural integrity, audio communications, and the

capability to transfer power and fuel after losing pressure, and NASA determined that the

module met these limited performance requirements.

• During a shuttle flight in 1999, crewmembers experienced headaches, flushed faces, and

nausea while working in Zarya for extended periods. The crew attributed these

symptoms to poor air quality caused by inadequate ventilation and high carbon dioxide

levels. After investigating the incident, NASA ruled out poor ventilation and air quality as

factors in the crew’s reported symptoms. NASA is still investigating the incident, but so

far, it has not identified any problems with Zarya that would warrant seeking

compensation from the contractor.

----

Mr. Chairman, this concludes our statement. We will be happy to answer any questions you

or members of the Subcommittee may have.

Contact and Acknowledgement

For questions regarding this testimony, please contact Allen Li at (202) 512-4841. Individuals

making key contributions to this testimony included Jerry Herley, Richard Eiserman, Vijay

Barnabas, and Gregory Harmon.

(707494)
ORDERS BY INTERNET

For information on how to access GAO reports on the INTERNET, send an e-mail

message with “info” in the body to

Info@www.gao.gov

or visit GAO’s World Wide Web Home Page at

http://www.gao.gov

TO REPORT FRAUD, WASTE, AND ABUSE

IN FEDERAL PROGRAMS

Contact one:

• website: http://www.gao.gov/fraudnet/fraudnet.htm

• e-mail: fraudnet@gao.gov

• 1-800-424-5454 (automated answering system)