IG-02-020

AUDIT 

REPORT SPACE SHUTTLE SAFETY UPGRADES 

July 01, 2002

 National Aeronautics and 

Space Administration

OFFICE OF INSPECTOR GENERAL
Additional Copies 

To obtain additional copies of this report, contact the Assistant Inspector General for 

Audits at (202) 358-1232, or visit www.hq.nasa.gov/office/oig/hq/issuedaudits.html.

Suggestions for Future Audits

To suggest ideas for or to request future audits, contact the Assistant Inspector General 

for Audits. Ideas and requests can also be mailed to: 

 Assistant Inspector General for Audits 

 Code W 

 NASA Headquarters 

 Washington, DC 20546-0001 

NASA Hotline

To report fraud, waste, abuse, or mismanagement contact the NASA Hotline at (800) 424-9183, 

(800) 535-8134 (TDD), or at www.hq.nasa.gov/office/oig/hq/hotline.html#form or write to the 

NASA Inspector General, P.O. Box 23089, L’Enfant Plaza Station, Washington, DC 20026. 

The identity of each writer and caller can be kept confidential, upon request, to the extent 

permitted by law. 

Reader Survey 

Please complete the reader survey at the end of this report or at 

www.hq.nasa.gov/office/oig/hq/audits.html. 

Acronyms 

AHMS Advanced Health Management System 

APU Auxiliary Power Unit 

CAU Cockpit Avionics Upgrade 

FY Fiscal Year 

GAO General Accounting Office 

NSTS National Space Transportation System 

OIG Office of Inspector General 

OMB Office of Management and Budget 

SSME Space Shuttle Main Engine 

SSP Space Shuttle Program 
W 

TO: HQ/M/Associate Administrator for Space Flight 

HQ/M/Deputy Associate Administrator for International Space Station 

and Space Shuttle 

JSC/AA/Director, Lyndon B. Johnson Space Center 

FROM: HQ/W/Assistant Inspector General for Audits 

SUBJECT: Final Report on Space Shuttle Safety Upgrades 

Assignment Number A-01-041-00 

Report Number IG-02-020 

The subject final report is provided for your use. Please refer to the Results in Brief for the 

overall audit results. We have included your comments in their entirety in Appendix E. 

We appreciate the courtesies extended to the audit staff. If you have questions concerning the 

report, please contact Dennis E. Coldren, Program Director, Space Flight Audits, at 

(281) 483-4773, or Esther A. Judd, Program Manager, at (301) 286-3359. The final report 

distribution is in Appendix F. 

[Original Signed By] 

Alan J. Lamoreaux 

Enclosure 
2 

cc: 

HQ/AI/Associate Deputy Administrator 

HQ/B/Deputy Chief Financial Officer 

HQ/B/Comptroller 

HQ/BF/Director, Financial Management Division 

HQ/G/General Counsel 

HQ/JM/Director, Management Assessment Division 

JSC/MA/Manager, Space Shuttle Program Development 
NASA Office of Inspector General 

IG-02-020 July 01, 2002 

 A-01-041-00 

Audit of Space Shuttle Safety Upgrades 

Introduction 

The Space Shuttle is the only U.S. vehicle that can launch humans and payloads into space and 

safely return them from an Earth orbit. Since the Space Shuttle Challenger mishap,1

 NASA has 

improved the safety of the Space Shuttle; the estimated risk of catastrophic failure during launch 

decreased from 1 in 78 missions in 1986 to 1 in 556 missions today. The continued safe 

operation of the Space Shuttle is a top priority and is essential in NASA’s ability to support the 

assembly and operations of the International Space Station. 

NASA has made investments in Space Shuttle safety improvements over the last several years 

while, at the same time, NASA has reduced the Space Shuttle budget by about a third through 

efficiencies and contract consolidation. Having achieved these budget reductions, continued 

improvements in Space Shuttle safety will require additional investments. 

The NASA Office of Inspector General (OIG) performed an audit of Space Shuttle safety 

upgrades. The overall objective was to evaluate NASA's management of Space Shuttle safety 

upgrades. Specifically, we determined whether NASA ensured that the approved safety 

upgrades2

 met established safety objectives, were selected based on a quantitative analysis or 

other measurable methodology, were adequately funded to ensure completion of the 

modifications when needed, and minimized adverse effects on the Space Shuttle flight schedule. 

Appendix A contains further details of our objectives, scope, and methodology. 

During the audit, the Office of Management and Budget (OMB) issued “Fiscal Year 2003 

Budget of the U.S. Government,” which assessed the Space Shuttle Safety Upgrades Program as 

ineffective. The basis of OMB’s assessment was NASA’s large cost overruns3

 and schedule 

delays in improving the safety of Space Shuttle. Appendix B contains further details on OMB’s 

conclusions. 

 

1

The Space Shuttle Challenger 51-L was the 25th mission in NASA's Space Transportation System program. The 

January 28, 1986, Challenger explosion shortly after liftoff resulted in the destruction of the vehicle and death of its

seven crew members. 2

Approved upgrades are those safety upgrade projects that NASA has approved to proceed from formulation to 

implementation. 3

OMB considered the cost increase from NASA’s estimates provided early in project formulation as the cost 

overruns. 
Results in Brief 

NASA appropriately managed safety upgrades approved for implementation to ensure they met 

established safety objectives, were selected using quantitative and qualitative factors, and were 

adequately funded for fiscal year (FY) 2002. In addition, we found that NASA ensured that the 

integration of the safety upgrades did not adversely affect the Space Shuttle flight schedule. 

Although the safety upgrades approved for implementation were adequately funded for FY 2002, 

the Congress and Aerospace Safety Advisory Panel (the Panel)4

 expressed concerns about the 

adequacy of future funding (see report section entitled, Other Matters of Interest). 

Background 

The Space Shuttle Program (SSP) is an essential element of NASA's integrated space 

transportation strategy for the first decade of this century. That strategy includes continued 

utilization of the Space Shuttle as the nation's primary launch vehicle for human access to space 

well into the second decade of this century and possibly beyond. NASA’s current plans are to 

safely operate the Space Shuttle through at least 2012,5

 to support the International Space Station 

for assembly and logistics missions, to undertake non-International Space Station missions that 

require unique Space Shuttle capabilities, and to meet other national goals for reusable launch 

vehicles. 

In NASA’s FY 2001 budget, the Congress appropriated $256 million to initiate the High-Priority 

Safety Upgrades Program. Congress directed the SSP to plan for and make prudent investments 

in system safety upgrades to reduce operational risk and to provide a more reliable capability to 

support NASA's human space mission objectives. Accordingly, the SSP established its 

Development Office to proactively provide a safer and more efficient Space Shuttle system that 

will continue to support the Agency’s commitments and goals for human access to space. The 

FY 2002 budget for the SSP Development Office safety upgrades is $207 million. 

 

4

The Aerospace Safety Advisory Panel is a senior advisory committee that reports to NASA and the Congress. The 

Panel reviews safety studies and operations plans that are referred to it and reports to the NASA Administrator with

respect to the hazards of proposed operations and to the adequacy of proposed or existing safety standards. 

2 

5

NASA based the current Space Shuttle upgrade strategy on the premise of ensuring the Space Shuttle can fly safely 

until 2012. However, on March 25, 2002, the NASA Associate Administrator for Space Flight requested that the 

Director, Lyndon B. Johnson Space Center, develop a strategy to identify upgrades and supportability investments 

needed to maintain the Space Shuttle fleet capability to fly safely through 2020. 
Space Shuttle Safety Upgrade Selection 

The safety upgrade candidates6 met at least one of the three safety objectives identified in 

National Space Transportation System (NSTS) 37400, “Space Shuttle Program Upgrades 

Management Plan,” July 21, 2000. In addition, the suite of proposed safety upgrades7

collectively met the targets established for each safety objective; however, two of the low-cost 

safety upgrades could not meet the established targets on an individual basis.

Space Shuttle Program Development Strategy 

NASA intends that Space Shuttle upgrades further the primary goals of the SSP. The SSP goals 

are to fly safely, meet the Shuttle manifest, improve supportability, and improve the Space 

Transportation System to meet the Agency’s commitments and strategies for human operation in 

space. 

NASA’s upgrade investment strategy considers two types of upgrades: high-priority safety 

upgrades (to improve system safety) and supportability upgrades (to mitigate obsolescence 

issues). Safety upgrades are those upgrades that minimize ascent, descent, and critical 

operations risks. The principal factors used to determine high-priority safety upgrades are the 

degree of safety improvement and how quickly the associated benefits can be realized. 

Supportability upgrades are primarily those system upgrades required to ensure that reliable 

Space Shuttle system hardware is available to the SSP to support the expected Space Shuttle 

mission manifest through at least 2012. The schedule for implementing obsolescence-driven 

supportability upgrades depends on when they are needed to mitigate a supportability threat. 

Space Shuttle Safety Upgrade Objectives 

NSTS 37400, “Space Shuttle Program Upgrades Management Plan,” July 21, 2000,8

 describes 

NASA’s safety upgrade objectives as follows: 

• major reduction in ascent catastrophic risk (targeting up to a 50-percent risk reduction); 

• significant reductions in orbital and entry/landing catastrophic risk (targeting up to a 

30-percent risk reduction); and 

 

6

The safety upgrade candidates that we reviewed included both approved and deferred upgrades: Cockpit Avionics 

Upgrade, Electric Auxiliary Power Unit, Space Shuttle Main Engine Advanced Health Management System

Phase I, External Tank Friction Stir Weld, and Main Landing Gear Tire/Wheel. The Electric Auxiliary Power Unit 

was deferred in June 2001 because of a lack of technology development. The Space Shuttle Main Engine Advanced 

Health Management System Phase II was deferred in September 2001 because of limited funding. Appendix D 

contains additional details on these safety upgrades. 7

The suite of safety upgrades includes upgrades that collectively would reduce Shuttle ascent risk by as much as 

50 percent and reduce orbital and entry/landing risk by as much as 30 percent. Because of budget constraints and 

technical limitations, NASA deferred some of these upgrades (see Appendix D). 

3 

8

We found that NSTS 37400 reflected upgrades that were no longer being considered due to budget constraints. 

Management stated that a draft of the revised management plan was in the review process. 
• major improvement in flight crew situational awareness for managing critical flight 

operational situations through cockpit modernization. 

The SSP Development Office established risk reduction target percentages for each stated safety 

upgrade objective. However, the selection of a specific upgrade did not depend solely on 

meeting one of the targeted percentages. 

We reviewed the safety upgrade objectives and targets and found that NASA appropriately used 

the safety objectives to prioritize safety upgrades before considering affordability, technology 

readiness, and early implementation potential. Although we also found that two9

 of the low-cost 

safety upgrades did not significantly contribute to achieving the stated safety objectives, the suite 

of upgrades collectively met all the risk reduction targets associated with the safety upgrade 

objectives. Appendix D contains additional information on the objectives. 

Conclusion 

NASA selected the safety upgrades based on the total of the risk reductions for a suite of 

upgrades rather than the percentage to be gained from an individual project. NASA acted 

appropriately because it needed to consider other programmatic factors such as cost and 

schedule. 

 

4 

9

The two low-cost upgrades were the Main Landing Gear Tire/Wheel (estimate at completion of $11 million) and 

External Tank Friction Stir Weld (estimate at completion of $21 million). 
Quantitative and Qualitative Analyses 

NASA appropriately selected safety upgrades approved for implementation by using quantitative 

and qualitative analyses.10 Although the SSP Development Office did not employ a standard 

analytical process, it used appropriate methods to evaluate each upgrade.

Space Shuttle Safety Upgrades Prioritization and Selection 

The primary goal of the safety upgrade prioritization and selection process is to allocate 

resources to significant safety improvement opportunities. NASA based the Space Shuttle safety 

upgrades prioritization and selection process on the Space Shuttle operational risk model. This 

model establishes the relative risk contribution of each Space Shuttle hardware element to 

overall Space Shuttle risk and identifies the high-risk systems and components of each element. 

The SSP Development Office established and maintained the resulting comparative risk 

contribution baseline as a major tool for prioritizing safety upgrade candidates. However, the 

SSP Development Office used many different methods, both qualitative and quantitative, to 

ascertain risk and select potential candidates. 

In addition to prioritizing upgrades based on safety improvement potential, the SSP 

Development Office also screened upgrades for how well they met SSP goals, affordability, 

technology readiness, and early implementation potential. For example, as part of prioritizing 

upgrades, the SSP Development Office would rank an upgrade proposal with modest risk 

reduction potential, but very high cost to implement, lower than a much less expensive proposal 

that offered similar risk reduction potential. The SSP Development Office uses the results of 

these analyses to develop a prioritized suite of safety upgrade candidates based on their ability to 

eliminate or reduce the potential for catastrophic loss. 

Alternative Safety Upgrade Selections 

Once the SSP Development Office develops the suite of highest priority proposed upgrades, it 

determines whether adequate resources exist. Because limited funds are available, the SSP 

Development Office prioritizes safety upgrades based not only on benefit and risk, but also on 

affordability. The SSP Development Office used the affordability prioritization factor to select 

two low-cost safety upgrades that were within the available funding limitations and provided the 

greatest safety benefit for the investment. NASA selected the Main Landing Gear Tire/Wheel 

and External Tank Friction Stir Weld safety upgrades as part of the suite of approved upgrades. 

 

5 

10Quantitative and qualitative analyses include but are not limited to preliminary hazard analyses, failure modes and 

effects analyses, system and subsystem hazard analyses, fault tree analyses, human factors analysis/assessments, 

peer reviews, and baseline hazard data such as discrepancy reports and in-flight/ground anomalies found in the 

Shuttle’s Problem Reporting and Corrective Action database. 
Probabilistic Risk Assessments 

NASA used a probabilistic risk assessment11 method, specifically the Quantitative Risk 

Assessment System,

12 to determine the risk reduction percentage for four of the five upgrade 

projects we reviewed. In recent years, critics of probabilistic risk assessment tools pointed out 

that sole reliance on this system can lead to an unsafe spacecraft because the system: 

• tends to focus on component/subsystem/system failures, 

• can result in a goal of improving the risk reduction percentages without improving the 

design, 

• concentrates on catastrophic hardware failures while not identifying risks associated 

with crew injury/vehicle damage, and 

• does not account for safety risks associated with the vehicle operational 

design/concept.13

In addition, the results of the probabilistic risk assessment method depend on the quality and 

completeness of the underlying engineering model,14 the quality and quantity of the data 

introduced, and the competencies of the individual using the system. Therefore, we were 

initially concerned about NASA’s use of the Quantitative Risk Assessment System. However, 

we reviewed the probabilistic risk assessments and found that the SSP Development Office did 

not rely solely on this analytical tool15 to determine risk. 

Conclusion 

NASA appropriately used quantitative and qualitative analyses to prioritize and select safety 

upgrades. For example, the SSP Development Office used quantitative risk analyses to rank 

safety risks and to prioritize safety upgrades and considered qualitative factors and judgment in 

determining what assumptions, such as risk factors, to use in the Quantitative Risk Assessment 

System and how to interpret the results. 

 

11Probabilistic risk assessment is a general term given to methodologies that assess risk. Although probabilistic risk 

assessment methods are usually quantitative, these methods can be either subjective or quantitative. 12The Quantitative Risk Assessment System is a personal computer-based software tool used to perform a 

probabilistic risk assessment. 13Critics of the probabilistic risk assessment based their explanations on the “Proceedings of the 19th International 

Systems Safety Conference – 2001, Risk Probability Numbers and Human-Rated Spacecraft Systems Safety,” 

published by the Systems Safety Society. 14The engineering model is incomplete and does not contain certain key attributes such as human error, procedural

error, secondary failures/conditions, operationally induced errors, or environmentally induced errors. 

6 

15The SSP Development Office used other analyses which included preliminary hazard analyses, failure modes and 

effects analyses, fault tree analyses, human factors analysis/assessments, peer reviews, and an assortment of 

baseline hazard data. 
Safety Upgrade Funding 

NASA had adequately funded the safety upgrades approved for implementation to ensure 

completion of the modifications when needed. For FY 2002, NASA received $207 million for 

high-priority safety upgrades--$20 million more than the $187 million the Agency requested.16 

The FY 2002 President’s Budget17 contained a program estimate for safety upgrades of about 

$1.6 billion.18 However, the FY 2003 President’s Budget reduced the program estimate for 

safety upgrades to $1 billion. The decrease of almost $600 million resulted from NASA’s 

reduction in and deferral of safety upgrade projects. 

Deferral of Electric Auxiliary Power Unit 

The SSP Development Office encountered significant technical challenges with the Electric 

Auxiliary Power Unit (APU) (see Appendix D for additional information on the Electric APU) 

project as the technical formulation phase progressed. Assumptions made for the initial estimate 

about the maturity of necessary technology, primarily the power cells, were incorrect, and 

significantly more technology development needed to be performed. The cost estimate to 

complete the project increased due to the inability to mature the technology, resulting in 

significant weight, mass, and cost growth. As a result, the most recent cost proposal was 

$667 million--more than three times the original estimate of $182 million. These cost increases 

primarily resulted from NASA’s underestimate of the technological risk remaining for 

developing the unique batteries required for the Electric APU and from growth in requirements 

early in the project formulation phase. In June 2001, NASA deferred the Electric APU as an 

upgrade because of technical and budget issues, but continued to pursue it as a technology 

development effort. As of December 2001, NASA had spent $70.3 million on the Electric APU 

project. 

Deferral of Space Shuttle Main Engine Advanced Health Management System Phase II 

NASA provided a $55 million preliminary estimate at completion for the Space Shuttle Main 

Engine (SSME) Advanced Health Management System (AHMS) Phase II (see Appendix D) 

during the budget formulation before the Agency knew either the scope or content of the 

program. An official of the NASA Independent Program Assessment Office stated that budget 

formulation demands often result in submission of premature estimates. The official explained 

that project estimates at completion are often required from project managers during the 

formulation phase when technology, schedule, and cost requirements are not yet fully developed, 

and there are many unknowns. However, estimates at completion must be provided early in the 

 

16The Manager, SSP Development Office is reviewing all projects to determine whether there is a potential for risk 

reduction or schedule acceleration if additional funds are allocated. However, the SSP Development Office has not 

made any decisions on how to use the additional $20 million. 17The President’s FY 2002 budget, “A Blueprint for New Beginnings,” February 28, 2001, outlined the President’s 

vision for governing the Nation. 

7 

18This budget estimate was the total cost estimate from the beginning of the Space Shuttle Safety Upgrades Program

through FY 2006. 
formulation stage in order for NASA to secure funding for future years. The latest estimate at 

completion for the SSME AHMS Phase II was $179 million.19 However, in September 2001, 

NASA deferred the SSME AHMS Phase II because of budget issues.20

NASA’s Response to Cost Growth 

NASA has responded to the growth in cost estimates by taking actions to improve cost 

management and cost estimating, including increasing its program evaluation capability by 

adding staff for the cost estimating function. In addition, the recent award of the Independent 

Program Assessment Contract to Booz Allen Hamilton is a step toward improving the Agency’s 

independent assessment capability. The contractor will support the Lyndon B. Johnson Space 

Center Systems Management Office in providing full programmatic and institutional assessment 

capability. 

Also, OMB and NASA are developing an agreement on the kinds of information NASA should 

provide to OMB for program approval, evaluation, and updates.21 This agreement should result 

in a more appropriate measure of cost estimates. 

Conclusion 

NASA continues to invest in safety upgrades for the Space Shuttle. The SSP Development 

Office has received sufficient funds for FY 2002 to continue work on high-priority safety 

upgrades that NASA approved for implementation. However, if the probability of catastrophic 

failure is to decrease further, NASA will need to increase funding to complete safety upgrade 

projects that have been reduced, deferred, or cancelled. 

 

19As of December 2001, costs incurred for the SSME AHMS Phase II were $7.5 million. 20Partial funding for FY 2002 was provided for the SSME AHMS Phase II to complete the development and 

documentation of the detailed technical specifications, to complete hardware preliminary design, and to refine cost

estimates for future consideration. The SSP Development Office’s position is that the SSME AHMS Phase II will 

be deferred indefinitely after FY 2002 if an adequate funding source cannot be identified for the implementation 

effort. 

8 

21OMB indicated that this program agreement could be completed by late FY 2002. 
Impact on Space Shuttle Flight Schedule 

The safety upgrades have not adversely affected the Space Shuttle flight schedule. Also, in the 

near future, there should be no adverse effect because of the limited number of upgrades being 

performed and the reduced number of planned flights. 

Mixed Fleet Study 

NASA performed a Mixed Fleet Study in May 2001. NASA defines a mixed fleet as one 

configured with multiple combinations of the Cockpit Avionics Upgrade (CAU)22 and the 

Electric APU23 (which has been deferred). The purpose of the Mixed Fleet Study was to develop 

an option to reduce the time the fleet is flying in a mixed configuration due to incorporation of 

major safety and supportability upgrades while maintaining the Space Shuttle flight schedule. 

The purpose of reducing the mixed fleet operating time was to provide overall cost savings due 

to reduced multiple configuration support requirements, reduce the strain associated with limited 

resources working multiple configurations, minimize the need for maintaining and operating 

multiple manuals and processes, reduce the window of vulnerability/risk of errors with multiple 

processes and procedures, and reduce training requirements for operations and support. When 

the Electric APU was deferred in June 2001, the May 2001 Mixed Fleet Study became obsolete. 

The SSP Office will make integration decisions with respect to the CAU in late summer 2002, 

when it expects to complete a new Mixed Fleet Study. 

Impacts on Flight Rates 

While the President’s budget for FY 2002 proposed an increase in NASA’s overall budget, it 

recommended that Space Shuttle flight rates be reduced from seven to six a year. However, the 

President’s budget for FY 2003 directs that NASA contain rising Space Shuttle costs, which are 

due primarily to personnel costs, aging infrastructure, and growing vehicle obsolescence. The 

FY 2003 budget also supports a recommendation made by the International Space Station 

Management and Cost Evaluation Task Force that NASA further reduce the Space Shuttle flight 

rate to five a year in FY’s 2003 and 2004 and to four a year in FY’s 2005 and 2006. 

Conclusion 

NASA used the Mixed Fleet Study to ensure that approved Space Shuttle safety upgrades 

minimized adverse effects on the Space Shuttle flight schedule. However, due to budget 

restrictions and technical problems, only one major safety upgrade (the CAU) that affects the 

 

22NASA’s Program Management Council granted the CAU authority to proceed through the preliminary design 

review, which was held in April 2002. As a result of that review, the Program Management Council must decide by

late summer 2002 whether to grant further authority to proceed. 

9 

23The SSME AHMS Phase I is a major safety upgrade, but because it does not affect modifications to the Orbiter, 

NASA did not consider the upgrade in the Mixed Fleet Study. 
Mixed Fleet Study is being performed. NASA will not make decisions regarding the integration 

of the CAU safety upgrade until summer 2002. This decision will be supported by a preliminary 

design review and a new Mixed Fleet Study in order for NASA to determine the best time to 

integrate the upgrade. 

10 
Other Matters of Interest 

Although we found that the Space Shuttle safety upgrades approved for implementation were 

adequately funded for FY 2002, the Congress and the Aerospace Safety Advisory Panel (the 

Panel) expressed concerns about deferred and future safety upgrades. The Panel reported that 

because of the budget shortfall, safety upgrades will not be adequately funded, and NASA’s 

plans to replace the Space Shuttle will not be accomplished in the near future. 

On April 18, 2002, the House Subcommittee on Space and Aeronautics held a hearing on the 

Space Shuttle and Space Launch Initiative Programs. The hearing examined NASA’s plans to 

operate and maintain the Space Shuttle and NASA’s strategy for developing a second-generation 

reusable launch vehicle to replace the Space Shuttle. 

During the hearing, the former Panel Chairman testified that during his involvement with the 

Panel, he had never been as concerned for Space Shuttle safety as he currently was. The Panel 

reported in its “Annual Report for 2001” that current plans and budgets for the Space Shuttle 

were not adequate and that while safety continues to be well served presently, the basis for future 

safety has eroded. In addition, the former Chairman stated that nobody would know for sure 

when the safety margin had been eroded too far and that the current approach was planting the 

seeds for future danger. Appendix C contains additional details on the Panel’s “Annual Report 

for 2001.” 

Despite the Panel’s concerns, NASA’s Associate Administrator for Space Flight assured 

Congress that sufficient funds were available to maintain the current levels of safety for the 

Space Shuttle. In addition, the Associate Administrator indicated that for the Space Shuttle to 

successfully continue accomplishing its goals, the SSP Office must implement upgrades that will 

increase flight safety and improve systems reliability. NASA has established a goal to have its 

currently approved safety upgrades implemented into the fleet by 2007. As a contingency, the 

Associate Administrator also asked the SSP Office to assess upgrade investments required to 

safely fly the Space Shuttle through FY 2020. 

11 
Appendix A. Objectives, Scope, and Methodology 

Objectives 

The overall objective was to evaluate NASA's management of Space Shuttle safety upgrades. 

Specifically, we determined whether NASA ensured that the approved safety upgrades: met 

established safety objectives, were selected based on quantitative analysis or other measurable 

methodology, were adequately funded to ensure completion of the modifications when needed, 

and minimized adverse impacts to the Space Shuttle flight schedule. 

Scope and Methodology 

We reviewed prior audits by NASA’s Office of Inspector General, the General Accounting 

Office, and the National Research Council, applicable Federal laws and regulations, NASA 

budget and historical data, procedures and guidelines, management plans and independent 

assessments/reviews. We discussed the audit scope with program management officials at the 

Lyndon B. Johnson Space Center. We did not assess the reliability of computer-processed data, 

because we did not rely on it to achieve our objectives. 

Management Controls Reviewed 

We reviewed the processes the Space Shuttle Program Development Office used to determine 

the prioritization and selection of the Space Shuttle safety upgrades. Additionally, we examined 

the process and the independent cost estimates that were prepared on the selected safety upgrade 

projects. We considered the controls in place to be adequate. 

Audit Field Work 

We performed the audit field work from June 2001 through May 2002 at the Lyndon B. Johnson 

Space Center. We performed the audit in accordance with generally accepted government 

auditing standards.

Summary of Prior Audits and Reviews 

The Aerospace Safety Advisory Panel, the General Accounting Office, and the National 

Research Council have issued several reports and testimony on Space Shuttle safety upgrades, 

which are summarized in Appendix C. 

12 
Appendix B. NASA Fiscal Year 2003 Budget Status Report 

on Shuttle Safety Upgrades 

The Office of Management and Budget (OMB) reviews programs throughout the Federal 

Government to identify strong and weak performers. The budget seeks to redirect funds where 

appropriate from lesser-performing programs to higher priority or more effective programs. 

Particularly, when low-performing programs are in priority areas, deficiencies will be addressed 

through reforms to improve performance. OMB rated the Space Shuttle Safety Upgrade 

Program ineffective and explained that the Program needed to address large cost overruns24 and 

schedule delays to improve Space Shuttle safety through effective investments. 

OMB’s Overall Performance Rating. OMB’s review concluded that NASA continues to 

invest in improving Space Shuttle safety, but some of the planned investments are experiencing 

significant problems (as depicted below). For example, the Electric Auxiliary Power Unit was 

the highest priority safety upgrade last year (fiscal year 2001), but delays, technical difficulties, 

decreasing safety benefits, and a tripling of its projected cost led NASA, with the support of its 

advisory committee, to cancel the project. 

While the safety and schedule record of Space Shuttle operations has been very good and costs 

had come down considerably in the last decade, the Space Shuttle remains a very expensive 

vehicle to operate. In the last few years, Space Shuttle costs have begun to rise again, due to 

personnel costs, aging infrastructure, growing vehicle obsolescence, and a shrinking industrial 

base. 

 

24See Footnote No. 3. 

13 
Appendix B 

Improving Safety. OMB stated that NASA continues to invest in safety improvements for the 

Space Shuttle and increases investment in repairing aging Space Shuttle infrastructure. Planned 

safety upgrades will enhance safety during launch by 12 percent and will decrease the estimated 

risk of catastrophic failure during launch from 1 in 556 missions to 1 in 620 missions. Delays in 

the planned implementation of these upgrades continue to be a concern, so funding will be set 

aside specifically to accelerate the availability of planned upgrades. 

14 
Appendix C. Prior Audit Reports and Reviews 

Aerospace Safety Advisory Panel 

“Annual Report for 2001,” March 2002. The Annual Report of the Aerospace Safety 

Advisory Panel (the Panel) presents results of activities during calendar year 2001. The Panel 

reported that budget cutbacks and shifts in priorities had severely limited the resources available 

to the Space Shuttle for application to risk-reduction and life-extension efforts. As a result, 

funds originally intended for long-term, safety-related activities have been used for operations. 

Thus, while safety continues to be well served at present, the basis for future safety has eroded. 

The Panel focused on the dichotomy between future Space Shuttle risk and the required level of 

planning and investment to control that risk. The report states that current plans and budgets 

were not adequate. The report also states it was not prudent to delay ready-to-install safety 

upgrades, thus continuing to operate at a higher risk level than is necessary. When risk reduction 

efforts, such as the advanced health monitoring for the Space Shuttle Main Engine, are deferred, 

astronauts are exposed to higher levels of flight risk for more years than necessary. These lost 

opportunities are not offset by any real life-cycle cost savings. The stock of some existing Space 

Shuttle components is not sufficient to support the program until a replacement vehicle becomes 

available. Some of the upgrades, in addition to improving safety, solve this shortfall by 

providing additional assets. If these upgrades are not going to be implemented, the program

must plan now for adequate quantities of long lead-time components to sustain safe operations. 

Regarding specific safety upgrades, the Panel reported that it was unfortunate that the Space 

Shuttle Main Engine Advanced Health Management System Phase II had been deferred and that 

the Electric Auxiliary Power Unit would be assessed as a potential safety upgrade by the Space 

Shuttle Program after the related technology had further matured. 

General Accounting Office Reports and Testimony 

“Space Shuttle Safety Update on NASA’s Progress in Revitalizing the Shuttle Workforce 

and Making Safety Upgrades,” GAO-01-1122T, Testimony, September 6, 2001. In 

August 2000, the NASA Space Shuttle Program was at a critical juncture. Its workforce had 

declined significantly since 1995, its flight rate was to double to support the assembly of the 

International Space Station, and costly safety upgrades were planned to enhance the Space 

Shuttle's operation until at least 2012. Workforce reductions were jeopardizing NASA's ability 

to safely support the Space Shuttle's planned flight rate. Recognizing the need to revitalize the 

Space Shuttle's workforce, NASA ended its downsizing plans for the Space Shuttle Program and 

began to develop and equip the Space Shuttle fleet with various safety and supportability 

upgrades. NASA is making progress in revitalizing the Space Shuttle Program's workforce. 

NASA's fiscal year (FY) 2001 budget request projected an increase of more than 200 full-time 

equivalent staff through FY 2002. NASA has also focused more attention on human capital 

management in its annual performance plan. However, considerable challenges still lie ahead. 

Because many of the additional staff are new hires, they will need considerable training and will 

need to be integrated into the Space Shuttle Program. Also, NASA still needs to fully staff areas 

15 
Appendix C 

critical to Space Shuttle safety; deal with critical losses due to retirements in the coming years; 

and, most of all, sustain management attention to human capital reforms. Although NASA is 

making strides in revitalizing its workforce, its ability to implement safety upgrades in a timely 

manner is uncertain. 

“Space Shuttle: Human Capital and Safety Upgrade Challenges Require Continued 

Attention,” GAO/NSIAD/GGD-00-186, August 15, 2000. In response to a congressional 

request, The General Accounting Office (GAO) reviewed the workforce and safety issues facing 

NASA and its Space Shuttle Program, focusing on the: (1) impact of workforce reductions on 

the Space Shuttle Program; (2) challenges NASA faces in addressing workforce issues; and 

(3) status of planned Space Shuttle safety and supportability upgrades. Among other matters, 

GAO noted that in regard to safety issues, over the next 5 years, NASA plans to develop and 

begin equipping the Space Shuttle fleet with a variety of safety and supportability upgrades at an 

estimated cost of about $2.2 billion. Further, to implement the program successfully, NASA will 

have to overcome a number of programmatic and technical challenges, such as a demanding 

schedule and undefined design and workforce requirements. 

“Space Shuttle: Upgrade Activities and Carryover Balances,” Testimony, GAO/T-NSIAD98-21, October 1, 1997. In response to a congressional request, GAO discussed the NASA 

Space Shuttle Program, focusing on: (1) the effect of a funding transfer from the Space Shuttle 

Program to the International Space Station Program on major Space Shuttle upgrade projects and 

the status of those projects, (2) the role carryover budget balances had in the transfer and in 

funding upgrades, and (3) funding for future upgrades. Concerning Space Shuttle upgrades, 

GAO noted that the $190 million funding transfer to the International Space Station Program did 

not adversely impact current or near-term upgrade projects; four current projects, which account 

for about 91 percent of the total funding provided for upgrade activities in FY 1997, could not 

have used the transfer funds; and even though they experienced technical problems and 

associated schedule slips, the projects' financial reserves were sufficient to fund the problems 

that were experienced. Furthermore, GAO reported that NASA has used carryover budget 

balances to fund upgrades in the past and plans to continue doing so in the future; that depending 

on the future upgrades selected, costs could range from hundreds of millions to several billions 

of dollars; and that NASA is defining an upgrade program to keep the Space Shuttle a viable 

space transportation system at least through about 2013 -- the planned mission life of the 

International Space Station. Finally, in addition to annual funding requests for safety and 

performance upgrades and the continued use of excess carryover budget balances, NASA plans 

to use any savings that are generated within the Space Shuttle Program to fund its upgrade 

activities; the extent to which these sources will be available in the future is uncertain; and 

funding needs for future upgrades will be driven by a number of questions related to issues such 

as how long the Space Shuttle will be required and whether viable alternatives can be developed 

to support space station operations and other human space flight requirements. 

16 
Appendix C 

National Research Council 

“Upgrading the Space Shuttle,” Committee on Space Shuttle Upgrades, Aeronautics and 

Space Engineering Board, Commission on Engineering and Technical Systems, 1999. In 

May 1998, NASA asked the National Research Council (the Council) to examine the Agency's

plans for further upgrades to the Space Shuttle system. The Council was asked to assess NASA's 

method for evaluating and selecting upgrades and to conduct a top-level technical assessment of 

proposed upgrades. NASA did not ask the Council to—and the Council’s report does not—

discuss the larger issue of whether the Space Shuttle should be upgraded. The report was limited 

to a review of NASA's approach to prioritizing and selecting upgrades and a top-level technical 

assessment of several representative proposed upgrades. The decision to implement many of the 

major proposed Space Shuttle upgrades must await a high-level national policy decision on when 

the Space Shuttle should be phased out in favor of some other launch vehicle (or vehicles). The 

report emphasized that although it may be tempting to delay making this decision until it 

becomes clear when a Space Shuttle replacement will be available, a timely decision is crucial 

for NASA to act efficiently either by phasing out its Space Shuttle upgrade program or by 

making the major investments necessary for the Space Shuttle to carry out its long-term mission 

reliably and efficiently. 

17 
Appendix D. Space Shuttle Safety Upgrades Objectives 

National Space Transportation System (NSTS) 37400, “Space Shuttle Program Upgrades 

Management Plan,” July 21, 2000, identifies the following safety upgrades objectives: 

• major reduction in ascent catastrophic risk (targeting up to a 50-percent risk reduction); 

• significant reductions in orbital and entry/landing catastrophic risk (targeting up to a 

30-percent risk reduction); and 

• major improvement in flight crew situational awareness for managing critical flight 

operational situations through cockpit modernization. 

NASA derived the targets associated with the first two objectives by adding the individual risk 

reduction for each of the candidate upgrades that the Agency selected. However, because of 

budget constraints and technical limitations,25 only two major upgrades are being pursued, the 

Cockpit Avionics Upgrade (CAU) (Figure D-1) and the Space Shuttle Main Engine (SSME) 

Advanced Health Management System (AHMS) Phase I. While two less costly safety upgrades, 

the External Tank Friction Stir Weld and Main Landing Gear Tire/Wheel, could not individually 

meet the safety objectives, the suite of proposed safety upgrades collectively met the established 

safety objectives. NASA has built the consideration of the safety objectives into the selection 

process. 

Figure D-1. Cockpit Avionics Upgrade 

Source: NASA

The CAU is a high-priority Space Shuttle safety upgrade. The project will provide new Orbiter 

cockpit avionics hardware and software to meet the man-machine interface requirements that 

will enhance overall crew safety. Orbiter cockpit displays and crew interface capabilities will be 

18 

 

25The Electric APU was deferred in June 2001. It is now identified as a technology development effort with about

$4 million in funding for fiscal year 2002. 
Appendix D 

significantly improved by replacing the existing integrated display processors with higher 

performance command and display processors. These units will provide expanded processing 

performance to enable dramatic improvements in information access and display capability as 

well as the implementation of new abort flight management and enhanced caution and warning 

software functions. 

The CAU will increase crew situational awareness and decrease crew workload in the cockpit to 

enable more timely and accurate crew decisions. Excessive crew workload adversely affects the 

crew’s situational awareness and impairs crew ability to diagnose and isolate system failures. 

Improving the crew’s ability to manage information during critical flight operations will 

significantly benefit the safety and reliability of the Space Shuttle Program. The CAU is 

designed to significantly improve crew performance margins in safety-critical, high-workload 

scenarios and to mitigate risk of crew error throughout all critical flight operational phases (the 

third safety upgrade objective). 

The SSME AHMS Phase I (Figure D-2) upgrade includes the contracted design, development, 

modification, certification, and delivery of 20 flight-advanced SSME controllers to include a 

high-pressure turbopump synchronous vibration redline capability,26 new external 

communications interface, enhanced memory, and deletion of memory retention batteries. 

Figure D-2. Advanced Health Management System 

Phase I Phase II 

Source: NASA

SSME Block II 

Controller 

UPGRADE

Health 

Management 

Computer 

 

19 

26The high-pressure turbopumps are the largest contributors to catastrophic ascent risk. The vibration redlines 

protect against bearing, impeller, and turbine blade failures within the SSME controller. The addition of a reliable 

catastrophic redline shutdown limit will result in a substantial reduction in both SSME and vehicle ascent risk. 
Appendix D 

The SSME AHMS Phase II upgrade will improve Space Shuttle safety by reducing the 

probability of catastrophic engine failures during the ascent phase of a Space Shuttle mission. 

This will be accomplished by the addition of new engine health management hardware and 

software, which will provide the capability to detect, diagnose and mitigate the effects of 

potentially catastrophic failures. The addition of the SSME AHMS Phase II capabilities will 

provide substantial reductions in catastrophic ascent risk above and beyond that achieved by 

Phase I. Additionally, Phase II will reduce the likelihood of having to abort the mission or, if an 

abort is required, will increase the probability that the abort will be less risky. However, in 

September 2001, because of limited funding, the SSME AHMS Phase II is in a deferred status 

until NASA increases the funding or makes a decision to formally cancel the project. The SSME 

AHMS is designed to reduce ascent risk by about 19 percent and reduce mission risk by about 

9 percent (first safety upgrade objective). 

The Electric Auxiliary Power Unit (APU) (Figure D-3) system was designed to replace the 

Orbiter’s existing Hydrazine APU27 with a battery. The Electric APU consists of a battery, 

associated 270-volt power, distribution and control, electro-hydraulic drive unit, and cooling 

system. All existing functional performance requirements of the existing Hydrazine APU will be 

met with the Electric APU, but without the highly toxic hydrazine fuel and high-speed turbo 

machinery and associated hazards. The Electric APU is designed to reduce mission risk by 

15 percent and ascent risk by less than 1 percent (second safety upgrade objective). In June 

2001, NASA deferred the Electric APU because of technical and budget issues. 

Figure D-3. Electric Auxiliary Power Unit 

Source: NASA

REPLACE HYDRAZINE POWERED AUXILIARY POWER 

UNIT’S WITH ELECTRIC AUXILIARY POWER UNIT’S

20 

 

27The Hydrazine APU is a highly toxic, explosive, flammable and corrosive system that utilizes a high-speed turbine 

to drive a pump shaft and pressurize the Orbiter hydraulic system. 
Appendix D 

Friction Stir Weld (Figure D-4) is a solid-state welding process utilizing a nonconsumable 

cylindrical tool, with a unique auger-type pin, which is rotated, plunged, and traversed along the 

weld joint using conventional milling equipment and backside support. Material around the tool 

is frictionally heated, plasticized, and extruded/forged to the back of the pin, where the material 

consolidates and cools under hydrostatic pressure conditions. The resulting wrought 

microstructure exhibits high strength and ductility. The Friction Stir Weld is designed to 

improve manufacturing reliability and was approved largely based on the potential to reduce the 

manufacturing defects in each external tank from about 100 per tank, which are experienced 

today, to none. This project is identified to reduce ascent risk by less than 1 percent (first safety 

upgrade objective). 

Figure D-4. Friction Stir Weld 

(FSW)

Source: NASA

Tool Holder 

FSW Tool 

Base Metal Hot Worked 

Metal 

Plasticized Metal 

Machine 

Spindle 

Direction

Welding

21 
Appendix D 

The Main Landing Gear Tire/Wheel (Figure D-5) project will replace the existing Orbiter tire 

and wheel with an improved tire/wheel design that will add a safety margin for landing 

operations by increasing load capability with only minor changes to flight operations and ground 

processing. NASA approved the project based on expected improvements of gaining about a 

20-percent margin in the tire load capability at touchdown, thereby reducing the risk of a tire 

blow-out on landing and potentially losing control during landing and roll out. This project is 

designed to reduce mission risk by less than 1 percent (second safety upgrade objective). 

Figure D-5. Main Landing Gear Tire/Wheel 

SIDE WALL 

UNDER TREAD 

TREAD / GROOVE 

LINER 

STEEL 

BEADS CARCASS PLY 

TURN-UPS

CHAFER 

STRIPS

16 BIAS PLIES 

TIRE CARCASS

Source: NASA 

22 
Appendix E. Management’s Response 

23 
Appendix F. Report Distribution 

National Aeronautics and Space Administration Headquarters 

HQ/A/Administrator 

HQ/AI/Associate Deputy Administrator 

HQ/AA/Chief of Staff 

HQ/AB/Associate Deputy Administrator for Institutions 

HQ/B/Deputy Chief Financial Officer 

HQ/B/Comptroller 

HQ/BF/Director, Financial Management Division 

HQ/G/General Counsel 

HQ/H/Assistant Administrator for Procurement 

HQ/HK/Director, Contract Management Division 

HQ/HS/Director, Program Operations Division 

HQ/J/Assistant Administrator for Management Systems 

HQ/JM/Director, Management Assessment Division 

HQ/L/Assistant Administrator for Legislative Affairs 

HQ/M/Associate Administrator for Space Flight 

NASA Advisory Officials 

HQ/I/Chair, NASA Advisory Council 

HQ/Q-1/Chair, NASA Aerospace Safety Advisory Panel 

NASA Centers 

JSC/AA/Director, Lyndon B. Johnson Space Center 

JSC/MA/Manager, Space Shuttle Program Development 

KSC/CC/Chief Counsel, John F. Kennedy Space Center 

Non-NASA Federal Organizations and Individuals 

Assistant to the President for Science and Technology Policy 

Deputy Associate Director, Energy and Science Division, Office of Management and 

 Budget 

Branch Chief, Science and Space Programs Branch, Energy and Science Division, Office 

 of Management and Budget 

Managing Director, Acquisition and Sourcing Management Team, General Accounting Office 

Senior Professional Staff Member, Senate Subcommittee on Science, Technology, and Space 

24 
Appendix F 

Chairman and Ranking Minority Member – Congressional Committees and 

Subcommittees 

Senate Committee on Appropriations 

Senate Subcommittee on VA, HUD, and Independent Agencies 

Senate Committee on Commerce, Science, and Transportation 

Senate Subcommittee on Science, Technology, and Space 

Senate Committee on Governmental Affairs 

House Committee on Appropriations 

House Subcommittee on VA, HUD, and Independent Agencies 

House Committee on Government Reform

House Subcommittee on Government Efficiency, Financial Management and 

 Intergovernmental Relations 

House Subcommittee on Technology and Procurement Policy 

House Committee on Science 

House Subcommittee on Space and Aeronautics, Committee on Science 

Congressional Member 

Honorable Pete Sessions, U.S. House of Representatives 

25 
NASA Assistant Inspector General For Auditing 

Reader Survey 

The NASA OIG has a continuing interest in improving the usefulness of our reports. We wish to 

make our reports responsive to our customers’ interests, consistent with our statutory 

responsibility. Could you help us by completing our reader survey? For your convenience, the 

questionnaire can be completed electronically through our homepage at 

www.hq.nasa.gov/office/oig/hq/customer.html or can be mailed to the Assistant Inspector 

General for Auditing; Code W, NASA Headquarters, Washington, DC 20546-0001. 

Report Title: Space Shuttle Safety Upgrades

Report Number: Report Date:

Circle the appropriate rating for the following statements. 

Statement Strongly 

Agree Agree Neutral Disagree 

Strongly 

Disagree N/A 

1. The report was clear, readable, and 

logically organized. 

5 4 3 2 1 N/A

2. The report was concise and to the 

point. 

5 4 3 2 1 N/A

3. We effectively communicated the 

audit objectives, scope, and 

methodology. 

5 4 3 2 1 N/A

4. The report contained sufficient 

information to support the findings in 

a balanced and objective manner. 

5 4 3 2 1 N/A

Overall, how would you rate the report? 

# Excellent # Fair # Very Good # Poor # Good 

If you have any additional comments or wish to elaborate on any of the above 

responses, please write them here. Use additional paper if necessary. 
How did you use the report?

How could we improve our report?

How would you identify yourself? (Select one) 

# Congressional Staff # Media 

# NASA Employee # Public Interest 

# Private Citizen # Other:

# Government: Federal: State: Local:

May we contact you about your comments? 

Yes: ______ No: ______ 

Name: ___________________________ 

Telephone: _______________________ 

Thank you for your cooperation in completing this survey. 
Major Contributors to the Report 

Dennis E. Coldren, Program Director, Space Flight Audits 

Esther A. Judd, Audit Program Manager 

Sandra A. Massey, Audit Program Manager 

Bret J. Skalsky, Auditor-in-Charge 

Loretta M. Garza, Auditor 

Ronald M. Yarbrough, Inspections and Assessments, Safety Engineer 

June C. Glisan, Program Assistant 

Nancy C. Cipolla, Report Process Manager