The first space shuttle launch occurred on April 12, 1981. During the 25th launch on January 28, 1986, the shuttle Challenger was destroyed shortly after liftoff from Kennedy Space Center. Shuttle flights were suspended while the accident was investigated by the Presidential Commission. The shuttle returned to flight on September 29, 1988. Since that time, it has flown successfully about 50 times. The Presidential Commission determined that the 1986 accident was caused by a faulty seal in one of the solid rocket motor joints. The Commission also found other contributing causes to the accident, such as management isolation, communications failures, and lack of a properly staffed, supported, and robust safety organization. According to the Commission’s June 6, 1986, report, the decision to launch the Challenger was based on incomplete and sometimes misleading information, a conflict between engineering data and management judgments, and a the National Aeronautics and Space Administration (NASA) management structure that permitted internal flight safety problems to bypass key shuttle managers. Officials who made the launch decision were unaware of a recent history of problems with the defective solid rocket motor joint and of the motor contractor’s initial recommendation against launching. According to the Commission, if the decisionmakers had known all of the facts, it is highly unlikely that they would have decided to launch. Space flight can never be made risk free because it involves complex hardware and software systems, harsh operating environments, and the possibility of human error. A 1995 study by a NASA contractor, for example, placed the median estimate of a catastrophic shuttle failure at 1 in 145 launches. According to the advisory committee on the Future of the U. S. Space Program, “there can be no acceptable objective among those who would challenge the vastness of space other than perfection.” Unfortunately, as the Committee’s report points out, the objective of perfection is not readily met, especially since space missions are fundamentally difficult and demand undertakings that depend upon some of the world’s most advanced technology and there are many opportunities for error. The shuttle is an extremely complex system. The program employs thousands of people and launching a shuttle requires that 1.2 million separate procedures be accomplished correctly. Also, NASA has identified over 5,000 critical system components whose failure, either singularly or in combination, could cause loss of the vehicle or crew. Because these risks cannot be completely eliminated, they must be identified and properly managed. NASA’s risk management policy requires that program and project management communicate to NASA management and all program/project personnel the significance of assessed risks and the decisions made with respect to them. At NASA, risk management includes identifying the primary risk drivers and estimating the likelihood of occurrence, identifying the ensuing consequences, and determining the cost and schedule impact. NASA policy regarding safety is to avoid loss of life, injury of personnel, damage, and property loss; instill safety awareness in all NASA employees and contractors; assure that an organized and systematic approach is utilized to identify safety hazards and that safety is fully considered from conception to completion of all agency activities; and review and evaluate contractors’ and NASA’s plans, systems, and activities related to establishing and meeting safety requirements to ensure that desired objectives are effectively achieved. Failure modes and effects analyses are conducted for all flight hardware elements and ground support equipment. This analysis starts with the identification of all potential failure modes and evaluation of “worst case” effects. NASA places potential effects of failures into the general categories shown in table 1.1. Hazard analyses are conducted to identify potential safety hazards and means for minimizing the hazards. NASA’s actions to minimize hazards follow the sequence of (1) system designs that minimize potential hazards, (2) use of safety devices if the design does not eliminate a potential safety hazard, (3) use of warning devices to alert the flight or ground crew to potential hazards, and (4) use of special procedures. Approaches for assessing risk can be either quantitative or qualitative, depending on whether statistical probabilities are assigned to a risk element. All risk assessment approaches require experts to make subjective judgments about the risk elements as well as the likelihood of their occurrence. Quantitative approaches, such as probabilistic risk assessments, can be used to assess both the likelihood that an accident will occur (probability) and the level of damage or loss that will result (consequences). Quantitative assessment methods mathematically quantify risk on the basis of engineering judgment, calculated probabilities of component reliability, analysis of potential human failures, and whether they occur singly or in combination. A probabilistic risk assessment, for example, addresses three basic questions: (1) What could go wrong? (2) How likely is it that this will happen? and (3) What are the consequences? Qualitative assessments, on the other hand, assess risk through descriptive information, identifying the nature and components of risk or an ordinal scale, such as high, medium, and low. Qualitative ratings are usually based on the judgments of experts after they consider such things as test and operational experience, analytical results, trends, and other reported data. NASA follows a formal review process in certifying the shuttle for flight. The certification of flight readiness process is a step-by-step activity designed to certify the readiness of all components of the vehicle assembly and all aspects of mission support. The flight preparation process begins with project milestone reviews including (1) element acceptance, (2) payload readiness, (3) software readiness, and (4) project preflight readiness reviews. These reviews are chaired by NASA project managers and the contractors formally certify the flight readiness of the hardware and software. The next step in the process is the program milestone reviews. These reviews are held to assess the readiness for mating the external tank and solid rocket booster, orbiter and external tank, and ferrying the orbiter atop the shuttle carrier aircraft when required. These reviews are chaired by the manager of launch integration and each shuttle element manager certifies that it has satisfactorily completed the manufacture, assembly, test, and checkout of the elements, including the contractor’s certification that design and performance are up to standard. The final step in the flight preparation process is the flight readiness review. This review is held about 2 weeks prior to launch and is chaired by the Associate Administrator for Space Flight. All shuttle elements, safety and mission assurance, center directors, and senior representatives from the major contractors participate in this review. At the end of the flight readiness review, all organizations must certify that the mission is ready for launch. The Associate Administrator for Safety and Mission Assurance is also an active participant. The safety and mission assurance organization holds parallel reviews to assess safety issues related to the planned launch. The safety and mission assurance organization participates in all phases of the flight preparation process. Two days before a scheduled launch, a mission management team holds a review to assess flight readiness. Its agenda includes close out of any open work, close out of any flight readiness review action items, discussion of new or continuing anomalies, and an updated briefing on anticipated weather conditions at the launch site and at abort landing sites in different parts of the world. The mission management team meets every day after the launch –2 day review up to the conclusion of the mission. Figure 1.1 illustrates NASA’s flight preparation process. NASA’s safety organization provides an independent channel for assessing shuttle flight safety. Each center’s safety organization participates in the element acceptance reviews as well as the flight readiness review and the mission management team. Participation in these reviews provides the opportunity for NASA’s safety organization to express any residual concerns about the safety of an upcoming mission. The organization also holds independent prelaunch assessment reviews. In addition, the Associate Administrator for Safety and Mission Assurance attends the flight readiness review and has a direct communications link to the NASA Administrator. Other program briefings and reviews are also a part of the certification of flight readiness process. For example, the program manager holds an early morning telephone conference with the shuttle centers and headquarters each day to discuss the status of progress and problems. Likewise, about midday the working level shuttle managers hold a telephone conference to provide updated information. Safety and mission assurance personnel attend all of the shuttle program and project meetings and contribute their independent views. The former Chairman, Subcommittee on Investigations and Oversight, House Committee on Science, Space, and Technology, asked us to review NASA’s management of risk associated with flying the space shuttle. Specifically, we reviewed the actions NASA has taken to improve the free flow of information in the launch decision process and the progress NASA has made in adopting quantitative methods for assessing risk. To assess the communications environment, we reviewed policies, procedures, and practices related to management of the shuttle program used by the agency in making launch decisions; we observed various shuttle processing reviews, including a shuttle launch; and discussed various aspects of the program with those responsible for its management. We also conducted discussions of these topics with groups of shuttle and safety managers at NASA Headquarters, and the Johnson, Marshall, and Kennedy field centers. Together these individuals represented almost all of the top NASA officials responsible for shuttle launch decisions and management of most shuttle manufacturing and processing work. To understand the flow of risk information within shuttle contractor organizations and between NASA and its shuttle contractors, we also held discussions with groups of program and safety managers and working-level engineers at three of NASA’s prime shuttle contractors. We chose the three contractors because the work is among the more complex and highest risk in the program. Group discussions are very useful for exploring the various facets of communications issues and processes. However, they did not enable us to determine how many participants held a particular view or the intensity of their views. Therefore, to more precisely measure the themes that emerged from the group discussions, we sent a structured questionnaire to the NASA interview participants and some safety representatives who did not participate in the group interviews. Appendixes I through III contain a more detailed discussion of our group interview and survey methodology.