IN JULY 1985, shortly after starting my job as a budget analyst at NASA, I wrote a memo summarizing my concerns about the safety of the solid rocket booster used in the space shuttle.
I summarized in the memo the seriousness of the problems that engineers told me they had found with the booster's O-ring seals. I stated: "There is little question . . . that flight safety has been and is still being compromised by potential failure of the seals, and it is acknowledged that failure during flight would certainly be catastrophic."
I wrote my 1985 memo after investigating the possible budgetary impact of the O-ring problem. The memo has been rehashed many times since the Challenger tragedy -- in commission hearings, in newspaper stories, and on television. But the memo was only as prescient as the analysis of the engineers I consulted who warned that this was a potentially deadly problem. I recall the remark of a senior engineer in mid-1985 that the O-ring situation was so serious that he held his breath each time the shuttle went up.
The question that haunts us now, after the Challenger disaster, is how these clear warnings of danger were discoiunted by the NASA bureaucracy. We can see similar analytical failures in other organizations -- from the U.S. military's failure in 1941 to comprehend its own intelligence information about the Japanese attack on Pearl Harbor to the seeming difficulty that our airlines have in correcting small problems before they become big ones. The intriguing issue for me is how the particular bureaucratic culture at NASA contributed to the Challenger tragedy.
I believe a large part of the problem is NASA's powerful self-image, which makes it difficult for management and staff alike to acknowledge that the agency could have significant problems or make fundamental mistakes.
I spent only seven months at NASA, but it was long enough to get a sense of a bureaucratic culture in the space agency that caused the upper echelons to be unable to accept the serious nature of the problems encountered by mid-level managers, or in some cases not even to be fully-informed about them.
Less than a week after the Challenger crash I tried to highlight the role of NASA's organizational structure in a Feb. 3 report to the NASA comptroller's office. I stated that "the Marshall Space Flight Center has not been adequately responsive to headquarters' concerns about flight safety . . . the Office of Space Flight has not given enough time and attention to the assessment of problems with solid rocket booster safety raised by senior engineers in the propulsion division, and . . . these engineers have been improperly excluded from investigation of the Challenger disaster."
One purpose of including these organizational factors in my report was to show not only that repairs to the solid rocket booster joint system were required, but that the organizational milieu in which the O-ring problem had been overlooked had to be corrected to keep similar problems with high budgetary impact from surprising the agency in the future.
When James M. Beggs became NASA administrator in 1981, he promised the NASA field centers, including the Kennedy, Johnson, and Marshall Space Flight Centers that directed and supported aspects of the space shuttle program, that they would not be "micromanaged" from headquarters. As a result, each center operated as a quasi-independent fiefdom with little central guidance or control.
While at NASA, I viewed this lack of central authority as a grievous fault that no moderately well-run corporation would tolerate. I attended many meetings involving staff from the field centers, especially Marshall. In these meetings, headquarters lacked the capacity, the authority, and a clear set of guidelines to deal with the centers effectively. Officials from Marshall Space Flight Center in particular tended to be defensive and vague under questioning and brushed aside concerns raised by headquarters engineers and analysts on matters affecting both safety and budget.
The solid rocket booster office also downplayed safety concerns raised by engineers from Marshall's own science and engineering lab. This happened, for instance, at a meeting I attended on filament-wound case safety, a lightweight substitute for steel booster segments to be used on Defense Department missions. I was also told that the escalating O-ring problem was first brought to headquarter's attention in 1984 by science and engineering personnel at Marshall after the booster program office did not take seriously enough the concerns that existed at that time.
Many of the meetings with Marshall at headquarters were rushed affairs attended by 20 or 30 people, so that complex technological or resource issues could rarely be discussed in depth.
Moreover, although NASA has many capable and conscientious employees, its promotion system tends to turn people into "yes men."
While I was at NASA headquarters, there was a decided tendency to report only good news, to paint only a rosy picture. Signs taped to the walls in the Office of Space Flight read, "Look Sharp. Think and Talk Positive." Top shuttle management liked to hear positive talk, optimistic views. That's certainly all I ever saw the Marshall solid rocket booster office give them.
So the filament-wound case ruptured in a major safety test -- no problem. So the budget didn't support the planned flight rate -- no problem. By accident one might learn that a case segment ruptured in testing because a crack in a bolt hole was missed during visual inspection, a rupture that might have been catastrophic in flight -- well, no problem.
At the Feb. 27 hearing of the Presidential commission, Marshall and headquarters top managers gave the impression that they never saw the O-rings as a flight safety issue or as a serious concern. From my own experience I can say that at both locations people understood completely the implications of a possible O-ring failure. It's just that it was viewed as "no problem."
But those at Marshall and headquarters who discounted engineering concerns and decided in 1985 that shuttle flights would continue in the face of the known solid rocket booster problems were drastically, tragically wrong. In their testimony and comments to the press, some seemed almost proud that they could claim not to have been overly concerned or not to have been informed. But in their justifications for not taking action, they overlooked that the shuttle did blow up, and from problems that were known and not corrected. Yet from the testimony, people actually seemed to believe they were excused by saying they didn't see the problem as all that serious.
This apparent blindness might seem even more astonishing except that it may relate to the fact that NASA's strong self-image works against any impulse by its personnel to admit to major problems or mistakes.
Unfortunately at NASA, the agency's achievements have been elevated by many to a plane approaching idolatry, evidenced by countless posters and photographs of the space shuttle and other pieces of machinery that adorn the walls of hallways and offices. With many employees, this overwhelming presence of the agency's image -- sometimes mistaken for "morale" -- is such that the impact of the Challenger disaster scarcely penetrated. To me the explosion was a tragedy of unfathomable proportions from the hour it happened. But it was quite natural for many of NASA's staff to believe that once the problem was solved and the screw tightened to fix it, the shuttle would be back in the air again, with teachers and politicians and who-knows-what-else on-board. Some dreamers were even predicting a June launch, an estimate I could not then believe and which has since proved wrong.
The surface nonchalance I observed at headquarters soon after the explosion was also reflected in numerous remarks inside and outside NASA that "sooner or later" a disaster was bound to happen.
This attitude was not simply a superstition or premonition, though clearly the odds were against the indefinite continuation of NASA's unbroken string of 55 more or less successful manned United States space flights, including 24 space shuttle missions without an in-flight fatality.
This grim judgment also reflected the general knowledge that all ventures into space in machinery at the cutting edge of technology are inherently dangerous, and that in a program such as the space shuttle, where funds had been limited by 15 years of budgetary realities, corners had to be cut that would become more evident the more frequently the vehicle flew.
But another factor gave urgency to the chronic anxiety of many knowledgeable professionals -- anxiety totally at odds with the space agency's official "no problem" approach. This factor was the awareness of specific deficiencies in major hardware components, including the solid rocket booster seals, the main engine turbopumps, and fuel line flapper valves between the external tank and the orbiter, which was referred to by chief astronaut John Young in the memo that was made public last week.
I detected an element of fatalism among many NASA officials, that manned space flight had become an ominous force by which someone would inevitably be crushed, rather than the exciting but dangerous adventure requiring every possible safeguard against failure that we saw in the 1960s. In my opinion, this fatalistic attitude reflected an unspoken awareness and acceptance that every safeguard was not taken, that NASA was trying to do too much too fast, and that the agency was riding a wave of luck that could not last.
As I gathered data from my Feb. 3 report on required improvements in the solid rocket booster program, I did so as the Office of Space Flight was beginning its own assessment of the cost of booster seal repairs. This work was going on as early as Friday, Jan. 31, the day NASA's top brass, along with President Reagan, attended the memorial service for the dead astronauts at Johnson Space Flight Center in Houston.
Yes, on that day, only 72 hours after the explosion, before any videotapes were released showing the "plume" on the right solid rocket booster, before acting Administrator Graham went on national television on Sunday, Feb. 2, and stated that not during the previous 24 shuttle flights had anything occurred that might account for the appearance of such a plume, NASA was starting its in-house analysis of how much it would cost to fix the O-rings.
During this period, there were many hushed conversations as more information came in to support the solid rocket booster failure hypothesis. There was concern about who might be blamed. One person asked me in a strident voice if I had shown anyone at the comptroller's office a particular document he had shared with me showing that the O-ring problem had been analyzed in detail the previous summer. He said he shouldn't have given it to me and told me not to show it to anyone further.
Another told me to step away from his doorway while he searched for another document in his filing cabinet, so no one would see me in his office and later suspect that he'd been the one I'd gotten it from. He called it the "death document," meaning that if its contents became known, it would prove beyond doubt that NASA had been aware of the potentially disastrous problem with the seals for over three years. Another told me of his fears that if the truth about the O-rings came out, it would be the little guys who were "fried." And all this was while I was gathering data for an internal NASA report.
I could understand how these people felt -- all good, decent employes with families to support and decades of professional experience. For after I filed my own report, a senior budget analyst in the comptoller's office questioned the validity of my now obvious statements. I told him that if need be, I would make and support such statements under oath, not realizing that in only eight days I would be required to do just that. He said the memo was "explosive" and I gave him the copies I had made for two other top comptroller office executives.
Soon afterwards I watched Judson Lovingood of the Marshall Space Flight Center on NASA Select television testify before the Presidential Commission that the problems with O-ring erosion had been "thoroughly worked."
Then, after The New York Times reported on the leaked documents and an intense search inside NASA had commenced to identify the source of the leak, a NASA superior told me what to say to press inquiries about what I had written the previous July. I was told to say that after I filed my report, the problem was discussed in the comptroller's office, inquiries were made to the program office, and work was underway that satisfied us that the safety issue was being dealt with.
Thus it was that following the Times report, I felt I was under official orders to deny publicly the validity of my earlier July 23 memorandum, a denial which of course I could not and did not make.
I was also struck at NASA by the careerism that I now consider a major contributing factor to the Challenger disaster. The most honest man I know there is an engineer who had been passed over for promotion because he spoke his mind, but who knew more than anyone else why the solid rocket booster could fail and what would happen if it did -- i.e., exactly what did happen.
NASA -- in its overconfidence, the secretiveness which prevailed behind the public relations facade, its frequent arrogance -- has undoubtedly become corrupt, not in any venal sense, but as all bureaucracies become more or less corrupt as they become satisfied with their achievements. This condition went largely undetected by a press corps that had been won over by the agency's relentless image-making apparatus. The stresses and strains that would break the system were visible, though in management meetings never penetrated by the press. There, as in any organization, a constant tension existed between individual conscience and the need of the organization to perpetuate its programs and glorify itself.
What appears to happen to an organization when this psychological corruption seeps in is a kind of hardening. A chasm develops between what sociologists call the "formal" and "informal" organizations. The informal organization at NASA and Thiokol, which is now threatened with the backlash of repression, knew the O-rings might fail under certain conditionsand could blow up the shuttle. The formal organization tuned that assessment out, even to the point of having no contingency plan for meeting spaceflight commitments should an accident occur.
It is my conviction that had NASA's management been more attuned to the human risks it was taking and less to the political winds that were blowing, they might have heeded the quiet voices -- sometimes even not so quiet -- of a small number of individuals, whether staff engineers or analysts at Marshall or at headquarters, or Thiokol engineers who feared the booster seals were unreliable in cold weather, and that Challenger and its astronauts might still be with us today.
The lesson for management is clear: When trained, dedicated, rational, experienced people speak up, it is time to listen.