A former top NASA official who led the last comprehensive review of the space shuttle program after a problem-plagued launch of the Columbia in 1999, told the panel investigating the Feb. 1 shuttle breakup that he was disappointed the agency did not act on more of the 120 recommendations his team had made.
Henry McDonald, a professor at the University of Tennessee at Chattanooga and former director of NASA's Ames Research Center in California, said that risk assessments before Columbia's disintegration during reentry, appears to fit into the same pattern of muddled analysis cited in the earlier report.
"It's a replay," he told reporters after the session.
McDonald, testifying during the first public hearing of the investigating board, said NASA has again fallen prey to "systemic" flaws in reasoning -- such as the creeping acceptance of poorly understood risks in operating the space shuttle -- that may require major changes in the agency's culture and technology to correct.
McDonald, a data management specialist, said he was particularly concerned that NASA, despite prodigious efforts and the best of intentions, had failed to upgrade its aged database and computer systems to allow it to track subtle but unacceptable trends, such as the tendency of foam insulation to come loose from the shuttle's giant external fuel tank during launch. The impact of tank debris on the orbiter's heat shielding, possibly made more lethal by embedded ice, is suspected as a cause of the Columbia disaster, which killed seven astronauts.
Citing the history of failing foam insulation, McDonald said, "When someone like [shuttle project manager] Ron Dittemore goes and tries to make an assessment of what his risk is, the instant access to all that past history would have been invaluable, but they had not in my view given that sufficiently high priority."
Retired Navy Adm. Harold W. Gehman Jr., who is chairman of the board, told McDonald his report was "eerily prescient."
Joe Rothenberg, NASA's top human space flight official at the time the report was issued, said in a phone interview yesterday that, to the best of his recollection, "We took action on all of them in some form. . . . Some of the things [McDonald] would have liked were almost impossible."
He recalled that when the agency attempted to upgrade and integrate the complex risk assessment database, engineers encountered a "translation problem," because the technical terminology of one shuttle division was alien to the next. "The propulsion people talk in one set of terms" and flight operations in another, Rothenberg said.
That recommendation "did galvanize the agency into significant effort in that regard," McDonald agreed, "but as to implementing these procedures, no."
McDonald was also critical of what he called the shuttle program's fuzzy definitions of risk, embodied in such phrases as "in family, out of family," whose meaning might vary from one worker to another. "Fair wear and tear was a subjective judgment," he added.
McDonald's review panel also found that NASA employees were getting conflicting signals about safety, McDonald said. Based on one-on-one interviews, members of the shuttle workforce were "clearly, deeply concerned both about the turmoil in the agency" as it strove for greater efficiency, and the possibility that, under an initiative then underway to contract out more work, they might have to shift to the private sector. "There most certainly was this mixed message" that safety was very important, but at the same time the agency was cutting back on safety inspections that had previously been mandatory.
Shuttle program manager Dittemore testified earlier in the day that some cutbacks in inspections were proper and did not affect safety.
"But from [the employees'] perspective, I don't think we did a good job of convincing them these were necessary," McDonald said later.
The March 2000 report by McDonald's Space Shuttle Independent Assessment Team was triggered by problems that occurred on a 1999 shuttle flight, resulting in part from a decision by managers to eliminate a preflight test that had previously been required. Engineers failed to detect problems with a pin in a main engine part that came loose during the mission and punctured two cooling tubes. Backup systems kicked in and the shuttle made it to orbit and returned safely, but the incident alerted NASA to a potential wiring problem in the entire shuttle fleet, which was temporarily grounded. Then-NASA administrator Daniel S. Goldin commissioned the independent review and directed McDonald to "leave no stone unturned."
"It was creeping risk," Rothenberg agreed. "It bothered me, too. The issue was not the fact of this problem [the loose pin]. It was, gee, we added risk on risk."
McDonald said his team discovered that the shuttle program's database did not properly record the history of problems with the pins. "Indeed, the real probability of a pin ejection was 1 in 10. I don't think anybody realized that that was the probability," he said.
McDonald said the shuttle team has been lulled by repeated successes. "I think there's a flaw in the reasoning of many well-intentioned people" in forgetting that "if you've a 1 in 100 chance of risk of an event occurring, the event can occur on the first or the last [opportunity], and there's an equal probability each time."
He said the perception within the agency seemed to be "that if I've flown 20 times, the risk is less than if I've just flown once. And we were continually attempting to inform them that unless they've changed the risk positively, they still have the same issue even after 50 flights or 60 flights."
"The availability of more information to people like Dittemore would result in a change in the culture, automatically," McDonald said after the session.
Another witness at the hearing, held on the campus of the University of Houston at Clear Lake, was Boeing engineer Keith Chong, an expert on foam insulation. Previously a member of a shuttle external tank review team, and now in Boeing's Delta 4 rocket program, he told the board he would recommend that NASA adopt a nondestructive test method that has worked well in the Delta program. It uses a laser to determine if the foam insulation has properly bonded to the tank.
Chong also said the foam insulation on the outside of the tank, though 90 percent waterproof because of its closed-cell composition, might after long exposure on the launch pad soak up patches of moisture in places where the foam has been "shaved." He agreed with Gehman's suggestion that, when the tank is filled with super-cooled propellants, the moisture might form ice.