[House Hearing, 108 Congress]
[From the U.S. Government Publishing Office]
NASA'S ORGANIZATIONAL AND
MANAGEMENT CHALLENGES IN THE
WAKE OF THE COLUMBIA DISASTER
=======================================================================
HEARING
BEFORE THE
COMMITTEE ON SCIENCE
HOUSE OF REPRESENTATIVES
ONE HUNDRED EIGHTH CONGRESS
FIRST SESSION
__________
OCTOBER 29, 2003
__________
Serial No. 108-30
__________
Printed for the use of the Committee on Science
Available via the World Wide Web: http://www.house.gov/science
90-160 U.S. GOVERNMENT PRINTING OFFICE
WASHINGTON : 2003
____________________________________________________________________________
For Sale by the Superintendent of Documents, U.S. Government Printing Office
Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; (202) 512�091800
Fax: (202) 512�092250 Mail: Stop SSOP, Washington, DC 20402�090001
______
COMMITTEE ON SCIENCE
HON. SHERWOOD L. BOEHLERT, New York, Chairman
LAMAR S. SMITH, Texas RALPH M. HALL, Texas
CURT WELDON, Pennsylvania BART GORDON, Tennessee
DANA ROHRABACHER, California JERRY F. COSTELLO, Illinois
JOE BARTON, Texas EDDIE BERNICE JOHNSON, Texas
KEN CALVERT, California LYNN C. WOOLSEY, California
NICK SMITH, Michigan NICK LAMPSON, Texas
ROSCOE G. BARTLETT, Maryland JOHN B. LARSON, Connecticut
VERNON J. EHLERS, Michigan MARK UDALL, Colorado
GIL GUTKNECHT, Minnesota DAVID WU, Oregon
GEORGE R. NETHERCUTT, JR., MICHAEL M. HONDA, California
Washington CHRIS BELL, Texas
FRANK D. LUCAS, Oklahoma BRAD MILLER, North Carolina
JUDY BIGGERT, Illinois LINCOLN DAVIS, Tennessee
WAYNE T. GILCHREST, Maryland SHEILA JACKSON LEE, Texas
W. TODD AKIN, Missouri ZOE LOFGREN, California
TIMOTHY V. JOHNSON, Illinois BRAD SHERMAN, California
MELISSA A. HART, Pennsylvania BRIAN BAIRD, Washington
JOHN SULLIVAN, Oklahoma DENNIS MOORE, Kansas
J. RANDY FORBES, Virginia ANTHONY D. WEINER, New York
PHIL GINGREY, Georgia JIM MATHESON, Utah
ROB BISHOP, Utah DENNIS A. CARDOZA, California
MICHAEL C. BURGESS, Texas VACANCY
JO BONNER, Alabama
TOM FEENEY, Florida
RANDY NEUGEBAUER, Texas
C O N T E N T S
October 29, 2003
Page
Witness List..................................................... 2
Hearing Charter.................................................. 3
Opening Statements
Statement by Representative Sherwood L. Boehlert, Chairman,
Committee on Science, U.S. House of Representatives............ 10
Written Statement............................................ 11
Statement by Representative Ralph M. Hall, Minority Ranking
Member, Committee on Science, U.S. House of Representatives.... 11
Written Statement............................................ 13
Statement by Representative Bart Gordon, Member, Committee on
Science, U.S. House of Representatives......................... 14
Prepared Statement by Representative Dana Rohrabacher, Chairman,
Subcommittee on Space and Aeronautics, Committee on Science,
U.S. House of Representatives.................................. 15
Prepared Statement by Representative Jerry F. Costello, Member,
Committee on Science, U.S. House of Representatives............ 15
Prepared Statement by Representative Eddie Bernice Johnson,
Member, Committee on Science, U.S. House of Representatives.... 15
Prepared Statement by Representative Sheila Jackson Lee, Member,
Committee on Science, U.S. House of Representatives............ 16
Panel I
Admiral F.L. ``Skip'' Bowman, Director, Naval Nuclear Propulsion
Program, U.S. Navy
Oral Statement............................................... 17
Written Statement............................................ 19
Biography.................................................... 24
Rear Admiral Paul E. Sullivan, Deputy Commander, Ship Design,
Integration and Engineering, Naval Sea Systems Command, U.S.
Navy
Oral Statement............................................... 24
Written Statement............................................ 26
Biography.................................................... 33
Mr. Ray F. Johnson, Vice President, Space Launch Operations, The
Aerospace Corporation
Oral Statement............................................... 33
Written Statement............................................ 35
Biography.................................................... 40
Ms. Deborah L. Grubbe, P.E., Corporate Director, Safety and
Health, DuPont
Oral Statement............................................... 40
Written Statement............................................ 42
Biography.................................................... 43
Discussion, Panel I
ITEA Budget Independence....................................... 44
Waivers........................................................ 45
Managing Safety................................................ 46
SUBSAFE........................................................ 48
Crew Escape.................................................... 48
Handling Anomolies............................................. 49
Safety Accountability.......................................... 50
Decision-making in the Naval Reactors Program.................. 52
Culture and Attitude........................................... 52
SUBSAFE's Use of the Challenger Case Study..................... 53
NASA/Navy Benchmarking......................................... 54
CAIB Recommendations........................................... 55
Communicating Risk............................................. 55
Turnover in the Safety Workforce............................... 56
Nanotechnology................................................. 57
NASA/Navy Benchmark............................................ 58
Manned vs. Unmanned Space Flight............................... 58
Safety Organization............................................ 59
Panel II
Admiral Harold Gehman (ret.), Chairman, Columbia Accident
Investigation Board
Oral Statement............................................... 61
Written Statement............................................ 62
Discussion, Panel II
ISS Safety and CAIB Recommendations............................ 63
Safety Program Independence.................................... 64
ISS Safety..................................................... 65
Leadership Confidence.......................................... 66
ISS Safety..................................................... 67
Vision......................................................... 67
Expedition 8 Launch Decision-making Process.................... 68
ITEA and Safety Staff Turnover................................. 69
ISS Review..................................................... 70
Appendix 1: Answers to Post-Hearing Questions
.................................................................
Admiral F.L. ``Skip'' Bowman, Director, Naval Nuclear Propulsion
Program, U.S. Navy 74
Rear Admiral Paul E. Sullivan, Deputy Commander, Ship Design,
Integration and Engineering, Naval Sea Systems Command, U.S.
Navy 82
Mr. Ray F. Johnson, Vice President, Space Launch Operations, The
Aerospace Corporation.......................................... 88
Ms. Deborah L. Grubbe, P.E., Corporate Director, Safety and
Health, DuPont................................................. 92
Appendix 2: Additional Material for the Record
Statement of Admiral H.G. Rickover before the Subcommittee on
Energy Research and Production, Committee on Science and
Technology, U.S. House of Representatives, May 24, 1979........ 96
Report NT-03-1, Environmental Monitoring and Disposal of
Radioactive Wastes From U.S. Naval Nuclear-Powered Ships and
Their Support Facilities, March 2003, Naval Nuclear Propulsion
Program........................................................ 208
Report NT-03-2, Occupational Radiation Exposure From U.S. Naval
Nuclear Plants and Their Support Facilities, March 2003, Naval
Nuclear Propulsion Program..................................... 269
Report NT-03-03, Occupational Radiation Exposure From Naval
Reactors' Department of Energy Facilities, March 2003, Naval
Nuclear Propulsion Program..................................... 322
Report NT-03-4, Occupational Safety, Health, and Occupational
Medicine Report, March 2003, Naval Nuclear Propulsion Program.. 373
NASA'S ORGANIZATIONAL AND MANAGEMENT CHALLENGES IN THE WAKE OF THE
COLUMBIA DISASTER
----------
WEDNESDAY, OCTOBER 29, 2003
House of Representatives,
Committee on Science,
Washington, DC.
The Committee met, pursuant to call, at 10:10 a.m., in Room
2318 of the Rayburn House Office Building, Hon. Sherwood L.
Boehlert [Chairman of the Committee] presiding.
hearing charter
COMMITTEE ON SCIENCE
U.S. HOUSE OF REPRESENTATIVES
NASA's Organizational and
Management Challenges in the
Wake of the Columbia Disaster
wednesday, october 29, 2003
10:00 a.m.-12:00 p.m.
2318 rayburn house office building
1. Purpose
On Wednesday, October 29, 2003 at 10:00 a.m., the House Committee
on Science will hold a hearing to address the organizational and
management issues confronting the National Aeronautics and Space
Administration (NASA) in the aftermath of the Space Shuttle Columbia
accident. According to the Columbia Accident Investigation Board
(CAIB), NASA's ``organizational culture and structure'' had as much to
do with the Columbia's demise as the physical causes of the accident.
During the course of its nearly seven months of investigation into the
causes of the accident, the CAIB encountered an ineffective and
disengaged safety organization within NASA that ``failed to adequately
assess anomalies and frequently accepted critical risks without
qualitative or quantitative support.'' Based on its findings, the CAIB
recommended significant changes to the organizational structure of the
Space Shuttle Program (detailed below).
To give a sense of some of the ways NASA could be restructured to
comply with its recommendations, the CAIB report provided three
examples of organizations with independent safety programs that
successfully operate high-risk technologies. The examples were: the
United States Navy's Submarine Flooding Prevention and Recovery
(SUBSAFE) and Naval Nuclear Propulsion (Naval Reactors) programs and
the Aerospace Corporation's independent launch verification process and
mission assurance program for the U.S. Air Force.
This hearing will provide an opportunity to examine each of these
examples in depth, as well as the safety programs of the Dupont
Corporation (an acknowledged industry leader in safety), to help
determine how NASA should be reorganized.
2. Critical Questions
The CAIB determined that reorganizing NASA is a critical
requirement if the Shuttle is to fly safely over the long term. To
provide adequate oversight of NASA's reorganization plans, the
Committee needs to understand how different organization structures can
contribute to safety. To that end, the following questions were
submitted in advance to each of the witnesses:
a. What does it mean for a safety program to be
``independent''? How can safety organizations be structured to
ensure their independence?
b. How can safety programs be organized to ensure that they
are robust and effective, but do not prevent the larger
organization from carrying out its duties?
c. How do you ensure that the existence of an independent
safety program does not allow the larger organization to
absolve itself of responsibility for safety?
d. How do you ensure that dissenting opinions are offered
without creating a safety review process that can never reach
closure?
3. Background
Recommendations of the CAIB and previous reports
Since the loss of the Space Shuttle Challenger in 1986, numerous
outside experts have reviewed NASA's human space flight safety programs
and found them lacking. For instance, in the immediate aftermath of the
Challenger accident, the Rogers Commission issued recommendations
calling for the creation of an independent safety oversight function.
Despite NASA's compliance efforts, the U.S. General Accounting Office
concluded in 1990 that NASA still ``did not have an independent and
effective safety organization.'' Nine years later, the Shuttle
Independent Assessment Team and NASA Integrated Action Team likewise
issued findings that were critical of NASA's safety programs and echoed
the Roger Commission's call for the creation of an independent safety
oversight function. Finally, in 2002, the Space Shuttle Competitive
Task Force reiterated the call for an independent safety assurance
function at NASA with ``authority to shut down the flight preparation
processes or intervene post-launch when an anomaly occurs.''
In August of 2003, the CAIB released Volume I of its report on the
Columbia accident. Consistent with previous analyses of NASA's safety
programs, the CAIB Report discovered fundamental, structural
deficiencies in NASA's safety programs. For example, the report states,
``the Shuttle Program's complex structure erected barriers to effective
communication and its safety culture no longer asks enough hard
questions about risk.. . .[T]he mistakes that were made on [the
Columbia mission] are not isolated failures, but are indicative of
systemic flaws that existed prior to the accident.. . .[A successful
safety process] demands a more independent status than NASA has ever
been willing to give its safety organizations, despite the
recommendations of numerous outside experts over nearly two
decades[.]''
According to the CAIB Report, NASA's current approach to safety and
mission assurance ``calls for centralized policy and oversight at
Headquarters and decentralized execution of safety programs at the
enterprise, program, and project levels.'' Under the existing
organizational rubric, ``safety is the responsibility of program and
project managers'' who are given flexibility ``to organize safety
efforts as they see fit.''
To remedy the current organization deficiencies, the primary CAIB
recommendation on organization calls on NASA to ``establish an
independent Technical Engineering Authority'' that would be
``responsible for technical requirements and all waivers to them'' and
that would be ``funded directly from NASA Headquarters, and should have
no connection to or responsibility for schedule or program cost.'' The
CAIB's fundamental goal is to separate the responsibility for safety
from the Shuttle program's responsibility for cost and schedule. The
current NASA structure, in which the Shuttle program itself is
ultimately responsible for cost, schedule and safety inevitably leads
to ``blind spots''--serious safety problems that are not properly
analyzed or addressed, the CAIB concluded. The CAIB did not specify
precisely how NASA should be reorganized to implement its
recommendations, leaving that up to the agency.
While the CAIB report does not label the implementation of a new
organizational structure as a ``return to flight'' requirement, the
report does say that NASA must ``prepare a detailed plan for defining,
establishing, transitioning and implementing an independent Technical
Engineering Authority, independent safety program, and a reorganized
Space Shuttle Integration Office'' prior to returning to flight.
NASA is in the process of preparing such a plan. Administrator Sean
O'Keefe has tasked the Associate Administrator for Safety and Mission
Assurance, Bryan O'Connor, with coming up with a proposed
reorganization plan. O'Connor has circulated a ``white paper''
outlining his ideas for reorganization among NASA staff. Before being
implemented, any reorganization plan will be reviewed both by the
Stafford-Covey Task Force (the task force of outside experts set up by
O'Keefe to evaluate return-to-flight activities, which is headed by
former astronauts Tom Stafford and Richard Covey) and by the Space
Flight Leadership Council, which comprises top NASA officials. NASA is
also in the process of setting up a new NASA Engineering and Safety
Center (NESC), which would be able to ``independently'' review aspects
of programs. It is not clear how the NESC would relate to a new
Independent Technical Engineering Authority, but Admiral Harold Gehman,
the chairman of the CAIB, has testified that the NESC does not, by
itself, fulfill the CAIB's recommendations related to organization.
Model safety organizations
The CAIB Report cites three examples of organizations with
successful safety programs and practices that could be models for NASA:
the United States Navy's Naval Reactors and SUBSAFE programs and the
Aerospace Corporation's independent launch verification process and
mission assurance program for the U.S. Air Force.
The Naval Reactors program is a joint Navy/Department of Energy
organization responsible for all aspects of Navy nuclear propulsion,
including research, design, testing, training, operation, and
maintenance of nuclear propulsion plants on-board Navy ships and
submarines. The Naval Reactors program is structurally independent of
the operational program that it serves. Although the naval fleet is
ultimately responsible for day-to-day operations and maintenance, those
operations occur within parameters independently established by the
Naval Reactors program. In addition to its independence, the Naval
Reactors program has certain features that might be emulated by NASA,
including an insistence on airing minority opinions and planning for
worst case scenarios, a requirement that contractor technical
requirements are documented in peer reviewed formal written
correspondence, and a dedication to relentless training and retraining
of its engineering and safety personnel.
SUBSAFE is a program that was initiated by the Navy to identify
critical changes in submarine certification requirements and to verify
the readiness and safety of submarines. The SUBSAFE program was
initiated in the wake of the USS Thresher nuclear submarine accident in
1963. Until SUBSAFE independently verifies that a submarine has
complied with SUBSAFE design and process requirements, its operating
depth and maneuvers are limited. The SUBSAFE requirements are clearly
documented and achievable, and rarely waived. Program mangers are not
permitted to ``tailor'' requirements without approval from SUBSAFE.
Like the Naval Reactors program, the SUBSAFE program is structurally
independent from the operational program that it serves. Likewise,
SUBSAFE stresses training and retraining of its personnel based on
``lessons learned,'' and appears to be relatively immune from budget
pressures.
The Aerospace Corporation operates as a Federally Funded Research
and Development Center that independently verifies safety and readiness
for space launches by the United States Air Force. As a separate entity
altogether from the Air Force, Aerospace conducts system design and
integration, verifies launch readiness, and provides technical
oversight of contractors. Aerospace is indisputably independent and is
not subject to schedule or cost pressures.
According to the CAIB, the Navy and Air Force programs have
``invested in redundant technical authorities and processes to become
reliable.'' Specifically, each of the programs allows technical and
safety engineering organizations (rather than the operational
organizations that actually deploy the ships, submarines and planes) to
``own'' the process of determining, maintaining, and waiving technical
requirements. Moreover, each of the programs is independent enough to
avoid being influenced by cost, schedule, or mission-accomplishment
goals. Finally, each of the programs provides its safety and technical
engineering organizations with a powerful voice in the overall
organization. According to the CAIB, the Navy and Aerospace programs
``yield valuable lessons for [NASA] to consider when redesigning its
organization to increase safety.''
4. Witnesses
First Panel
a. Admiral Frank L. ``Skip'' Bowman, United States Navy (USN),
is the Director of the Naval Nuclear Propulsion (Naval
Reactors) Program. In this capacity, Admiral Bowman is
responsible for the program that oversees the design,
development, procurement, operation, and maintenance of all the
nuclear propulsion plants powering the Navy's fleet of nuclear
warships. Admiral Bowman is a graduate of Duke University and
the Massachusetts Institute of Technology.
b. Rear Admiral Paul Sullivan, USN, is the Deputy Commander
for Ship Design Integration and Engineering for the Naval Sea
Systems Command, which is the authority for the technical
requirements of the SUBSAFE program. Admiral Sullivan is a
graduate of the U.S. Naval Academy and the Massachusetts
Institute of Technology.
c. Mr. Ray F. Johnson is the Vice President for Space Launch
Operations for the Aerospace Corporation, located in El
Segundo, California. Mr. Johnson is responsible for Aerospace's
support for all Air Force space launch programs, including
Aerospace's certification reviews prior to launch. Mr. Johnson
holds a B.S. degree in mechanical engineering from the
University of California at Berkeley and an MBA from the
University of Chicago.
d. Ms. Deborah L. Grubbe is the Corporate Director for Safety
and Health at Dupont. In this capacity, Ms. Grubbe is tasked
with leading new initiatives in global safety and occupational
health for Dupont. Ms. Grubbe and is a past director of DuPont
Nonwovens, where she was accountable for manufacturing,
engineering, and safety. Ms. Grubbe holds a B.S. degree in
chemical engineering from Purdue University and a Certificate
of Post-Graduate Study in chemical engineering from Cambridge
University.
Second Panel
Admiral Harold Gehman, Jr., USN (retired), chaired the Columbia
Accident Investigation Board.
5. Attachment
Excerpt from the Columbia Accident Investigation Board Report,
Volume I (August 2003), Chapter 7, Section 7.3 (pp. 182-184).
Attachment
Chairman Boehlert. We might as well start. We thank you for
being punctual, and I tried very hard to be punctual, too.
I want to welcome everyone to today's hearing, which
concerns one of the most critical recommendations of the
Columbia Accident Investigation Board. The CAIB was clear and
on-target in citing organizational deficiencies as a leading
cause of the Columbia accident. It was also clear and on-target
in calling for the establishment of a new Independent Technical
Engineering Authority and of a truly independent safety
organization. And in both instances, I stress the word
``independent''.
In both its conclusions and its recommendations on
organization, the Columbia Accident Investigation Board was,
unfortunately, able to follow a well-worn path. The Rogers
Commission and the Shuttle Independent Assessment Team, among
others, had made similar recommendations. They all apparently
fell on deaf ears. This must not be allowed to happen again.
NASA Administrator Sean O'Keefe is to be applauded for
deciding that the reorganization of NASA should occur before
return to flight, setting a more ambitious schedule than that
called for by the CAIB. He should also be congratulated for
recognizing NASA's organizational deficiencies before the
Columbia accident, which led him to initiate the so-called
``benchmarking studies'' comparing NASA with the Navy,
something with which he is most familiar.
But, of course, undertaking the right studies and setting
the right schedule is not enough. NASA must actually come up
with the right reorganization plan and make sure that it is
taken to heart.
The CAIB did not dictate exactly how NASA should carry out
its recommendations, so NASA is now in the process of drawing
up its plans, and this committee will have to review those
plans with a fine-tooth comb.
The purpose of today's hearing is to help give us the
background to do just that. We will hear from organizations
that the CAIB cited as possible models for NASA to follow and
from an industrial leader in safety. Obviously, there are
differences among these models, and any one of them would have
to be adapted to apply to NASA, but they all highlight
characteristics of high-reliability organizations that NASA has
been lacking. We will learn from Admiral Gehman precisely why
and how the Navy and Air Force safety programs can be seen as
models for NASA.
I have no doubt that this committee will have ample
opportunity over the next year or so to put to use the
information we gather today. As I noted earlier, NASA is just
in the initial stages of putting together and organizational
plan, and I have complete confidence that Administrator O'Keefe
has taken the CAIB recommendations to heart.
But that said, I must note that I believe the initial
organization ideas being circulated by NASA fall significantly
short of the mark. We look forward to working with NASA as it
continues to rework its plans.
Today's hearing, though, is not on any specific proposal.
Rather, our goal today is to learn what has worked elsewhere
and why and to start thinking how the experience of others
could be put to work to help NASA.
This is one of the most important tasks facing this
committee, and I am eager to hear from our witnesses today. And
I want to thank you all for being resources.
[The prepared statement of Mr. Boehlert follows:]
Prepared Statement of Chairman Sherwood Boehlert
I want to welcome everyone to today's hearing, which concerns one
of the most critical recommendations of the Columbia Accident
Investigation Board (CAIB).
The CAIB was clear and on-target in citing organizational
deficiencies as a leading cause of the Columbia accident. It was also
clear and on-target in calling for the establishment of a new
Independent Technical Engineering Authority and of a truly independent
safety organization.
In both its conclusions and its recommendations on organization,
the CAIB was, unfortunately, able to follow a well-worn path. The
Rogers Commission and the Shuttle Independent Assessment Team, among
others, had made similar recommendations. They all apparently fell on
deaf ears. That must not be allowed to happen again.
NASA Administrator Sean O'Keefe is to be applauded for deciding
that the re-organization of NASA should occur before return-to-flight,
setting a more ambitious schedule than that called for by the CAIB. He
should also be congratulated for recognizing NASA's organizational
deficiencies before the Columbia accident, which led him to initiate
the so-called ``bench-marking studies'' comparing NASA with the Navy.
But, of course, undertaking the right studies and setting the right
schedule is not enough. NASA must actually come up with the right
reorganization plan and make sure that it is taken to heart.
The CAIB did not dictate exactly how NASA should carry out its
recommendations, so NASA is now in the process of drawing up its plans,
and this committee will have to review those plans with a fine-tooth
comb.
The purpose of today's hearing is to help give us the background to
do just that. We will hear from organizations that the CAIB cited as
possible models for NASA to follow and from an industrial leader in
safety. Obviously, there are differences among these models, and any
one of them would have to be adapted to apply to NASA. But they all
highlight characteristics of high-reliability organizations that NASA
has been lacking. We will learn from Admiral Gehman precisely why and
how the Navy and Air Force safety programs can be seen as models for
NASA.
I have no doubt that this committee will have ample opportunity
over the next year or so to put to use the information we gather today.
As I noted earlier, NASA is just in the initial stages of putting
together an organization plan, and I have complete confidence that
Administrator O'Keefe has taken the CAIB recommendations to heart.
But that said, I must note that I believe the initial organization
ideas being circulated by NASA fall significantly short of the mark. We
look forward to working with NASA as it continues to rework its plans.
Today's hearing, though, is not on any specific proposal. Rather,
our goal today is to learn what has worked elsewhere and why, and to
start thinking how the experience of others could be put to work to
help NASA.
This is one of the most important tasks facing this committee, and
I am eager to hear from our witnesses today.
Chairman Boehlert. The gentleman from Texas, Mr. Hall.
Mr. Hall. Thank you, Mr. Chairman. I certainly join you in
welcoming the panel and Admiral Bowman and Admiral Sullivan,
Mr. Johnson, and Ms. Grubbe. And Admiral Gehman is to be here.
I think he has a conflict right now, but he is to join us. We
look forward to his input and his backing up the testimony that
we are going to be hearing here and to thank him again for an
excellent job that he did at a time when we really needed an
excellent job to be done.
As we continue to address the recommendations of the panel,
we now come to absolutely the most important part of it. We
have talked about organizational items, and we were organized
then, but we just weren't organized properly. And we need
organizational changes now. And that has got to be the thrust.
The Columbia Accident Investigation Board, the CAIB, report
devotes an entire chapter to the organizational causes of the
accident. And in it, the CAIB makes three specific
recommendations, and those are based on the CAIB's
investigation of organizations that have had success in setting
up and maintaining highly regarded safety procedures. They have
had some experience and they know what they are doing. They
know what they are recommending.
So three of the organizations represented by our witnesses
here are specifically named by CAIB as examples of
organizations, and I quote, ``highly adept in dealing with
inordinately high risk by designing hardware and management
systems that prevent seemingly inconsequential failure from
leading to major disasters.'' And you almost have to read that
and read it again to really get the full impact of it. But we
want to hear from each of you about the characteristics of your
approaches to safety that you think are important for NASA to
adopt.
However, setting up the right organizational structure is
only part of the job. Ensuring that the organization carries
through on safe practices is equally important. That is where
independent oversight can play a valuable role, and that is why
the Chairman emphasizes independence, independence,
independence. After the Apollo fire in 1968, Congress set up
the Aerospace Safety Advisory Panel, ASAP, to provide that
function for the agency. And in recent years, it has become
apparent that NASA had not followed through on a number of the
ASAP's constructive recommendations. As many of you know, the
entire membership of ASAP resigned last month. And that is
highly irregular. I can't even remember such an action ever
occurring. I think we need to find out why they resigned and
what we need to do to address their concerns.
One of the ASAP's recommendations concerned the need for a
crew escape system for the Shuttle. And I think ASAP was
exactly right on that. I would also note that the appendices to
the CAIB report that were released this week make it clear that
we can and we should be doing more to ensure crew survivability
on the Shuttle. I don't understand why we can't. I am going to
press--continue to press for NASA action on a crew escape
system if the Shuttle is going to be flying for many more
years. If it is going to be flying for another year, I want us
to be underway at doing it. I would hate to have a tragedy at
the end of this year and not have already launched a method for
them to escape whether we are able to get that in place. It is
just like Reagan's star wars. I don't think Russia ever knew if
we had one in place or not, but I think it helped that we were
on our way there. And the fact that we were working toward it
gave us a lot electronically and even nationally defense-wise.
And it was worthwhile. It was worth what we spent for it.
So I--and I have another concern. Admiral Gehman has made
the point in recent months that he is concerned about NASA not
following through on the CAIB recommendations once the Shuttle
returns to flight. I also share his concern. I think an
independent group is needed to monitor NASA's implementation of
the CAIB recommendations. One potential approach is contained
in H.R. 3219, a bill I recently introduced that directs the
NASA Administrator to work with the National Academies of
Science and Engineering to establish such an independent
oversight committee. It would report yearly to Congress for
five years following the launch of the next Shuttle. As I have
said, it is one potential approach. It is not the only one.
There may be others. There may be a better way to go about
ensuring continuing, independent oversight of NASA's Shuttle
program. And I am open to suggestions. But I think we need to
take action. I introduced that to get something kicked off, to
get it going in the right direction. And if anybody can pick a
better direction or a faster direction or a safer direction,
then I am certainly interested in looking at. I--but I don't
want CAIB's recommendations to wind up being ignored.
Well, I won't take any more time, Mr. Chairman, to discuss
these issues. I know we all want to hear from the witnesses,
very valuable witnesses, and people that are givers and not
takers. You have had to prepare yourself to come here. You had
to prepare yourself to know what you know and to do what you
have done and then to share it with us. I appreciate it, and I
know the Chair and this committee does.
And I yield back my time.
[The prepared statement of Mr. Hall follows:]
Prepared Statement of Representative Ralph M. Hall
Good morning. I want to join the Chairman in welcoming Admiral
Bowman, Admiral Sullivan, Mr. Johnson, and Ms. Grubbe to our hearing.
Admiral Gehman, welcome back to our committee. We again look forward to
your comments.
As we continue to address the recommendations of the Gehman Panel,
we now come to one of the most important areas--organizational changes.
The Columbia Accident Investigation Board (CAIB) report devotes an
entire chapter to the organizational causes of the accident. In it, the
CAIB makes three specific recommendations. Those recommendations are
based on the CAIB's investigation of organizations that have had
success in setting up and maintaining highly regarded safety
procedures.
Three of the organizations represented by our witnesses are
specifically named by the CAIB as examples of organizations ``highly
adept in dealing with inordinately high risk by designing hardware and
management systems that prevent seemingly inconsequential failure from
leading to major disasters.'' We want to hear from each of you about
the characteristics of your approaches to safety that you think are
important for NASA to adopt.
However, setting up the right organizational structure is only part
of the job. Ensuring that the organization carries through on safe
practices is equally important. That's where independent oversight can
play a valuable role. After the Apollo fire in 1968, Congress set up
the Aerospace Safety Advisory Panel (ASAP) to provide that function for
the agency. In recent years, it has become apparent that NASA has not
followed through on a number of the ASAP's constructive
recommendations. As many of you know, the entire membership of the ASAP
resigned last month. I can't ever remember such an action occurring,
and I think we need to find out why they resigned and what we need to
do to address their concerns.
One of the ASAP's recommendations concerned the need for a crew
escape system for the Shuttle. I think the ASAP was right. I'd also
note that the appendices to the CAIB report that were released this
week make it clear that we can and should be doing more to ensure crew
survivability on the Shuttle. I'm going to continue to press for NASA
action on a crew escape system if the Shuttle is going to be flying for
many more years.
I have another concern. Admiral Gehman has made the point in recent
months that he is concerned about NASA not following through on the
CAIB recommendations once the Shuttle returns to flight. I share his
concern. I think an independent group is needed to monitor NASA's
implementation of the CAIB recommendations. One potential approach is
contained in H.R. 3219, a bill I recently introduced that directs the
NASA Administrator to work with the National Academies of Sciences and
Engineering to establish such an independent oversight committee. It
would report yearly to Congress for five years following the launch of
the next shuttle. As I said, it is one potential approach. There may be
other ways to go about ensuring continuing, independent oversight of
NASA's Shuttle program, and I am open to suggestions. But I think we
need to take action soon so that the CAIB's recommendations don't wind
up getting ignored.
Well, I will not take any more time to discuss these issues in my
opening statement. I know we all want to hear from the witnesses, and I
will continue this discussion during the question period.
I look forward to your testimony, and I yield back the balance of
my time.
Chairman Boehlert. Thank you very much, Mr. Hall.
The gentleman from Tennessee, Mr. Gordon.
Mr. Gordon. Thank you, Mr. Chairman. I think that you sent
us in a good direction with your earlier remarks, so I will be
brief here. I want to also welcome the witnesses. It is my
understanding that Admiral Gehman is on his way over from the
Senate. And again, I want to thank him for his willingness to
appear before the Committee again.
The Columbia Accident Investigation Board, which he
chaired, raised a number of serious issues about the way NASA
addressed safety in the Shuttle program. The Board came to the
conclusion that should be of concern to all Members, namely,
and I quote, ``We are convinced that the management practices
overseeing the Space Shuttle program were as much a cause of
the accident as the foam that struck the left wing.'' To its
credit, the Board did not simply highlight the problem. It also
tried to offer some suggestions on how NASA might address the
management issue.
Today, we are going to hear from some non-NASA
organizations that the Board thinks may have some lessons
learned for NASA. I look forward to their testimony. In
particular, I hope that we can--or that they can offer the
Committee some benchmarks by which we can judge NASA's
responses to the Board's organizational recommendations.
Beyond that, Mr. Chairman, I hope that this hearing will be
just a starting point for our examination of these issues. I
hope that we will look at additional models of safety and
organizations for insights that they might offer. For example,
I think that we should look at how NASA and DOD handled
experimental flight testing programs at the Dryden Research
Center and Edwards Air Force Base.
I also think that it might be worth taking a look--a closer
look at the Russian human space flight program. As I understand
it, the Russians haven't had a space flight fatality since
1971, or more than 30 years ago. We might also benefit from the
examination of how NASA handled safety in the earlier years,
that is during the Apollo moon-landing program. Apollo was an
extremely challenging program that may have lessons for us to
learn today, also.
And finally, I want to support Mr. Hall's concerns and
comments. I was also very concerned about the mass resignation
of the Aerospace Safety Panel. ASAP members, I think we need to
hear from them and hear more about why they resigned and what
they feel like is necessary for their independence.
So there is a lot to cover today, and once again, thank
you, Mr. Chairman, for bringing us together for this important
meeting and I am glad the witnesses are giving their time
today.
Chairman Boehlert. Thank you very much, Mr. Gordon and Mr.
Hall.
[The prepared statement of Mr. Rohrabacher follows:]
Prepared Statement of Representative Dana Rohrabacher
Mr. Chairman, your leadership has enabled this committee to
carefully deliberate on the root causes that contributed to the
Columbia Space Shuttle accident and critical issues surrounding the
future of our civil space program in the wake of this tragedy.
Admiral Gehman and his colleagues found that overconfidence and an
overly bureaucratic nature dominated NASA's historical decision-making
of Shuttle Program managers. Although NASA claims it has made safety a
high priority within the Space Shuttle Program, ``blind spots''
inherent in its culture impeded its ability to detect risks posed by
something as simple as form.
NASA must get its house in order before it attempts to meet the
challenge of space exploration. Our witnesses will provide us insight
on how their organizations apply best practices for reducing the
likelihood of accidents. Let's hope that what we learn today is useful
for getting NASA on the path of recovery tomorrow.
Thank you Mr. Chairman.
[The prepared statement of Mr. Costello follows:]
Prepared Statement of Representative Jerry F. Costello
Good morning. I want to thank the witnesses for appearing before
our committee to discuss the organizational and management issues
confronting NASA in the aftermath of the Space Shuttle Columbia
accident. Today's hearing serves has an opportunity for Congress to
gain a better understanding of the Columbia Accident Investigation
Board (CAIB) recommendations and the successful safety programs of the
organizations represented at this hearing so as to have an informed
basis for judging whether NASA is in compliance with the CAIB
recommendations.
I have been concerned with the Safety and Health regulation
structure used by the DOE civilian labs. My colleague, Congressman Ken
Calvert, has worked with me to introduce a bill ending DOE's self-
regulation and opening the civilian labs up to regulation by OSHA and
the NRC. The Jet Propulsion Laboratory (JPL) has been drawn into this
discussion inadvertently due to its inclusion in the DOE 2002 Best
Practices Study. That report, coupled with reviews done by the General
Accounting Office, draws attention to the relative efficiency of JPL's
management processes and provides a snapshot for what we would like to
see at the civilian labs.
The same can be said about the Naval Nuclear Propulsion Program,
the SUBSAFE program, and Aerospace Corporation in relation to NASA and
evaluating best safety practices. You each represent organizations that
have been identified as leaders in safety. The CAIB report recommends
that NASA establish an independent Technical Engineering Authority that
is responsible for all technical requirements and waivers to them.
Further, the CAIB's fundamental goal in establishing this independent
body is to separate the responsibility for safety from the Shuttle's
program responsibility for cost and schedule.
I am interested to know if each of your organizations has an
independent technical engineering authority or something similar and
how it is independent from other elements of the organization, funded
and staffed. Further, I am interested to know from Admiral Gehman how
he and CAIB view the role of the Shuttle program manager in light of
the CAIB recommendations.
I welcome our panel of witnesses and look forward to their
testimony.
[The prepared statement of Ms. Johnson follows:]
Prepared Statement of Representative Eddie Bernice Johnson
Thank you, Mr. Chairman. I would like to thank you for calling this
hearing today, and I would also like to thank our witnesses for
agreeing to appear here today to answer our questions.
Today we are here to discuss issues concerning organization and
management at the National Aeronautics and Space Administration (NASA).
At the end of the past summer, the final report of the Columbia
Accident Investigation Board (CAIB) was released. While much of it
focused on the technical causes, there was also a substantial emphasis
on poor decisions and other organizational issues that may have led to
the accident. Included in this report are communications about how
repeated foam strikes on the Shuttle became damaged, as well as
communications and decision-making issues among engineers and managers
while the Shuttle was in orbit. These types of mistakes are entirely
too costly.
We are now seeing the warning signs that show that NASA is an
agency in trouble. The Columbia Accident Investigation Board sharply
criticized NASA's safety and management procedures. With problems
escalating rather than abating, NASA still seems ready to put the
mission ahead of an abundance of caution. What could be the disastrous
affects if the Space Station is not being properly maintained and
supplied, increasing the risk to its crew? In this environment, if
senior safety officials cannot halt the launch of a replacement crew to
a deteriorating Space Station, who at NASA can and would abort a
dangerous mission?
We must put forth a more concerted effort to protect the safety of
our astronauts.
It was over 40 years ago that this nation's leaders in human space
travel were given the foresight to recognize the importance of space
exploration. It is my hope that NASA will continue this exploration,
with the intent of making safety first in all of their endeavors.
[The prepared statement of Ms. Jackson Lee follows:]
Prepared Statement of Representative Sheila Jackson Lee
Mr. Chairman,
Thank you for calling yet another critical hearing in this series
to ensure that we in Congress are doing all we can do to help NASA get
back on track to fulfilling its vital mission in Space. I have been
pleased by the bipartisan spirit here and in the Space Subcommittee
since February, when we lost the Shuttle Columbia and her brave crew.
Fulfilling the call of the Gehman Board and changing the culture at
NASA will take hard work, creativity, and good ideas from both sides of
the aisle.
But we do not need to re-invent the wheel. As was stated in the
Columbia Accident Investigation Board Report, there are several
excellent models of organizations that work in high-risk areas, and
still maintain solid safety records. I thank the representatives from
those groups for joining us today, to enlighten us on the management
practices they use to ensure that safety is not an afterthought, but a
top priority.
Working together, I hope we can draw from their experiences and
craft policies for NASA that will ensure that Shuttles and the Space
Station, as well as the spaceships of the future, are robust and
reliable.
I am especially interested in their opinions on the role of
whistleblower protections and retaliation prevention in promoting open
dialogue and safety. After the Columbia Disaster, it was painful to
hear from the CAIB that there were people at NASA--and not just some
interns with naive notions--but experienced engineers, who had
recognized the dangers, and tried to take prudent steps to get images
that may have averted disaster. Those experts were ignored. That is
truly painful to think about. The report gave great insight into the
broken culture of safety at NASA that impeded the flow of critical
information from engineers up to program managers. I quote: ``Further,
when asked by investigators why they were not more vocal about their
concerns, Debris Assessment Team members opined that by raising
contrary points of view about Shuttle mission safety, they would be
singled out for possible ridicule by their peers.''
That reaffirms to me that strong whistleblower protections do not
just protect workers. They protect lines of communication and dialogue
that prevent waste, fraud, and abuse, and, in this case, might have
saved lives. I have been working with union representatives to develop
a pathway within NASA, through which workers with serious concerns
about the safety of a mission or the survivability of crew can go to
express their opinions. That body will make sure that due attention is
given to their concerns. After that, the same office will be charged
with following the employee that came to them over time, to ensure that
they are not harassed or retaliated against in any way.
Workers that think critically and act responsibly should be
rewarded, not punished. Protecting such workers will send a signal to
all workers that safety must always come before speed. I would like to
hear the panelists' opinions of this approach.
I am also interested in their opinions of what proportion of their
budgets are dedicated to safety and quality assurance. Budgets are
tight these days, and many important programs are being cut. However,
if we are going to continue our mission in space--as I believe we
must--we need to spend the appropriate funds to protect our investments
and our astronauts. How much will that cost?
I am also pleased to see Admiral Gehman here again to share his
expertise and insights with us. I would like to continue the dialogue
we started last month, exploring how we can ensure that the lessons we
learn about how to make the Shuttle safer also carry over to the Space
Station and other NASA programs. Recent revelations that the new Space
Station crew was sent up against the will of senior medical personnel
were disturbing. It was even more disturbing to hear that the internal
debates about hazards to the crew did not percolate up to the
Administrator until a couple of days before flight--and never made it
to us in Congress. I hope it is not business-as-usual at NASA. I would
like to hear the Admiral's ideas on this matter.
I look forward to the discussion. Thank you.
Panel I
Chairman Boehlert. Let us get right to our panel.
The panel consists of: Admiral F.L. ``Skip'' Bowman,
Director, Naval Nuclear Propulsion Program; Rear Admiral Paul
E. Sullivan, Deputy Commander, Ship Design, Integration and
Engineering, Naval Sea Systems Command; Ray F. Johnson, Vice
President, Space Launch Operations, The Aerospace Corporation;
and Ms. Deborah Grubbe, Corporate Director, Safety and Health,
DuPont. Thank you all for your willingness to serve as
resources for this committee. And as you will discover, we are
going to listen in wrapped attention, because what you have to
say is very important to us and--as we go about our very
important work. And I would ask that you try to summarize your
statement. The Chair is not going to be arbitrary. What you
have to say is too darn important to confine it to 300 seconds,
but that would be sort of a benchmark of five minutes or so, so
that we will have ample time for a dialogue and an exchange so
that we can learn. Thank you very much.
Admiral Bowman, you are first up.
STATEMENT OF ADMIRAL F.L. ``SKIP'' BOWMAN, DIRECTOR, NAVAL
NUCLEAR PROPULSION PROGRAM, U.S. NAVY
Admiral Bowman. Mr. Chairman, Mr. Hall, Members of the
Committee, thank you very much for the opportunity to testify
today on the culture of safety that has allowed Naval Reactors
to be successful for the last 55 years.
First, let me say that I wish the circumstances that
brought me here were different. I am sure it is true with you,
also. Obviously, the underlying reason I am here involves your
oversight of NASA in the aftermath of the Space Shuttle
Columbia tragedy.
I want to begin, then, by extending my sympathy to all of
the families, colleagues, and friends of the Columbia crew. I
must also tell you that although there has been, and continues
to be, much public discussion of the tragedy, why it happened
and what changes NASA should pursue, I do not know firsthand
the details surrounding the accident nor am I an expert on
spacecraft or the NASA organization. I am therefore not
qualified to make judgments about the causes of the tragedy or
to even suggest changes that NASA may implement to prevent our
nation from suffering another terrible loss. However, I have
studied, very carefully, the final report of the Columbia
Accident Investigation Board, and I believe, therefore, that
you might draw some useful thoughts from my testimony today.
I am often asked, Mr. Chairman, how it is that Naval
Reactors has been able to maintain its impeccable safety record
for these 55 years. Just last week, I participated in a
conference that asked these same questions, commemorating the
50th anniversary of President Eisenhower's ``Atoms for Peace''
speech, which partially addressed these very questions that I
will address today. And many of the things that I have said
then are applicable today.
Since Admiral Hyman Rickover began the Naval Reactors
Program in 1948, we have insisted that the only way to operate
our nuclear power plants, the only way to ensure safe operation
generation after generation, is to embrace a system that
ingrains in each operator a total commitment to safety, a
pervasive, enduring devotions to a culture of safety and
environmental stewardship.
To ensure the Program's success, as our record of safety
clearly demonstrates, Admiral Rickover established these core
values, which endure today. First, technical excellence and
technical competence are absolutely required in our work.
Because things do happen, especially at sea, we rely on a
multi-layered defense against off-normal events. Our reactor
designs and operating procedures are uncomplicated and
conservative, and we build in redundancy. Next, we still, and
always will, select the very best people we can find with the
highest integrity and professional competence; then we
rigorously train them and continually challenge them. Third, we
require formality and discipline, and we insist on forceful
backup from the very youngest sailor on board all of the way up
through to the commanding officer. And fourth, every level of
the Program must accept inescapable, cradle-to-grave
responsibility for every aspect of nuclear power operations.
These core values, among others, are what define our
organizational culture. They are visible in everything we do
and have done for the last 55 years.
Today, in my eighth year as Admiral Rickover's successor,
the fourth director of Naval Reactors, I oversee the operation
of 103 naval reactors, equaling the number of commercial
reactors in this country. These reactors, powering U.S. Navy
ships, are welcomed in more than 150 ports and more than 50
countries around the world.
That welcome access is primarily due to our safety record.
Safety is embedded in our organization in every individual at
every level. Put another way, we use the word ``mainstreamed.''
Safety is mainstreamed. It is not a responsibility unique to a
segregated safety department that then attempts to impose its
oversight on the rest of the organization. Each individual is
completely responsible for his or her component, his or her
system, from cradle to grave and this drives two other vital
aspects of the way we do business.
First, when solving a problem, we determine the range of
technically acceptable answers first. Then we find out how to
fit one of those solutions into our other constraints,
specifically cost and schedule, without imposing any undue risk
and without challenging the safety aspects of the technically
acceptable answers. If we need more time or more money, we
simply ask for it. Although we pride ourselves as stewards of
the Government's resources, we don't let funding or schedules
outweigh sound technical judgment.
Second, the decision-making process occasionally brings out
dissenting or minority opinions. When this occurs, my staff
presents the facts from both sides of the issues to me
directly. Before a final decision is made, every opinion is
aired. There is never any fear of reprisal for not agreeing
with the proposed recommendation; rather, if there is not a
minority opinion, I ask why not and solicit that minority
opinion, treat it with the same weight as the consensus view.
If I determine that there is enough information to make a
decision, then I make a decision. If more data are needed, then
we get more data.
In the aftermath of Three Mile Island, the accident in
1979, Admiral Rickover was asked to testify before Congress in
a context very similar to my appearance here today. In his
testimony, he said the following: ``Over the years, many people
have asked me how I run the Naval Reactors Program so that they
might find some benefit for their own work. I am always
chagrined at the tendency of people to expect that I have a
simple, easy gimmick that makes my program function. Any
successful program functions as an integrated whole of many
factors. Trying to select just one aspect as the key one will
not work. Each element depends on all of the others.''
I wholeheartedly agree with what Admiral Rickover said
those years ago. As I said earlier, there is no magic formula.
Safety must be in the mainstream.
Mr. Chairman, with your permission, I will submit a copy of
my written testimony along with Admiral Rickover's 1979
testimony for the record. This testimony is very relevant,
because it describes many of the same attributes and core
values that I have discussed today, demonstrating that in fact
these key elements of Naval Reactors are timeless and enduring.
That testimony also details the continual training program for
the nuclear-trained Fleet operators. I have taken the
opportunity to update the statistics on the first four pages of
Admiral Rickover's testimony to put them in perspective for
today's real numbers. Also, with your permission, I will submit
a copy of the Program's annual environmental, occupational
radiation exposure, and occupational safety and health reports
for the Committee's perusal.
Our basic organization responsibilities, and, most
importantly, our core values have remained largely unchanged
since Admiral Rickover founded Naval Reactors. These core
values that I have discussed today are the foundation that have
allowed our nuclear-powered ships to safely steam more than 128
million miles, equivalent to over 5,000 trips around the Earth,
without a reactor accident, indeed, with no measurable negative
impact on the environment or human health.
Thank you very much for allowing me to testify today.
[The prepared statement of Admiral Bowman follows:]
Prepared Statement of Admiral F.L. ``Skip'' Bowman
Mr. Chairman and Members of this committee, thank you for giving me
the opportunity to testify today on the subject of the culture of
safety that has allowed Naval Reactors to be successful for the last 55
years.
But first, let me say that that I wish the circumstances that
brought me here were different. Obviously, the underlying reason I'm
here involves your oversight of NASA in the aftermath of the Space
Shuttle Columbia tragedy. I want to begin, then, by extending my
sympathy to all the families, colleagues, and friends of the Columbia
crew. I must also tell you that although there has been and continues
to be much public discussion of the tragedy--why it happened, what
changes NASA should pursue, and others--I do not know first-hand the
details surrounding the accident, nor am I an expert on spacecraft or
the NASA organization. I therefore am not qualified to make judgments
about the causes of the tragedy or to suggest changes that NASA may
implement to prevent our nation from suffering another terrible loss.
However, having studied the final report of the Columbia Accident
Investigation Board, I believe you may draw some useful conclusions
from my testimony.
My area of expertise is the Naval Reactors Program (NR), so it's
better for me to talk about that. Admiral Hyman G. Rickover set up NR
in 1948 to develop nuclear propulsion for naval warships. Nuclear
propulsion is vital to the Navy today for the reasons Admiral Rickover
envisioned 55 years ago: it gives our warships high speed, virtually
unlimited endurance, worldwide mobility, and unmatched operational
flexibility. When applied to our submarines, nuclear propulsion also
enables the persistent stealth that allows these warships to operate
undetected for long periods in hostile waters, exercising their full
range of capabilities.
In 1982, after almost 34 years as the Director of Naval Reactors,
Admiral Rickover retired. Recognizing the importance of preserving the
authority and responsibilities Admiral Rickover had established,
President Reagan signed Executive Order 12344. The provisions of the
executive order were later set forth in Public Laws 98-525 [1984] and
106-65 [1999]. The executive order and laws require that the Director,
Naval Reactors, hold positions of decision-making authority within both
the Navy and the Department of Energy (DOE). Because continuity and
stature are vital, the director has the rank of four-star admiral
within the Navy and Deputy Administrator within the Department of
Energy's National Nuclear Security Administration and a tenure of eight
years.
Through the Executive Order and these laws, the director has
responsibility for all aspects of naval nuclear propulsion,
specifically:
Direct supervision of our single-purpose DOE
laboratories, the Expended Core Facility, and our training
reactors.
Research, development, design, acquisition,
procurement, specification, construction, inspection,
installation, certification, testing, overhaul, refueling,
operating practices and procedures, maintenance, supply
support, and ultimate disposition of naval nuclear propulsion
plants and components, plus any related special maintenance and
service facilities.
Training (including that which is conducted at the
DOE training reactors), assistance and concurrence in the
selection, training, qualification, and assignment of personnel
reporting to the director and of personnel who supervise,
operate, or maintain naval nuclear propulsion plants.
Administration of the Naval Nuclear Propulsion
Program, including oversight of Program support in areas such
as security, nuclear safeguards and transportation, public
information, procurement, logistics, and fiscal management.
And finally, perhaps most relevant to this committee,
I am responsible for the safety of the reactors and associated
naval nuclear propulsion plants, and control of radiation and
radioactivity associated with naval nuclear propulsion
activities, including prescribing and enforcing standards and
regulations for these areas as they affect the environment and
the safety and health of workers, operators, and the general
public.
For more than seven years, I have been the director, the third
successor to Admiral Rickover. I am responsible for the safe operation
of 103 nuclear reactors--the same number as there are commercial
nuclear power reactors in the U.S. Roughly 40 percent of the Navy's
major combatants are nuclear powered, including 10 of its 12 aircraft
carriers plus 54 attack submarines, 16 ballistic missile submarines,
and two former ballistic missile submarines being converted to SSGNs
(guided missile submarines). Also included in these 103 reactors are
four training reactors and the NR-1, a deep submersible research
submarine. The contribution these ships and their crews make to the
national defense and, more recently, to the Global War on Terrorism is
remarkable. And the Program's safety record speaks for itself: these
warships have steamed over 128 million miles since 1953 and are
welcomed in over 150 ports of call in over 50 countries around the
world.
Safety is the responsibility of everyone at every level in the
organization. Safety is embedded across all organizations in the
Program, from equipment suppliers, contractors, laboratories,
shipyards, training facilities, and the Fleet to our Headquarters. Put
another way, safety is mainstreamed. It is not a responsibility unique
to a segregated safety department that then attempts to impose its
oversight on the rest of the organization.
To clarify what I mean by mainstreaming, let me tell you a story
from my days as Chief of Naval Personnel. I was speaking to a large
gathering of Army, Navy, Air Force, and Marine Corps military and
civilian personnel at the Defense Equal Opportunity Management
Institute. I startled the group by beginning with the phrase, ``I'm
here to tell you about plans to put you out of your jobs in a few
years!'' I explained that a worthwhile goal would be to have an
organization that didn't need specialists to monitor, enforce, and
remind line management to do what's right. That's mainstreaming.
Our record of safety is the result of our making safety part of
everything we do, day to day, not a magic formula. To achieve this
organizational culture of safety in the mainstream, Admiral Rickover
established certain core values in Naval Reactors that remain very
visible today. I will discuss four of them: People, Formality and
Discipline, Technical Excellence and Competence, and Responsibility.
PEOPLE
Admiral Rickover has been rightly credited with being an
outstanding engineer and a gifted manager of technical matters. His
other genius lay in finding and developing the right people to do
extremely demanding jobs.
At NR, we still, and we always will, select the best people we can
find, with the highest integrity and the willingness to accept complete
responsibility over every aspect of nuclear-power operations. Admiral
Rickover personally selected every member of his Headquarters staff and
every naval officer accepted into the Program. This practice is still
in place today, and I conduct these interviews and make the final
decision myself.
It doesn't end there. After we hire the best men and women, the
training they need to be successful begins immediately. All members of
my technical staff undergo an indoctrination course that occupies their
first several months at Headquarters. Next, they spend two weeks at one
of our training reactors, learning about the operation of the reactor
and the training our Fleet sailors are undergoing. This is experience
with an actual, operating reactor plant, not a simulation or a
PowerPoint presentation--and it is an important experience. It gives
them an understanding that the work they do affects the lives of the
sailors directly, while they perform the Navy's vital national defense
role. This helps reinforce the tenet that the components and systems we
provide must perform when needed.
Shortly after they return from the training reactor, they spend six
months at one of our DOE laboratories for an intensive, graduate-level
course in nuclear engineering. Once that course is complete, they spend
three weeks at a nuclear-capable shipyard, observing production work
and work controls. Finally, they return to Headquarters and are
assigned to work in one of our various technical jobs. During the next
six months, they attend a series of seminars, covering broad technical
and regulatory matters, led by the most experienced members of my
staff.
At Headquarters, there is a continued emphasis on professional
development as we typically provide training courses that are open to
the entire staff each month on various topics, technical and non-
technical. In particular, we have many training sessions on lessons
we've learned--trying to learn from mistakes that we, or others, have
made in order to prevent similar mistakes from recurring.
Throughout their careers, the members of my staff are continually
exposed to the end product, spending time on the waterfront, at the
shipyards, in the laboratories, at the vendor sites, or interacting
directly with the Fleet. My staff audits nuclear shipyards, vendors,
training facilities, laboratories, and the ships to validate that our
expectations are met. In addition, we receive constant feedback from
the Fleet by several means. When a nuclear-powered ship returns from
deployment, my staff and I are briefed on the missions the ship
performed and any significant issues concerning the propulsion plant.
Additionally, I have a small cadre of Fleet-experienced, nuclear-
trained officers at Headquarters who, like me, bring operational
expertise and perspective to the table.
My Headquarters staff is very small, comprised of about 380 people,
including administrative and support personnel. We are also an
extremely ``flat'' organization. About 50 individuals report directly
to me, including my Headquarters section heads, plus field
representatives at shipyards, major Program vendors, and the
laboratories. Included in this is a small section of people responsible
for Reactor Plant Safety Analysis. In an organization where safety is
truly mainstreamed, one might ask why we have a section for Reactor
Plant Safety Analysis. Here's why: they provide most of the liaison
with other safety organizations (such as the NRC) to help ensure we are
using best practices and to champion the use of those practices within
my staff. They also maintain the documentation of procedures and upkeep
of the modeling codes used in our safety analysis. Last, they provide
one last layer that our mainstreamed safety practices are in fact
working the way they should--an independent verification that we are
not ``normalizing'' threats to safety. Thus, they are full-time safety
experts who provide our corporate memory of what were past problems,
what we have to do to maintain a consistent safety approach across all
projects, and what we need to follow in civilian reactor safety
practices.
Nearly all my Headquarters staff came to Naval Reactors right out
of college. A great many of them spend their entire careers in the
Program. For example, my section heads, the senior managers who report
directly to me, have an average of more than 25 years of Program
experience. It is therefore not uncommon that a junior engineer working
on the design of a component in a new reactor plant system will be
responsible several years later for that same system during its service
life.
Even though the focus of my testimony is on my Headquarters staff,
I should also point out the importance of the Navy crews who operate
our nuclear-powered warships. Again, I personally select the best
people I can find and then train them constantly, giving them
increasing challenges and responsibilities throughout their careers. My
Headquarters staff and I oversee this training directly.
FORMALITY AND DISCIPLINE
Engineering for the long haul demands that decisions be made in a
formal and disciplined manner. By ``the long haul,'' I mean the cradle-
to-grave life of a project, and even an individual reactor plant.
Before a new class of ships (which may be in service for more than 50
years) is even put into service, we typically have already determined
how we will perform maintenance--and refueling, if needed--and have
considered eventual decommissioning and disposal of that ship. In the
long life of a project, all requests and recommendations are received
as formal correspondence. Resolution of issues is documented, as well.
Whether we are approving a minor change to one of our technical manuals
or resolving a major Fleet issue, the resolution will be clearly
documented in formal correspondence.
That correspondence must have the documented concurrence of all
parties within the Headquarters that have a stake in the matter. There
are formal systems in place to track open commitments and agreements or
dissents with proposed actions. I receive a copy of every recommended
action prior to issue, a practice initiated by Admiral Rickover in July
1949; in fact, these recommendations are frequently discussed in detail
and, when necessary, ``cleared'' with me prior to issue.
The 50 individuals who report directly to me inform me regularly
and routinely of issues in their area of responsibility. In addition,
commanding officers of nuclear-powered warships are required to report
to me routinely on matters pertaining to the propulsion plant.
This organizational ``flatness'' streamlines the flow of
information in both directions--allowing me to ensure that the guidance
I provide reaches everyone, while ensuring that my senior leaders and I
receive timely information vital to making the right decisions.
In our ships and at our training reactors, we require formality and
discipline. Detailed written procedures are in place for all aspects of
operation. These procedures are based on over 50 years of ship
operational experience, and they are followed to the letter, with what
we call verbatim--but not blind--compliance. Independent auditing,
coupled with critical self-assessments at all levels and activities, is
virtually continuous to ensure that crews are trained and procedures
are followed properly. We insist on forceful backup, from young sailor
to commanding officer. We also insist that the only way to operate our
nuclear power plants--the only way to ensure safe operation, generation
after generation--is to embrace a system that ingrains in each operator
a total commitment to safety: a pervasive, enduring commitment to a
culture of safety and environmental stewardship.
TECHNICAL EXCELLENCE AND COMPETENCE
Technical excellence and competence are required in our work.
Nearly all of my managers are technical people with either an
engineering or science background. My job requires me to be qualified
by reason of technical background and experience in naval nuclear
propulsion. I am a qualified, nuclear-trained naval officer, having
previously served in many operational billets, including commanding
officer of a submarine and of a submarine tender that maintains nuclear
ships. It is crucial that the people making decisions understand the
technology they are managing and the consequences of their decisions.
It is also important that much of the technical expertise reside within
the Government organization that oversees the contractor work. This
enables the Government to be a highly informed and demanding customer
of contractor technology and services.
An important part of our technical effort is working on small
problems to prevent bigger problems from occurring. The way we do this
is to ask the hard questions on every issue: What are the facts? How do
you know? Who is responsible? Who else knows about the issue and what
are they doing about it? What other ships and places could be affected?
What is the plan? When will it be done? Is this within our design,
test, and operational experience? What are the expected outcomes? What
is the worst that could happen? What are the dissenting opinions? When
dealing with an issue that seems minor, these and other questions like
them not only lead us to solving the current problem before it gets
worse, but also help us prevent future problems.
As we look at the many potential solutions to a given problem, we
determine the range of technically acceptable answers first. Then we
find out how to fit one of those solutions into our other constraints,
specifically cost and schedule, without imposing any undue risk. If we
need more time or more money, we ask for it. Although we pride
ourselves as stewards of the Government's resources, we do not let
funding or schedule concerns outweigh sound technical judgment.
Occasionally, the decision-making process brings out dissenting
opinions. When this occurs, my staff presents the facts from both sides
of the issue to me directly. Before a final decision is made, every
opinion is aired. There is never any fear of reprisal for not agreeing
with the proposed recommendation; rather, we solicit and welcome the
minority opinion and treat it with the same weight as the consensus
view. If I determine there is enough information to make a decision, I
decide. If more data are needed, we get more.
Because things do happen--especially at sea--we rely on a multi-
layered defense against off-normal events. Our reactor designs and
operating procedures are simple and conservative, and we build in
redundancy to compensate for the risks involved and the operational
environment. (For example, the pressurized water reactors are self-
regulating: the reactor is designed to protect itself during normal
operations or casualty situations.) The systems and components are
rugged--they must be to withstand battle shock and still perform. In
certain key systems, there are redundant components so that if one is
unable to function, the other can take over.
RESPONSIBILITY
Admiral Rickover realized the importance of having total
responsibility. He once said:
Responsibility is a unique concept: it can only reside and
inhere in a single individual. You may share it with others,
but your portion is not diminished. You may delegate it, but it
is still with you. You may disclaim it, but you cannot divest
yourself of it. Even if you do not recognize it or admit its
presence, you cannot escape it. If responsibility is rightfully
yours, no evasion, or ignorance, or passing the blame can shift
the burden to someone else. Unless you can point your finger at
the person who is responsible when something goes wrong, then
you have never had anyone really responsible.
His concept of total responsibility and ownership permeates NR at
every level. He also realized that while the Navy designed and operated
the ships, the Atomic Energy Commission (the forerunner of the
Department of Energy) was responsible for the nuclear research and
development--he would need to have authority within both activities.
Hence, he forged a joint Navy/Atomic Energy Commission program having
the requisite authority within each activity to carry out the cradle-
to-grave responsibility for all aspects of naval nuclear propulsion,
including safety.
CONCLUSION
In the aftermath of the Three Mile Island accident in 1979, Admiral
Rickover was asked to testify before Congress in a context similar to
my appearance before you today. In this testimony, he said:
Over the years, many people have asked me how I run the Naval
Reactors Program, so that they might find some benefit for
their own work. I am always chagrined at the tendency of people
to expect that I have a simple, easy gimmick that makes my
program function. Any successful program functions as an
integrated whole of many factors. Trying to select one aspect
as the key one will not work. Each element depends on all the
others.
I wholeheartedly agree. As I said earlier, there is no magic
formula. Safety must be in the mainstream.
Mr. Chairman, with your permission, I will submit a copy of Admiral
Rickover's 1979 testimony for the record. This testimony is relevant
because it describes many of the same key attributes and core values I
have discussed today--demonstrating that in fact, these key elements of
Naval Reactors are timeless and enduring. That testimony also details
the continual training program for the nuclear-trained Fleet operators
I mentioned earlier. I have updated the statistics on the first four
pages to make them current and placed them in parentheses beside the
1979 data. Also, with your permission, I will submit a copy of the
Program's annual environmental, occupational radiation exposure, and
occupational safety and health reports. [Note: These items are located
in Appendix 2: Additional Material for the Record.]
Our basic organization, responsibilities, and, most important, our
core values have remained largely unchanged since Admiral Rickover
founded NR. These core values that I've discussed today are the
foundation that have allowed our nuclear-powered ships to safely steam
more than 128 million miles, equivalent to over 5,000 trips around the
Earth. . .without a reactor accident. . .indeed, with no measurable
negative impact on the environment or human health.
Thank you for allowing me to testify before you today.
Biography for Admiral Frank Lee Bowman
United States Navy, Director, Naval Nuclear Propulsion
Admiral Frank L. ``Skip'' Bowman is a native of Chattanooga, Tenn.
He was commissioned following graduation in 1966 from Duke University.
In 1973 he completed a dual master's program in nuclear engineering and
naval architecture/marine engineering at the Massachusetts Institute of
Technology and was elected to the Society of Sigma Xi. Adm. Bowman has
been awarded the honorary degree of Doctor of Humane Letters from Duke
University. Admiral Bowman serves on two visiting committees at MIT
(Ocean Engineering and Nuclear Engineering), the Engineering Board of
Visitors at Duke University, and the Nuclear Engineering Department
Advisory Committee at the University of Tennessee.
His early assignments included tours in USS Simon Bolivar (SSBN
641), USS Pogy (SSN 647), USS Daniel Boone (SSBN 629), and USS
Bremerton (SSN 698). In 1983, Adm. Bowman took command of USS City Of
Corpus Christi (SSN 705), which completed a seven-month
circumnavigation of the globe and two special classified missions
during his command tour. His crew earned three consecutive Battle
Efficiency ``E'' awards. Adm. Bowman later commanded USS Holland (AS
32) from August 1988 to April 1990. During this period, the Holland
crew was awarded two Battle Efficiency ``E'' awards.
Ashore, Adm. Bowman has served on the staff of Commander, Submarine
Squadron Fifteen, in Guam; twice in the Bureau of Naval Personnel in
the Submarine Policy and Assignment Division; as the SSN 21 Attack
Submarine Program Coordinator on the staff of the Chief of Naval
Operations; on the Chief of Naval Operations' Strategic Studies Group;
and as Executive Assistant to the Deputy Chief of Naval Operations
(Naval Warfare). In December 1991, he was promoted to flag rank and
assigned as Deputy Director of Operations on the Joint Staff (J-3)
until June 1992, and then as Director for Political-Military Affairs
(J-5) until July 1994. Adm. Bowman served as Chief of Naval Personnel
from July 1994 to September 1996.
Admiral Bowman assumed duties as Director, Naval Nuclear
Propulsion, on 27 September 1996, and was promoted to his present rank
on 1 October 1996. In this position, he is also Deputy Administrator
for Naval Reactors in the National Nuclear Security Administration,
Department of Energy.
Under his command, his crews have earned the Meritorious Unit
Commendation (three awards), the Navy Battle Efficiency ``E'' Ribbon
(five awards), the Navy Expeditionary Medal (two awards), the
Humanitarian Service Medal (two awards), the Sea Service Deployment
Ribbon (three awards), and the Navy Arctic Service Ribbon. His personal
awards include the Defense Distinguished Service Medal, the Navy
Distinguished Service Medal, the Legion of Merit (with three gold
stars), and the Officier de l'Ordre National du Merite from the
Government of France.
Chairman Boehlert. Thank you very much for some very fine
testimony. And without objection, your statement, in its
entirety, along with the supplemental material, will be
included in the record. And that will hold true for the
testimony of all of our distinguished witnesses. We want
everything you can give us, because we--that is how we learn.
And thank you, Admiral, and congratulations, once again, for an
outstanding program.
Admiral Sullivan.
STATEMENT OF REAR ADMIRAL PAUL E. SULLIVAN, DEPUTY COMMANDER,
SHIP DESIGN, INTEGRATION AND ENGINEERING, NAVAL SEA SYSTEMS
COMMAND, U.S. NAVY
Rear Admiral Sullivan. Good morning, Mr. Chairman, Mr.
Hall, Members of the Committee. I would like to thank you for
the opportunity to testify about the Submarine Safety Program,
which we call in the Navy, SUBSAFE.
I serve as the Naval Sea Systems Command's Deputy Commander
for Ship Design, Integration and Engineering. My organization
is the authority for the technical requirements that underpin
the SUBSAFE Program.
Mr. Chairman, I have submitted a written statement, which
addresses the questions you raised about the SUBSAFE Program,
and I will summarize that statement for you now.
On April 10, 1963, when engaged in a deep test dive, the
USS Thresher was lost with 129 people on board. The loss of
Thresher and her crew was a devastating event for the submarine
community, the Navy, and the Nation.
Shortly after that tragedy, the SUBSAFE Program was created
in June 1963. It established submarine design requirements,
initial submarine safety certification requirements, and
submarine safety certification continuity requirements.
The purpose of the SUBSAFE Program is to provide maximum
reasonable assurance of watertight integrity and the ability of
our submarines to recover from flooding. It is important to
note that the SUBSAFE Program does not spread or dilute its
focus beyond that purpose.
The heart of the Program is a combination of work
discipline, material control, and documentation.
The SUBSAFE Program has been very successful, however, it
has not been without problems. For example, in 1984 NAVSEA
directed a thorough evaluation of the SUBSAFE Program to ensure
that mandatory discipline had been maintained. As a result, the
following year, in 1985, the Submarine Safety and Quality
Assurance Division was established as an independent
organization within NAVSEA to strengthen compliance with
SUBSAFE requirements.
The SUBSAFE Program continues to adapt to the ever-changing
construction and maintenance environments as well as new and
evolving technologies as they become used on our submarines.
Safety is central to the culture of our entire Navy
submarine community, including designers, builders,
maintainers, and operators. The Navy's submarine safety culture
is instilled through the following: first, clear, concise, non-
negotiable requirements; second, multiple, structured audits;
and third, annual training with strong, emotional lessons
learned from past failures.
SUBSAFE certification is a disciplined process that lead to
formal authorization for unrestricted operations on a
submarine. Once a submarine is certified for unrestricted
operation, we use three elements to maintain that
certification. The first, the Re-entry Control Process, is used
to control work within the SUBSAFE boundary and is the backbone
of this certification continuity. The second, the Unrestricted
Operation/Maintenance Requirement Program, is used to carry out
periodic inspections and tests of critical systems, and that is
the technical basis for continued unrestricted operations.
Third, SUBSAFE audits are used to confirm compliance with
SUBSAFE requirements. We use two primary types of audits. The
first is a certification audit, and that audit examines the
objective quality evidence, or paperwork, for an individual
submarine to ensure that that submarine is satisfactory for
unrestricted operations. Functional audits review the
organizations that perform SUBSAFE work to ensure that the
organization complies with SUBSAFE requirements.
In addition to these formal NAVSEA audits, our field
organizations and the Fleet are required to conduct their own
similar internal audits. In fact, we also have the field
activities audit the headquarters. We have some homework to do,
for instance, from the most recent of those headquarters audits
that was performed this summer.
The SUBSAFE Program has a formal organizational structure,
which has key--three key elements: first, technical authority;
second, program management; and third, the submarine safety and
quality assurance. Each of these elements is organizationally
independent and has the authority to stop the certification
process until an identified issue has been satisfactorily
resolved.
Our nuclear submarines require a highly competent and
experienced technical workforce and constant vigilance to
prevent complacency. Despite our past successes, mandated
downsizing of our workforce has caused us to continually
optimize our processes and to become more efficient while we
maintain that culture of safety.
In conclusion, let me reiterate that since the inception of
the SUBSAFE Program in 1963, the Navy has had a disciplined
process that provides maximum reasonable assurance that our
submarines are safe from flooding and can recover from a
flooding incident. We have taken the lessons learned from the
Thresher to heart, and we have them--made them a part of our
submarine culture.
Thank you.
[The prepared statement of Rear Admiral Sullivan follows:]
Prepared Statement of Rear Admiral Paul E. Sullivan
NAVAL SEA SYSTEMS COMMAND
SUBMARINE SAFETY (SUBSAFE) PROGRAM
Good Morning Chairman Boehlert, Ranking Member Hall and Members of
the Committee.
Thank you for the opportunity to testify before this committee
about the Submarine Safety Program, which the Navy calls SUBSAFE, and
how it operates.
My name is RADM Paul Sullivan, USN. I serve as the Naval Sea System
Command's Deputy Commander for Ship Design, Integration and
Engineering, which is the authority for the technical requirements of
the SUBSAFE Program.
To establish perspective, I will provide a brief history of the
SUBSAFE Program and its development. I will then give you a description
of how the program operates and the organizational relationships that
support it. I am also prepared to discuss our NASA/Navy benchmarking
activities that have occurred over the past year.
SUBSAFE PROGRAM HISTORY
On April 10, 1963, while engaged in a deep test dive, approximately
200 miles off the northeastern coast of the United States, the USS
THRESHER (SSN-593) was lost at sea with all persons aboard--112 naval
personnel and 17 civilians. Launched in 1960 and the first ship of her
class, the THRESHER was the leading edge of U.S. submarine technology,
combining nuclear power with a modern hull design. She was fast, quiet
and deep diving. The loss of THRESHER and her crew was a devastating
event for the submarine community, the Navy and the Nation.
The Navy immediately restricted all submarines in depth until an
understanding of the circumstances surrounding the loss of the THRESHER
could be gained.
A Judge Advocate General (JAG) Court of Inquiry was conducted, a
THRESHER Design Appraisal Board was established, and the Navy testified
before the Joint Committee on Atomic Energy of the 88th Congress.
The JAG Court of Inquiry Report contained 166 Findings of Fact, 55
Opinions, and 19 Recommendations. The recommendations were technically
evaluated and incorporated into the Navy's SUBSAFE, design and
operational requirements.
The THRESHER Design Appraisal Board reviewed the THRESHER's design
and provided a number of recommendations for improvements.
Navy testimony before the Joint Committee on Atomic Energy occurred
on June 26, 27, July 23, 1963 and July 1, 1964 and is a part of the
Congressional Record.
While the exact cause of the THRESHER loss is not known, from the
facts gathered during the investigations, we do know that there were
deficient specifications, deficient shipbuilding practices, deficient
maintenance practices, and deficient operational procedures. Here's
what we think happened:
THRESHER had about 3000 silver-brazed piping joints
exposed to full submergence pressure. During her last shipyard
maintenance period 145 of these joints were inspected on a not-
to-delay vessel basis using a new technique called Ultrasonic
Testing. Fourteen percent of the joints tested showed sub-
standard joint integrity. Extrapolating these test results to
the entire population of 3000 silver-brazed joints indicates
that possibly more than 400 joints on THRESHER could have been
sub-standard. One or more of these joints is believed to have
failed, resulting in flooding in the engine room.
The crew was unable to access vital equipment to stop
the flooding.
Saltwater spray on electrical components caused short
circuits, reactor shutdown, and loss of propulsion power.
The main ballast tank blow system failed to operate
properly at test depth. We believe that various restrictions in
the air system coupled with excessive moisture in the system
led to ice formation in the blow system piping. The resulting
blockage caused an inadequate blow rate. Consequently, the
submarine was unable to overcome the increasing weight of water
rushing into the engine room.
The loss of THRESHER was the genesis of the SUBSAFE Program. In
June 1963, not quite two months after THRESHER sank, the SUBSAFE
Program was created. The SUBSAFE Certification Criterion was issued by
BUSHIPS letter Ser 525-0462 of 20 December 1963, formally implementing
the Program.
The Submarine Safety Certification Criterion provided the basic
foundation and structure of the program that is still in place today.
The program established:
Submarine design requirements
Initial SUBSAFE certification requirements with a
supporting process, and
Certification continuity requirements with a
supporting process.
Over the next 11 years the submarine safety criterion underwent 37
changes. In 1974, these requirements and changes were codified in the
Submarine Safety Requirements Manual (NAVSEA 0924-062-0010). This
manual continues to be the set of formal base requirements for our
program today. Over the years, it has been successfully applied to many
classes of nuclear submarines and has been implemented for the
construction of our newest VIRGINIA Class submarine.
The SUBSAFE Program has been very successful. Between 1915 and
1963, sixteen submarines were lost due to non-combat causes, an average
of one every three years. Since the inception of the SUBSAFE Program in
1963, only one submarine has been lost. USS SCORPION (SSN 589) was lost
in May 1968 with 99 officers and men aboard. She was not a SUBSAFE
certified submarine and the evidence indicates that she was lost for
reasons that would not have been mitigated by the SUBSAFE Program. We
have never lost a SUBSAFE certified submarine.
However, SUBSAFE has not been without problems. We must constantly
remind ourselves that it only takes a moment to fail. In 1984 NAVSEA
directed that a thorough evaluation be conducted of the entire SUBSAFE
Program to ensure that the mandatory discipline and attention to detail
had been maintained. In September 1985 the Submarine Safety and Quality
Assurance Office was established as an independent organization within
the NAVSEA Undersea Warfare Directorate (NAVSEA 07) in a move to
strengthen the review of and compliance with SUBSAFE requirements.
Audits conducted by the Submarine Safety and Quality Assurance Office
pointed out discrepancies within the SUBSAFE boundaries. Additionally,
a number of incidents and breakdowns occurred in SUBSAFE components
that raised concerns with the quality of SUBSAFE work. In response to
these trends, the Chief Engineer of the Navy chartered a senior review
group with experience in submarine research, design, fabrication,
construction, testing and maintenance to assess the SUBSAFE program's
implementation. In conjunction with functional audits performed by the
Submarine Safety and Quality Assurance Office, the senior review group
conducted an in depth review of the SUBSAFE Program at submarine
facilities. The loss of the CHALLENGER in January 1986 added impetus to
this effort. The results showed clearly that there was an unacceptable
level of complacency fostered by past success; standards were beginning
to be seen as goals vice hard requirements; and there was a generally
lax attitude toward aspects of submarine configuration.
The lessons learned from those reviews include:
Disciplined compliance with standards and
requirements is mandatory.
An engineering review system must be capable of
highlighting and thoroughly resolving technical problems and
issues.
Well-structured and managed safety and quality
programs are required to ensure all elements of system safety,
quality and readiness are adequate to support operation.
Safety and quality organizations must have sufficient
authority and organizational freedom without external pressure.
The Navy continues to evaluate its SUBSAFE Program to adapt to the
ever-changing construction and maintenance environments as well as new
and evolving technologies being used in our submarines. Since its
creation in 1974 the SUBSAFE Manual has undergone several changes. For
example, the SUBSAFE boundary has been redefined based on improvements
in submarine recovery capability and establishment of a disciplined
material identification and control process. An example of changing
technology is the utilization of fly-by-wire ship control technology on
SEAWOLF and VIRGINIA class submarines. Paramount in this adaptation
process is the premise that the requirements, which keep the SUBSAFE
Program successful, will not be compromised. It is a daily and
difficult task; but our program and the personnel who function within
it are committed to it.
PURPOSE AND FOCUS
The purpose of the SUBSAFE Program is to provide maximum reasonable
assurance of watertight integrity and recovery capability. It is
important to recognize that the SUBSAFE Program does not spread or
dilute its focus beyond this purpose. Mission assurance is not a
concern of the SUBSAFE Program, it is simply a side benefit of the
program. Other safety programs and organizations regulate such things
as fire safety, weapons systems safety, and nuclear reactor systems
safety.
Maximum reasonable assurance is achieved by certifying that each
submarine meets submarine safety requirements upon delivery to the Navy
and by maintaining that certification throughout the life of the
submarine.
We apply SUBSAFE requirements to what we call the SUBSAFE
Certification Boundary--those structures, systems, and components
critical to the watertight integrity and recovery capability of the
submarine. The SUBSAFE boundary is defined in the SUBSAFE Manual and
depicted diagrammatically in what we call SUBSAFE Certification
Boundary Books.
SUBSAFE CULTURE
Safety is central to the culture of our entire Navy submarine
community, including designers, builders, maintainers, and operators.
The SUBSAFE Program infuses the submarine Navy with safety requirements
uniformity, clarity, focus, and accountability.
The Navy's safety culture is embedded in the military, Civil
Service, and contractor community through:
Clear, concise, non-negotiable requirements,
Multiple, structured audits that hold personnel at
all levels accountable for safety, and
Annual training with strong, emotional lessons
learned from past failures.
Together, these processes serve as powerful motivators that
maintain the Navy's safety culture at all levels. In the submarine
Navy, many individuals understand safety on a first-hand and personal
basis. The Navy has had over one hundred thousand individuals that have
been to sea in submarines. In fact, many of the submarine designers and
senior managers at both the contractors and NAVSEA routinely are on-
board each submarine during its sea trials. In addition, the submarine
Navy conducts annual training, revisiting major mishaps and lessons
learned, including THRESHER and CHALLENGER.
NAVSEA uses the THRESHER loss as the basis for annual mandatory
training. During training, personnel watch a video on the THRESHER,
listen to a two-minute long audio tape of a submarine's hull
collapsing, and are reminded that people were dying as this occurred.
These vivid reminders, posters, and other observances throughout the
submarine community help maintain the safety focus, and it continually
renews our safety culture. The Navy has a traditional military
discipline and culture. The NAVSEA organization that deals with
submarine technology also is oriented to compliance with institutional
policy requirements. In the submarine Navy there is a uniformity of
training, qualification requirements, education, etc., which reflects a
single mission or product line, i.e., building and operating nuclear
powered submarines.
SUBSAFE CERTIFICATION PROCESS
SUBSAFE certification is a process, not just a final step. It is a
disciplined process that brings structure to our new construction and
maintenance programs and leads to formal authorization for unrestricted
operations. SUBSAFE certification is applied in four areas:
Design,
Material,
Fabrication, and
Testing.
Certification in these areas applies both to new construction and
to maintenance throughout the life of the submarine.
The heart of the SUBSAFE Program and its certification processes is
a combination of Work Discipline, Material Control, and Documentation:
Work discipline demands knowledge of the requirements
and compliance with those requirements, for everyone who
performs any kind of work associated with submarines.
Individuals have a responsibility to know if SUBSAFE impacts
their work.
Material Control is everything involved in ensuring
that correct material is installed correctly, beginning with
contracts that purchase material, all the way through receipt
inspection, storage, handling, and finally installation in the
submarine.
Documentation important to SUBSAFE certification
falls into two categories:
Selected Record Drawings and Data: Specific design
products are created when the submarine is designed.
These products consist of documents such as system
diagrams, SUBSAFE Mapping Drawings, Ship Systems
Manuals, SUBSAFE certification Boundary Books, etc.
They must be maintained current throughout the life of
the submarine to enable us to maintain SUBSAFE
certification.
Objective Quality Evidence (OQE): Specific work
records are created when work is performed and consist
of documents such as weld forms, Non-Destructive
Testing forms, mechanical assembly records, hydrostatic
and operational test forms, technical work documents in
which data is recorded, waivers and deviations, etc.
These records document the work performed and the
worker's signature certifying it was done per the
requirements. It is important to understand that
SUBSAFE certification is based on objective quality
evidence. Without objective quality evidence there is
no basis for certification, no matter who did the work
or how well it was done. Objective quality evidence
provides proof that deliberate steps were taken to
comply with requirements.
The basic outline of the SUBSAFE certification process is as
follows:
SUBSAFE requirements are invoked in the design and
construction contracts for new submarines, in the work package
for submarines undergoing depot maintenance periods, and in the
Joint Fleet Maintenance Manual for operating submarines.
Material procurement and fabrication, overhaul and
repair, installation and testing generate objective quality
evidence for these efforts. This objective quality evidence is
formally and independently reviewed and approved to assure
compliance with SUBSAFE requirements. The objective quality
evidence is then retained for the life of the submarine.
Formal statements of compliance are provided by the
organizations performing the work and by the government
supervising authority responsible for the oversight of these
organizations. All organizations performing SUBSAFE work must
be evaluated, qualified and authorized in accordance with
NAVSEA requirements to perform this work. A Naval Supervising
Authority, assigned to each contractor organization, is
responsible to monitor and evaluate contractor performance.
Audits are conducted to examine material, inspect
installations and review objective quality evidence for
compliance with SUBSAFE requirements.
For new construction submarines and submarines in
major depot maintenance periods, the assigned NAVSEA Program
Manager uses a formal checklist to collect specific
documentation and information required for NAVSEA Headquarters
certification. When all documentation has been collected,
reviewed and approved by the Technical Authority and the
SUBSAFE Office, the Program Manager formally presents the
package to the Certifying Official for review and certification
for sea trials. For new construction submarines, the formal
presentation of the certification package is made to the
Program Executive Officer for Submarines, and for in-service
submarines completing a major depot maintenance period the
certification package is formally presented to the Deputy
Commander for Undersea Warfare. Approval by the Certifying
Official includes verification of full concurrence, as well as
discussion and resolution of dissenting opinions or concerns.
After successful sea trials, a second review is performed prior
to authorizing unrestricted operations for the submarine.
SUBSAFE CERTIFICATION MAINTENANCE
Once a submarine is certified for unrestricted operation, there are
two elements, in addition to audits, that we use to maintain the
submarine in a certified condition. They are the Re-Entry Control
Process and the Unrestricted Operation/Maintenance Requirement Card
(URO/MRC) Program.
Re-entry Control is used to control work within the SUBSAFE
Certification Boundary. It is the backbone of certification maintenance
and continuity. It provides an identifiable, accountable and auditable
record of work performed within the SUBSAFE boundary. The purpose is to
provide positive assurance that all SUBSAFE systems and components are
restored to a fully certified condition. Re-entry control procedures
help us maintain work discipline by identifying the work to be
performed and the standards to be met. Re-entry control establishes
personal accountability because the personnel authorizing, performing
and certifying the work and testing must sign their names on the re-
entry control documentation. It is the process we use to collect the
OQE that supports certification.
The Unrestricted Operation/Maintenance Requirement Card (URO/MRC)
Program facilitates planned periodic inspections and tests of critical
equipment, systems, and structure to ensure that they have not degraded
to an unacceptable level due to use, age, or environment. The URO/MRC
Program provides the technical basis for authorizing continued
unrestricted operations of Navy submarines. The responsibility to
complete URO/MRC inspections is divided among multiple organizations.
Some inspections can only be completed by a shipyard during a
maintenance period. Other inspections are the responsibility of an
Intermediate Maintenance Activity or Ships Force. NAVSEA manages the
program by tracking performance to ensure that periodicity requirements
are not violated, inspections are not missed, and results meet invoked
technical requirements.
AUDITS
A key element of certification and certification maintenance is the
audit program. The audit program was established in 1963. During
testimony before Congress Admiral Curtze stated: ``To ensure the
adequacy of the application of the quality assurance programs in
shipyards a system of audits has been established.. . .'' This system
of audits is still in place today. There are two primary types of
audits: Certification Audits and Functional Audits.
In a SUBSAFE CERTIFICATION Audit we look at the Objective Quality
Evidence associated with an individual submarine to ensure that the
material condition of that submarine is satisfactory for sea trials and
unrestricted operations. These audits are performed at the completion
of new construction and at the end of major depot maintenance periods.
They cover a planned sample of specific aspects of all SUBSAFE work
performed, including inspection of a sample of installed equipment. The
results and resolution of deficiencies identified during such audits
become one element of final NAVSEA approval for sea trials and
subsequent unrestricted operations.
In a SUBSAFE FUNCTIONAL Audit we periodically review the policies,
procedures, and practices used by each organization, including
contractors, that performs SUBSAFE work, to ensure that those policies,
procedures and practices comply with SUBSAFE requirements, are healthy,
and are capable of producing certifiable hardware or design products.
This audit also includes surveillance of actual work in progress.
Organizations audited include public and private shipyards, engineering
offices, the Fleet, and NAVSEA headquarters.
In addition to the audits performed by NAVSEA, our shipyards, field
organizations and the Fleet are required to conduct internal (or self)
audits of their policies, procedures, and practices and of the work
they perform.
SUBSAFE ORGANIZATIONAL RELATIONSHIPS
The SUBSAFE Program maintains a formal organizational structure
with clear delineation of responsibilities in the SUBSAFE Requirements
Manual. Ultimately, the purpose of the SUBSAFE Organization is to
support the Fleet. We strongly believe that our sailors must be able to
go to sea with full confidence in the safety of their submarine. Only
then will they be able to focus fully on their task of operating the
submarine and carrying out assigned operations successfully.
There are three key elements in our Headquarters organization:
Technical Authority, Program Management and Submarine Safety and
Quality Assurance. Each of these elements is organizationally
independent and has specifically defined roles in the SUBSAFE Program.
NAVSEA Technical Authority provides technical direction and
assistance to Program Managers and the Fleet. In our terms, Technical
Authority is the authority, responsibility and accountability to
establish, monitor and approve technical products and policy in
conformance to higher tier policy and requirements. Technical
authorities are warranted (formally given authority) within NAVSEA and
our field organizations. Technical warrant holders are subject matter
experts. Within the defined technical area warranted, they are
responsible for establishing technical standards, entrusted and
empowered to make authoritative decisions, and held accountable for the
technical decisions made. Where technical products are not in
conformance with technical policy, standards and requirements, warrant
holders are responsible to identify associated risks and approve non-
conformances (waivers or deviations) in a manner that ensures risks are
acceptable. NAVSEA is accustomed to evaluating risk; however, non-
conformances are treated as an exception vice the norm. Full discussion
of technical issues is required before making decisions. Discussions
and decisions are coordinated with the Program Management and Submarine
Safety and Quality Assurance Offices. However, NAVSEA 05, Ship Design,
Integration and Engineering, is the final authority for the technical
requirements of the SUBSAFE Program.
Within the Undersea Warfare Directorate (NAVSEA 07)
the Director, Submarine Hull, Mechanical and Electrical
Engineering Management Division (NAVSEA 07T) is the warranted
technical authority and provides system engineering and support
for submarine technical SUBSAFE issues.
Submarine Program Managers manage all aspects of assigned submarine
programs in construction, maintenance and modernization, including
oversight of cost, schedule, performance and direction of life cycle
management. They are responsible and accountable to ensure compliance
with the requirements of the SUBSAFE Program and with technical policy
and standards established by the technical authority.
The Submarine Safety and Quality Assurance Office (NAVSEA 07Q)
manages the SUBSAFE program and audits organizations performing SUBSAFE
work to ensure compliance with SUBSAFE requirements. NAVSEA 07Q is the
primary point of contact within NAVSEA Headquarters in all matters
relating to SUBSAFE Program policy and requirements.
In addition, several groups and committees have been formally
constituted to provide oversight of and guidance to the SUBSAFE Program
and to provide a forum to evaluate and make changes to the program:
The SUBSAFE Oversight Committee (SSOC) provides
independent command level oversight to ensure objectives of the
SUBSAFE Program are met. Members are of Flag rank and represent
NAVSEA Directorates (SEA 09, PEO-SUB, SEA 05, SEA 04, SEA 07)
and the Navy Inventory Control Point.
The SUBSAFE Steering Task Group (SSSTG) was
established based on results of the THRESHER investigation to
ensure adequate provision of safety features in current and
future submarine construction, conversion, and major depot
availability programs. The SSSTG defines the scope of the
SUBSAFE Program, reviews program progress and approves or
disapproves proposed policy changes. Members include Admirals,
Senior Executive Service members and other senior civilian
managers with direct SUBSAFE and technical responsibilities, as
well as the Submarine Program Managers.
The SUBSAFE Working Group (SSWG) consists of SUBSAFE
Program Directors from Headquarters, shipyards, field
organizations, and the Fleet. The Working Group meets formally
twice a year to provide a forum to discuss and evaluate SUBSAFE
Program progress, implementation and proposals for improvement.
SUBSAFE Program Directors are the focal point for SUBSAFE
matters and are responsible and accountable for implementation
and proper execution of the SUBSAFE Program within their
respective organizations. They maintain close liaison with
NAVSEA 07Q to present or obtain information relative to SUBSAFE
issues.
SUBSAFE CERTIFICATION RELATIONSHIPS
As described earlier in this testimony, each NAVSEA organization is
assigned separate responsibility and authority for SUBSAFE Program
requirements and compliance. Our technical authority managers are
empowered and accountable to make disciplined technical decisions. They
are formally given the authority, responsibility and accountability to
establish, monitor and approve technical products and policy. The
Submarine Program Managers are responsible for executing the SUBSAFE
Program for assigned submarines in new construction and major depot
availabilities. They have the authority, responsibility and
accountability to ensure compliance with technical policy and standards
established by cognizant technical authority. NAVSEA 07Q, Submarine
Safety and Quality Assurance Office, is responsible and accountable for
implementation and management of the SUBSAFE Program and for ensuring
compliance with SUBSAFE Program requirements.
The ultimate certification authority is the Program Executive
Officer for Submarines (PEO SUB) for new construction and the Deputy
Commander for Undersea Warfare (NAVSEA 07) for major depot
availabilities. The Program manager, with the concurrence of and in the
presence of the technical authority representative (NAVSEA 07T) and the
SUBSAFE office (NAVSEA 07Q), presents the certification package with
which he attests that the SUBSAFE material condition of the submarine
is satisfactory for sea trials or for unrestricted operation. Each of
the participants has the authority to stop the certification process
until an identified issue is satisfactorily resolved.
NAVSEA PERSONNEL
Our nuclear submarines are among the most complex weapon systems
ever built. They require a highly competent and experienced technical
workforce to accomplish their design, construction, maintenance and
operation. In order for NAVSEA to continue to provide the best
technical support to all aspects of our submarine programs, we are
challenged to recruit and maintain a technically qualified workforce.
In 1998, faced with downsizing and an aging workforce, NAVSEA initiated
several actions to ensure we could meet current and future challenges.
We refocused on our core competencies, defined new engineering
categories and career paths, and obtained approval to infuse our
engineering skill sets with young engineers to provide for a systematic
transition of our workforce. We hired over 1000 engineers with a net
gain of 300. This approach allowed our experienced engineers to train
and mentor young engineers and help NAVSEA sustain our core
competencies. Despite this limited success, mandated downsizing has
continued to challenge us. I remain concerned about our ability, in the
near future, to provide adequate technical support to, and quality
overview of our submarine construction and maintenance programs.
NASA/NAVY BENCHMARKING EXCHANGE (NNBE)
The NASA/NAVY Benchmarking Exchange effort began activities in
August 2002 and is ongoing. The NNBE was undertaken to identify
practices and procedures and to share lessons learned in the Navy's
submarine and NASA's human space flight programs. The focus is on
safety and mission assurance policies, processes, accountability, and
control measures. To date, nearly all of this effort has involved the
Navy describing our organization, processes and practices to NASA. The
NNBE Interim report was completed December 20, 2002.
Phase-2 was initiated in January 2003 with 40 NAVSEA personnel
spending a week at the Kennedy Space Center (January 13-17) being
briefed on a wide array of topics related to the manufacturing,
processing, and launch of the Space Shuttle with emphasis on safety,
compliance verification, and safety certification processes. A follow-
up trip to Kennedy Space Center and a trip to Johnson Space Center were
scheduled for early February 2003. After loss of Columbia, the NAVSEA
benchmarking of NASA activity was placed on hold until October when 18
NAVSEA software experts were hosted by their NASA counterparts for a
week of meetings at Kennedy Space Center and Johnson Space Center. It
should also be noted that Naval Reactors hosted 45 senior NASA managers
for a ``Challenger Launch Decision'' training seminar at the Washington
Naval Yard on May 15.
Three Memoranda of Agreement (MOA) have been developed to formalize
NASA/NAVSEA ongoing collaboration. The first, recently signed,
establishes a sharing of data related to contractor and supplier
quality and performance. The second MOA, in final preparation,
establishes the basis for reciprocal participation in functional
audits. The third MOA, also in final preparation, will establish
reciprocal participation in engineering investigations and analyses.
In conclusion, let me reiterate that since the inception of the
SUBSAFE Program in 1963, the Navy has had a disciplined process that
provides MAXIMUM reasonable assurance that our submarines are safe from
flooding and can recover from a flooding incident. In 1988, at a
ceremony commemorating the 25th anniversary of the loss of THRESHER,
the Navy's ranking submarine officer, Admiral Bruce Demars, said: ``The
loss of THRESHER initiated fundamental changes in the way we do
business, changes in design, construction, inspections, safety checks,
tests and more. We have not forgotten the lesson learned. It's a much
safer submarine force today.''
Biography for Rear Admiral Paul E. Sullivan
United States Navy, Deputy Commander for Ship Design Integration
and Engineering, Naval Sea Systems Command
Rear Admiral Sullivan is a native of Chatham, N.J. He graduated
from the U.S. Naval Academy in 1974 with a Bachelor of Science Degree
in Mathematics.
Following graduation, Rear Adm. Sullivan served aboard USS Detector
(MSO 429) from 1974 to 1977, where he earned his Surface Warfare
Qualification.
Rear Adm. Sullivan then attended the Massachusetts Institute of
Technology (MIT), where he graduated in 1980 with dual degrees of
Master of Science (Naval Architecture and Marine Engineering) and Ocean
Engineer. While at MIT, he transferred to the Engineering Duty Officer
Community.
Rear Adm. Sullivan's Engineering Duty Officer tours prior to
command include Ship Superintendent, Docking Officer, Assistant Repair
Officer and Assistant Design Superintendent at Norfolk Naval Shipyard,
where he completed his Engineering Duty Officer qualification; Deputy
Ship Design Manager for the Seawolf class submarine at Naval Sea
Systems Command (NAVSEA), where he completed his submarine
qualification program; Associate Professor of Naval Architecture at
MIT; Ohio (SSBN 726) Class Project Officer and Los Angeles (SSN 688)
Class Project Officer at Supervisor of Shipbuilding, Groton, Conn.;
Team Leader for Cost, Producibility, and Cost and Operational
Effectiveness Assessment (COEA) studies for the New Attack Submarine at
NAVSEA; and the Director for Submarine Programs on the staff of the
Assistant Secretary of the Navy (Research, Development and
Acquisition).
Rear Adm. Sullivan served as Program Manager for the Seawolf Class
Submarine Program (PMS 350) 1995 to 1998. During his tenure, the
Seawolf design was completed, and the lead ship of the class was
completed, tested at sea, and delivered to the Navy.
In September 1998, Rear Adm. Sullivan relieved as Program Manager
for the Virginia Class Submarine Program (PMS 450). During his tour the
contract for the Virginia Class Submarine Program was signed,
construction was initiated on the first four submarines, and most of
the Virginia design was completed. In September 2001 he reported to his
current assignment as Deputy Commander for Ship Design Integration and
Engineering, Naval Sea Systems Command. Rear Adm. Sullivan's awards
include the Legion of Merit (two awards), the Meritorious Service Medal
(four awards), the Navy Commendation Medal (two awards) and the Navy
Achievement Medal.
Chairman Boehlert. Thank you very much, Admiral Sullivan.
Mr. Johnson.
STATEMENT OF MR. RAY F. JOHNSON, VICE PRESIDENT, SPACE LAUNCH
OPERATIONS, THE AEROSPACE CORPORATION
Mr. Johnson. Thank you. Mr. Chairman, distinguished
Committee Members, and staff, I am pleased to have the
opportunity to describe the capabilities of The Aerospace
Corporation as they relate to organizational and management
``best practices'' of successful safety and mission assurance
programs.
I will discuss the Committee's questions as outlined in the
invitation letter, but first, I would like to present an
overview of Aerospace and specifically what we do for the Air
Force in the area of launch readiness verification.
The Aerospace Corporation is a private, non-profit,
California corporation that was created in 1960 at the
recommendation of Congress to provide research, development,
and advisory services to the U.S. Government in the planning
and acquisition of space, launch, and ground systems and their
related technologies.
As its primary activity, Aerospace operates a Federally
Funded Research and Development Center, or FFRDC, sponsored by
the Undersecretary of the Air Force and managed by the Space
and Missile Systems Center, or SMC, in El Segundo, California.
Our principal tasks are systems planning, systems engineering,
integration, flight readiness verification, operations support,
and anomaly resolution for DOD, Air Force, and National
Security Space systems. Independent launch verification is a
core competency of Aerospace, as defined in its charter. As
such, Aerospace is directly accountable to SMC for the
verification of launch readiness. The verification begins as
early as the concept and requirement definition phase of most
programs and continues through flight operations. This
assessment includes things such as design, qualification,
fabrication, acceptance, software, mission analysis,
integration, and test.
Prior to any launch, Aerospace provides a letter to SMC
documenting the results of the launch verification process,
confirming the flight readiness of the launch vehicle. This
letter is not just a formality but represents the culmination
of a long and rigorous assessment that draws upon the
collective expertise of scientists and engineers within the
program office and engineering staff.
Now I will address the Committee's specific questions. The
first question: ``What does it mean for a safety program to be
``independent''? How is your organization structured to ensure
its independence?''
The Government's requirement for the Aerospace FFRDC
mission requires complete objectivity and freedom from conflict
of interest; a highly expert staff, full access to all space
programs and contractor data sources; special simulation,
computational, laboratory, and diagnostic facilities; and
continuity of effort that involves detailed familiarity with
the sponsor's programs, past experience, and future needs.
Although the Aerospace program offices are co-located with
the Air Force programs, they are separate organizations with
their own management structure. Technical recommendations are
worked up through Aerospace management and are then presented
to the Air Force.
The second question was: ``Given that more can always be
done to improve safety, how can you ensure that your safety
program is independent and vigilant, and that it won't prevent
the larger organization from carrying out its duties?''
Aerospace recognizes its obligation to identify issues in a
timely manner and to keep the Air Force aware of any technical
issues that may impact the overall program. The launch
verification process is involved with all phases of the program
and is not merely a final assessment that is done just prior to
launch. While our technical rigor can identify otherwise
unobserved risks, the entire team must work together to allow
the larger organization to carry out its duties to achieve
flight worthiness certification and a successful mission.
The third question was: ``How do you ensure that the
existence of Aerospace's mission assurance program and
independent launch verification process does not allow the
larger organization that it serves to feel that it is absolved
of its responsibility for safety?''
Final flight worthiness certification is the responsibility
of the SMC Commander. At the final flight readiness review, the
Commander receives input from several organizations prior to
giving the GO to proceed with launch processing. The Commander
receives inputs from the Air Force Mission Director, the launch
vehicle program managers, the launch ranges, the SMC Chief
Engineer, prime contractors, the spacecraft program managers,
The Aerospace Corporation, and also his Independent Readiness
Review Team.
Aerospace is directly accountable to SMC for the
verification of launch readiness. The ultimate GO/NO-GO launch
decision rests with the SMC Commander, not Aerospace. However,
the Air Force relies heavily on our readiness assessment in
building confidence in the final decision.
And the final question is: ``How do you ensure that
dissenting opinions are offered without creating a process that
can never reach closure?''
The verification process includes all stakeholders at major
decision points and milestones. Individuals with dissenting
opinion are heard and we make every effort to assure our
positions are based on sound engineering practices backed up by
factual data. Management encourages the sharing of all points
of view and has the responsibility for ultimately deciding on a
final recommendation. When a pure technical solution is not
possible, the Air Force is provided with a risk assessment that
outlines the degree of risk associated with each course of
action.
In closing, our success depends largely on the close,
intimate relationship we have with our government customers. We
are physically integrated and programmatically aligned with our
customers. It is this totally integrated approach that allows
Aerospace to use its technical and scientific skills in support
of the National Security Space Program.
Thank you for the opportunity to describe The Aerospace
Corporation, its launch verification program, and contributions
to mission success.
I stand ready to provide any further data or discussions
that the Committee may require.
Thank you.
[The prepared statement of Mr. Johnson follows:]
Prepared Statement of Ray F. Johnson
Mr. Chairman, distinguished Committee Members and Staff:
I am pleased to have the opportunity to describe the capabilities
of The Aerospace Corporation as they relate to organizational and
management ``best practices'' of successful safety and mission
assurance programs. Aerospace is truly a unique organization. Our
capabilities, core competencies and practices are the result of 43
years of operating a Federally Funded Research and Development Center
(FFRDC) for the National Security Space program.
I will discuss the committee's questions as outlined in the
invitation letter, but first I would like to present an overview of
Aerospace and specifically what we do for the Air Force in the area of
launch readiness verification.
The nature and value of The Aerospace Corporation
The Aerospace Corporation is a private, nonprofit corporation,
headquartered in El Segundo, California. It was created in 1960 at the
recommendation of Congress and the Secretary of the Air Force to
provide research, development and advisory services to the U.S.
government in the planning and acquisition of space, launch and ground
systems and their related technologies. The key features of Aerospace
are that we provide a stable, objective, expert source of engineering
analysis and advice to the government, free from organizational
conflict of interest. We are focused on the government's best
interests, with no profit motive or predilection for any particular
design or technical solution.
As its primary activity, Aerospace operates an FFRDC sponsored by
the Under Secretary of the Air Force, and managed by the Space and
Missile Systems Center (SMC) in El Segundo, California. Our principal
tasks are systems planning, systems engineering, integration, flight
readiness verification, operations support and anomaly resolution for
the DOD, Air Force, and National Security Space systems. Through our
comprehensive knowledge of space systems and our sponsor's needs, our
breadth of staff expertise, and our long term, stable relationship with
the DOD, we are able to integrate technical lessons learned across all
military space programs and develop systems-of-systems architectures
that integrate the functions of many separate space and ground systems.
Aerospace does not compete with industry for government contracts,
and we do not manufacture products. The government relies on Aerospace
for objective development of pre-competitive system specifications, and
impartial evaluation of competing concepts and engineering hardware
developments, to ensure that government procurements can meet the
military user's needs in a cost-and-performance-effective manner.
Aerospace employs about 3,450 people, of whom 2,400 are scientists
and engineers with expertise in all aspects of space systems
engineering and technology. The professional staff includes a large
majority, 74 percent, with advanced degrees, with 29 percent holding
Ph.D.s. The average experience of Members of the Technical Staff (MTS)
is more than 25 years. We recruit more than two-thirds of our technical
staff from experienced industry sources and the rest from new
graduates, university staff, other nonprofit organizations, government
agencies, and internal degree programs.
Aerospace has maintained a 43-year strategic partnership with the
DOD and the National Security Space community, developing a data and
experience base that covers virtually every military space program
since 1960. We have evolved an unparalleled set of engineering design,
analysis and systems simulation tools, along with computational,
diagnostic test, and research facilities in critical space-specific
disciplines that are used in day-to-day support of government space
system programs.
Aerospace is the government's integral engineering arm for National
Security Space systems architecture and engineering. As such, Aerospace
has broad access to intelligence information, government requirements
development, all programs and contractors' proprietary data and
processes, and the full scope of government program planning
information. We translate the requirements dictated by Congress and the
military and national security management into engineering
specifications that form the basis for competitive Request for
Proposals (RFPs) to industry. We evaluate contractor technical designs
and performance, and provide continuing technical insight and progress
assessment for the government program manager throughout the
engineering development, test and initial operation phases of space
systems. In order to do this, Aerospace must have technical experience
and breadth at least equal to the industrial firms we evaluate. I am
extremely proud of the quality and performance record of our staff, as
evidenced by the outstanding success record of the space launches and
satellite systems Aerospace has technically supported on behalf of its
government sponsors.
The Aerospace technical program office MTS are supported by a
matrix of 1,000 engineering and scientific specialists in every
discipline relevant to space systems, with extensive laboratory and
diagnostic facilities. Typically, an expert in a particular field--
propulsion, microelectronics, or infrared sensors, for example--will
work on several programs during the course of a year, as each program
has a need for a particular skill depending on its program phase. This
approach permits Aerospace to develop and maintain state-of-the-art
analytical and simulation models and test facilities that could not be
afforded by a single program or contractor, but are efficiently used as
needed by all programs.
Aerospace systems engineering currently supports 29 satellite
programs, 8 launch vehicle boosters, and 13 ground station elements for
the DOD and National Security customers. Our functions can be
summarized as follows, covering the entire system acquisition process:
planning and systems studies--pre-competitive systems
definition
trade-offs and simulations of system requirements to
help prioritize user needs
technical RFPs and technical evaluation of proposals
early detection of development problems and timely
identification of alternative solutions, to preserve schedule,
cost and performance
independent analysis, verification, and validation of
data and performance to assure mission success
launch verification and readiness assessments
(boosters, satellites and ground systems)
launch and on-orbit operations and work-arounds
Aerospace's launch readiness verification process
Independent launch readiness verification is a core competency of
Aerospace as defined in our charter as an FFRDC supporting the Air
Force. As such, Aerospace is directly accountable to SMC for
verification of launch readiness. This responsibility is vested within
the Space Launch Operations program offices and executed using our
launch readiness verification process.
Prior to any launch, Aerospace provides a letter to SMC documenting
the results of the launch verification process, confirming flight
readiness of the launch vehicle. This letter is not just a formality,
but represents the culmination of a long and rigorous assessment that
draws upon the collective expertise of scientists and engineers within
the program office and the engineering staff. The launch readiness
verification letter provided by the Aerospace Vice President of Space
Launch Operations to the Air Force was first introduced in the late
1970s to document our corporate commitment to mission success. This
formal launch readiness verification provides assurance that all known
technical issues have been assessed and resolved, residual launch risks
have been satisfactorily assessed, and establishes confidence in launch
mission success. The ultimate GO/NO-GO launch decision and flight
worthiness certification rests with SMC, not Aerospace, however, the
Air Force relies heavily on our readiness assessment in building
confidence in its final decision.
The process used to independently determine launch system flight
readiness is a capability that has evolved over 40 years. Aerospace's
role in independent launch readiness verification began with the
Mercury-Atlas program in 1960, shortly after the corporation was
founded. The Project Mercury launch vehicle had suffered two failures
and a turnaround in reliability was required before human space flight
could be attempted. The risk reduction techniques that Aerospace
developed were instrumental in achieving mission success. Since then,
we have applied this process to the design, development, and operation
of more than 600 launches including all Atlas, Delta, Inertial Upper
Stage, and Titan launch vehicle variants resulting in a proven track
record of reducing launch risk.
The fundamental features of our launch readiness verification have
been the same since first employed. Verification begins as early as the
concept and requirements definition phase of most programs and
continues through flight operations. Launch verification certification
and readiness assessments include design, qualification, fabrication,
acceptance, software, mission analysis, integration and test. Thorough
launch readiness verification requires a detailed review by Aerospace
staff of thousands of components, procedures, and test reports to
verify flight readiness. Independent models are developed and
maintained by Aerospace domain experts and exercised to validate and
verify the contractors' results. Resident Aerospace engineers are
involved in all aspects of the launch campaign from manufacture through
launch site operations. Launch readiness verification is a closed loop
process via post flight analyses that use the independent analytical
tools and independently acquired and processed flight telemetry data to
provide feedback into the engineering design process, capture lessons
learned, monitor trends, and establish a basis for proceeding into the
next launch cycle.
To accomplish the entire spectrum of launch readiness verification
requires that Aerospace retain a diverse cadre of skilled engineers
with expertise in a wide variety of disciplines including systems
engineering, mission integration, structures and mechanics, structural
dynamics, guidance and control, power and electrical, avionics,
telemetry, safety, flight mechanics, environmental testing, computers,
software, product assurance, propulsion, fluid mechanics, aerodynamics,
thermal, ground systems, facilities and operations. Our major objective
is to retain the necessary skills and expertise needed to support
planned as well as unexpected events.
The launch readiness verification process was reinvigorated in the
late 1990s following a series of launch failures. Among the
observations of the Space Launch Broad Area Review were that the root
cause was the lack of disciplined system engineering in the design and
processing of launch vehicles exacerbated by a premature dismantling of
government oversight capability, particularly the engineering support
capabilities; that space launch needed to re-establish clear lines of
authority and accountability; that space launch is inherently more
engineering intensive than other operational systems; and that properly
conducted independent review is an essential element of mission
success.
Now, I will address the committee's specific questions:
1. What does it mean for a safety program to be ``independent?'' How
is your organization structured to ensure its independence?
The government's requirement for the Aerospace FFRDC mission
requires complete objectivity and freedom from conflict of interest; a
highly expert staff; full access to all space programs and contractor
data sources; special simulation, computational, laboratory and
diagnostic facilities; and continuity of effort that involves detailed
familiarity with the sponsor's programs, past experience, and future
needs. We are focused on the government's best interests, with no
profit motive or predilection for any particular design or technical
solution.
Although the Aerospace program offices are co-located with the Air
Force programs, they are separate organizations with their own
management structure. Technical recommendations are worked up through
Aerospace management and are then presented to the Air Force. In
addition to the launch verification letter, a formal launch readiness
briefing is given to the Aerospace president. At this review, our
president confirms that our technical analyses are thorough and
objective, and our recommendations are based on sound engineering
principles. Although the Aerospace launch readiness verification
products are produced independently from those of the prime contractor,
we also employ another independent review organization that reports to
the SMC Commander. This independent review team also briefs our
president on its findings to ensure that our process has yielded
acceptable risks. This review is conducted just prior to the SMC
Commander's Flight Readiness Review (FRR). The Aerospace president is
polled during the Commander's FRR for his concurrence to proceed with
final launch processing.
2. Given that more can always be done to improve safety, how do you
ensure that your safety program is independent and vigilant, but that
it won't prevent the larger organization from carrying out its duties?
The key elements here are teamwork, technical rigor, and a goal for
100 percent mission success. Aerospace program offices are co-located
with the Air Force programs and Aerospace engineers are in daily
contact with their Air Force counterparts. Aerospace recognizes our
obligation to identify issues in a timely manner and to keep the Air
Force aware of any technical issues that may impact the overall
program. The launch readiness verification process is involved with all
phases of the program and is not merely a final assessment that is
performed just prior to launch. The failures of 1998 and 1999 were in
part due to ineffective teamwork. All successes since then can be
attributed to a complete team effort among Aerospace, the Air Force,
and the contractors. All team members understand and respect the value
of the individual responsibilities and contributions. While vigilance
and independence can identify otherwise unobserved risks, the entire
team must work together to allow the larger organization to carry out
its duties to achieve flight worthiness certification and a successful
mission.
Just as important as teamwork is the technical rigor employed in
the process to reach certification. We employ a well-defined launch
readiness verification process with individual responsibilities and
accountability. The burden of proof requires a positive demonstration
that a system is flight-worthy, rather than proving that an anomalous
condition will cause a flight failure. The launch readiness
verification process is part of an overarching flight readiness
process. Many unforeseen events occur during each launch campaign that
must be acted upon. The process rigor that we employ assures that no
single event or issue is overlooked or prematurely closed. With 100%
focus on mission success, the technical rigor and commitment by each
team member enhances the larger organization decision process.
3. How do you ensure that the existence of Aerospace's mission
assurance program and independent launch verification process does not
allow the larger organization that it serves to feel that it is
absolved of responsibility for safety?
Final flight worthiness certification is the responsibility of the
SMC Commander. At the final FRR, the Commander receives input from
several organizations prior to giving the GO to proceed with launch
processing. The Commander receives input from the Air Force Mission
Director, launch vehicle program managers, launch ranges, SMC Chief
Engineer, prime contractors, spacecraft program managers, Aerospace,
and the Independent Readiness Review Team (IRRT).
Aerospace is directly accountable to SMC for the verification of
launch readiness. Our task is to independently confirm readiness of the
launch vehicle, assess mission risks, and assure that all risks are
acceptably low to enter into launch. The ultimate GO/NO-GO launch
decision rests with the SMC Commander, not Aerospace; however, the Air
Force relies heavily on our readiness assessment in building confidence
in the final decision.
4. How do you ensure that dissenting opinions are offered without
creating a process that can never reach closure?
The verification process includes all stakeholders at major
decision points and milestones. Dissenting opinions are heard and data
is required to resolve engineering issues. Aerospace makes every effort
to ensure that our positions are based on sound engineering practices
backed up by factual data. Aerospace's engineering staff objectively
develops their technical recommendations and supporting analyses that
are then coordinated with the Aerospace program offices and management.
Management encourages the sharing of all points of view and is
responsible for ultimately deciding on a final recommendation. When an
issue is well founded in science and engineering, the path forward is
usually identifiable, e.g., additional inspections, tests, analyses,
etc. For issues that do not have concrete solutions, risks are assessed
by senior review teams based on technical data. When a ``pure''
technical solution is not possible, the Air Force is provided with a
risk assessment that outlines the degree of risk associated with each
course of action.
As I mentioned previously, the independent launch readiness
verification end-to-end system review process culminates in a launch
readiness assessment for each mission. A formal flight readiness
certification provides assurance that all known technical issues have
been assessed and resolved, residual launch risks have been
satisfactorily assessed and confidence in launch mission success has
been established as acceptable. It is this process, as outlined in the
following figure, that ensures acceptable closure of every issue.
I would like to leave you with some concluding summary thoughts:
Aerospace is focused on the success of its sponsor's
mission
Aerospace is the integral space systems engineering
arm of the Air Force and National Security Space program
The key to Aerospace's value and effectiveness is our
process of systems engineering:
-- stable, objective, expert advice backed by analysis
and experiment
-- a trusted partner with our sponsors and industry
-- breadth and depth of staff in all space disciplines
-- access to sensitive planning and proprietary data
-- continuity across all space programs and
technologies
-- co-location with the government customer
In closing, our success depends largely on the close, intimate
relationship we have with our government customers. We are physically
integrated and programmatically aligned with our customers. It is this
totally integrated approach that allows Aerospace to use its technical
and scientific skills in support of the National Security Space
program.
Thank you for the opportunity to describe The Aerospace
Corporation, its Launch Readiness Verification program, and
contribution to mission success.
I stand ready to provide any further data or discussions that the
Committee may require.
Biography for Ray F. Johnson
Ray F. Johnson is Vice President of Space Launch Operations, Space
Systems Group. He assumed this position on April 1, 2001.
Johnson is responsible for Aerospace support to all Air Force
launch programs including Titan II, Titan IV, Delta II, Atlas II, upper
stages and the Evolved Expendable Launch Vehicle (EELV), as well as the
Air Force Space Test Program. He has responsibility for the company's
launch operations at Cape Canaveral, Florida, and Vandenberg Air Force
Base, California, and operations in support of the Space Test Program
at Kirtland Air Force Base, New Mexico.
Johnson joined Aerospace in 1987 as a project engineer in the Titan
program office. He was promoted to manager of the Liquid Propulsion
section in 1988. He was director of the Centaur Directorate within the
Titan program office from 1990 to 1993 and was responsible for
Aerospace's support in developing the Centaur upper stage for use on
the Titan IV launch vehicle.
In November 1993 Johnson was appointed principal director of the
Vehicle Performance Subdivision, Engineering and Technology Group, with
responsibility for engineering support in the areas of propulsion,
flight mechanics, fluid mechanics, and launch vehicle and spacecraft
thermal analysis.
Before being named vice president, Johnson was general manager of
the Launch Programs Division with responsibility for managing
Aerospace's technical support to the Air Force for the Titan, Atlas and
Delta launch programs.
Prior to joining Aerospace, Johnson held a number of engineering
positions with Martin Marietta Aerospace as part of Titan launch
operations at Vandenberg AFB.
Johnson holds a B.S. degree in mechanical engineering from the
University of California at Berkeley and an MBA from the University of
Chicago. He is a registered professional engineer in the state of
California and a senior member of the American Institute of Aeronautics
and Astronautics.
The Aerospace Corporation, based in El Segundo, California, is an
independent, nonprofit company that provides objective technical
analyses and assessments for national security space programs and
selected civil and commercial space programs in the national interest.
Chairman Boehlert. Thank you very much, Mr. Johnson.
Ms. Grubbe.
STATEMENT BY MS. DEBORAH L. GRUBBE, P.E., CORPORATE DIRECTOR,
SAFETY AND HEALTH, DuPONT
Ms. Grubbe. Good morning, Mr. Chairman, Members of the
Committee. I would like to thank you for the opportunity to
testify today on the most important issue of safety.
In my work with the DuPont Company, I am a chemical
engineer by training. I also have 25 years of experience with
DuPont in engineering design, leading multi-million dollar
construction projects and running multi-million dollar
manufacturing organizations.
Today, I would like to focus my remarks on how we manage
safety in the DuPont Company. My overarching message is that
good safety practice takes committed leadership, educated
personnel, integrated safety systems, and a continuous
attention to doing the details of the work.
While DuPont has one of the best safety records in the
world, we are far from perfect. Good safety is an elusive
dynamic. When we think we are getting good, that is the time we
need to start to worry. The key is never to become complacent.
From our experience, we think there are several
organizational attributes common to successive--successful
safety organizations: number one, safety comes first, and all
organizational leadership is actively engaged in safety; number
two, standards are high, these standards are well communicated
and everyone knows what their role is; number three, our line
management is accountable for safety, every person; number
four, if the work can not be done safely, it is not done until
it can be done safely; number five, safety systems, tools, and
process are in place to support high standards and to support
implementation and people are trained.
DuPont's safety culture starts at the top of our
organization. Our Chief Executive Officer is actively engaged
in leading safety. He starts his key meetings with safety. He
insists that safety come first on every manager's and
employee's list of tasks. He expects to be notified by his
direct reports of each employee and contractor fatality or
lost-time injury within 24 hours of the event.
Any person can stop any job at any time if there is a
perceived danger. Managers and employees are expected to work
together to figure out how to do a job safely. If they need
more resources, the team obtains them and resolves the problem.
Management's role is to support the team and to help find the
safest, best solution. Safety is, and must be, a fundamental,
line management responsibility all through the organization.
Independent bodies can help and assist line managers execute
their responsibilities and monitor that execution.
Our corporate safety organization is accountable for being
the watchdog on corporate safety policy and for examining how
well DuPont executes against its own procedures. This
organization, in conjunction with business safety leaders, also
develop safety improvements. All improvements, however, are
owned and implemented by the line management structure. There
are multiple audits to ensure compliance to standards. DuPont
never stops looking for weaknesses in its safety systems.
The corporate safety organization reports to a separate
executive leader. This person does not have a specific business
or manufacturing role and is accountable for integrating safety
health and environmental excellence as a core business
strategy. His organization works with every DuPont business and
functional leader to ensure safe, injury-free operation.
Just as our CEO considers himself the ``chief safety
officer'' for DuPont, each of our managers and supervisors are
the chief safety officers of their respective organizations.
They are never relieved of their safety duties. Our collective
goal is to have every employee and every contractor that works
at our facilities leave everyday just as they arrived. We
believe that all injuries and incidents are preventable.
Complacency and arrogance are our enemies.
In summary, we believe that any organization can create a
safe work environment if it embraces and implements a core set
of organizational attributes and values, beginning with the
fundamental belief that good safety is achievable and is a core
management responsibility.
Thank you for the opportunity to share our experiences with
the Committee, and I would be happy to answer any questions.
[The prepared statement of Ms. Grubbe follows:]
Prepared Statement of Deborah L. Grubbe
I am a chemical engineer by training and have 25 years of
experience with DuPont in engineering design, construction and
operations. My current role is Corporate Director--Safety and Health.
Today I would like to focus my remarks on ``Safety at DuPont.'' In
summary, good safety practice takes committed leadership, educated
personnel, integrated safety systems, and a continuous attention to
detail.
DuPont has been in business for over 200 years. We started as a
manufacturer of black powder for the U.S. Government in 1802. DuPont
first kept injury statistics in 1912, installed an off the job safety
process in the 1950's, and worked with the U.S. Government to establish
OSHA 1910.119 in the 1980's. Even today, DuPont continues to improve
its own safety systems. In 1994, DuPont established a Goal of Zero for
injuries and incidents, and in the year 2000, decided to adopt a Goal
of Zero for soft tissue injuries like, and not limited to, carpal
tunnel syndrome and back injuries.
DuPont always strives to improve its safety performance. In fact,
safety is a precarious subject; just when you think you are good, that
is the time you should start to worry. The key is to never become
complacent. DuPont does have a leadership commitment to put safety
first and we are committed to continuous improvement throughout our
whole organization.
Safety conscious organizations hold similar organizational
attributes:
1. Safety comes first, and all organizational leadership is
actively engaged.
2. Standards are high, are well communicated, and everyone
knows their role.
3. Line management is accountable for safety.
4. If the work cannot be done safely, it is not done until it
can be done safely.
5. Safety systems, tools and processes are in place and
training is constant.
DuPont is a large organization, diverse in products, in
technologies, and in global locations. However, in spite of this
diversity, we have a single safety culture. We have an integrated,
disciplined set of beliefs, behaviors, safety systems and procedures.
The safety culture is held together by committed and visible
leadership. We ensure that our contractors also have similar management
processes in place to manage their own safety to high standards.
DuPont safety culture starts at the top of the organization. Our
CEO is actively engaged in leading safety. He starts his key meetings
with safety, and he insists that safety come first on every employee's
list. He expects to be notified by his direct reports, of each employee
lost time injury or fatality, employee or contractor, within 24 hours
of the event.
Safety at DuPont
Safety management is the unique balance of the carrot and the
stick. There must be recognition and reward, as well as serious
implications for blatant disregard of safety procedures and standards.
If a DuPont employee continuously disregards procedures, he/she
endangers his/her life, the lives of his/her colleagues, the
shareholders' investment, and the health and welfare of the communities
where we do business. We usually prefer that these kinds of people find
work somewhere else.
Any person can stop any job at anytime if there is a perceived
safety danger. Employees are trained to look out for each other and to
ensure that they and their colleagues work safely.
The corporate safety organization is accountable for being the
watchdog on corporate policy and for examining how well DuPont executes
against its own procedures. This organization, in conjunction with
business safety leaders, also develops safety improvements. All
improvements are owned and implemented by the line organization. There
are multiple audits to ensure compliance to standards. These audits can
range from a sales manager observing the driving habits of his/her
sales representatives, to an external consultant evaluating how well we
conduct our audits. The point is that DuPont never stops looking for
weaknesses in its safety systems.
The corporate safety organization reports to a separate leader.
This person does not have a specific business or manufacturing role and
is accountable for integrating safety, health and environmental
excellence as a core business strategy. His organization works with
each DuPont leader to ensure there is clear knowledge of the risks
present in his/her area, and to ensure safe, injury-free operation.
Just as our CEO considers himself the ``chief safety officer'' for
DuPont, each of our managers and supervisors are the chief safety
officers for their respective organizations. They are never relieved of
their safety duties. The safety organization in DuPont is sometimes a
consultant, sometimes a conscience, and sometimes a leader. Our
collective goal is to have every employee and every contractor that
works at our facilities leave every day just as they arrived.
In 2002, over 80 percent of our 367 global sites completed the year
with zero lost time injuries. While we are proud of the thousands of
employees and their achievements; we are not satisfied with this
performance. We believe that all injuries and incidents are
preventable. Complacency and arrogance are our enemies.
Biography for Deborah L. Grubbe
Deborah Grubbe is Corporate Director--Safety and Health for DuPont.
She is accountable for leading new initiatives in global safety and
occupational health for the $27 billion corporation. Deb was formerly
the Operations Director in two of DuPont's global businesses, where she
was accountable for manufacturing, engineering, safety, environmental
and information systems. Deborah is also a past director of DuPont
Engineering's 700 person engineering technology organization. Her 15
different assignments in 24 years range from capital project
implementation through manufacturing management and human resources.
Deborah currently serves on the National Institute of Standards and
Technology Visiting Committee for Advanced Technology. She also serves
the National Academy of Sciences as a member of the oversight committee
for the Demilitarization of U.S. Chemical Weapons Stockpile. Deborah
sits on the Board of Directors of the Engineering and Construction
Committee of the American Institute of Chemical Engineers, and is on
the Business Management Advisory Committee of Wilmington College. She
is the former co-chair of the Benchmarking and Metrics Committee of the
Construction Industry Institute, and currently serves as a member of
the Purdue University School of Chemical Engineering New Directions
Executive Committee. Deborah was the first woman and youngest elected
member on the State of Delaware Registration Board for Professional
Engineers (1985-1989). During her tenure on the State Board, she was
the Chair of the Law Enforcement and Ethics Committee. She is active
with the Society of Women Engineers, and is a former board member of
the Women in Engineering Program Advocates Network (WEPAN). Deborah has
been featured in the books ``Engineering Your Way to Success'' and
``Journeys of Women in Science and Engineering--No Universal
Constants.''
She has been active in the Delaware community; as former president
and board member of the Chesapeake Bay Girl Scout Council, and
currently sits on their Northern President's Advisory Council. Deborah
is also a board member of the Delaware Zoological Society. Deborah is a
past board member of the YWCA of New Castle County. She has served as a
Province President of her sorority, Zeta Tau Alpha, and is a recipient
of their Alumnae Certificate of Merit. In 1994, Deborah was named an
outstanding Chemical Engineering Alumna by the Purdue University School
of Chemical Engineering, and is a recipient of the 1986 Trailblazer
Award from the Delaware Alliance of Professional Women. This year, she
is a recipient of the Purdue Distinguished Engineering Alumni Award,
and has been named ``Delaware Engineer of the Year,'' by the Delaware
Engineering Society.
Deborah was born in suburban Chicago and graduated with a Bachelor
of Science in Chemical Engineering with Highest Distinction from Purdue
University. She received a Winston Churchill Fellowship to attend
Cambridge University in England, where she received a Certificate of
Post Graduate Study in Chemical Engineering. She is a registered
professional engineer in Delaware. She is married to James B. Porter,
Jr., and resides in Chadds Ford, Pennsylvania.
Discussion, Panel I
Chairman Boehlert. Thank you very much, Ms. Grubbe, and
thank all of you.
ITEA Budget Independence
Can you explain--you know, Admiral Gehman, the CAIB
Commission, if they have said it once, they have said it a
thousand times: safety has to be independent of operational
budget considerations. Can you tell me how your organizations,
particularly the Admirals', have safety truly independent of
the operational segment budgets and schedules? Ms. Grubbe and
Mr. Johnson specifically addressed those, and I would like the
Admirals to do so.
Admiral Bowman. Mr. Chairman, as I listened to Ms. Grubbe,
I heard her describing the Naval Reactors organization, also.
Many of the elements of her safety program and her operation
are identical to what I described as the Naval Reactors
organization. I specifically jotted down committed leadership,
ingrained safety culture throughout the organization, an
integrated safety system, attention to detail, safety owned by
line management, a very key point, and that the CEO feels that
he is the ``chief safety officer.'' I could just say ditto for
the Naval Reactors Program.
And this is a difference in the way I think some are
interpreting or perhaps the way the CAIB report is written.
Standby for heavy rolls here. I don't believe an organization
should have--should rely on an independent organization off to
the side to oversee safety. I believe that safety has to be
endemic to the organization. It has to be ingrained in every
person. I used the word ``mainstream.'' Our line management,
likewise, is responsible for safety in our organization. We can
not have a separate group that comes in at the end and throws
the flag on safety. Safety is a part of the day-to-day design,
the day-to-day operation, the day-to-day development of
procedures. It is who we are. It is what we are. Every person
who is responsible and reports directly to me for components
for systems for the entire reactor plant feels the
responsibility for safety.
We don't create, therefore, a tension between safety and
resources. Safety is a part of the technical line management
organization. If one were to arrange a separate safety
committee or safety group totally responsible for safety within
an organization, I believe that it would be near impossible to
avoid this tension between the schedule and the budget, the
resources that are necessary. The line management will--would
look upon that safety group as Piranhas, not invite them into
the campfire at night. They would be pulling in the opposite
direction, and I think that the correct way is to ensure that
every person within the organization understands that safety is
a part of his or her responsibility from the very beginning,
from the design and the operation.
Chairman Boehlert. You can't emphasize that enough.
Admiral Bowman. Yes, sir.
Chairman Boehlert. Like you know the old saw where if
something is everybody's business, it is nobody's business.
Admiral Bowman. Yes, sir.
Chairman Boehlert. I mean, it has to be someone. And I
think what Admiral Gehman is saying, at least in my
interpretation, is that you need people--everybody has to be
devoted to safety, but you need an operation separate from the
pressures of scheduling and looking at the calendar. ``Can we
go on the 14th?'' Or, ``Do we have to wait until the 15th?''
Or, ``Do we have enough money to go?'' Some--safety has to be
totally separate from that, according to my interpretation of
the Gehman report and then be able to enter into the equation
and say, ``Regardless of schedule, regardless of money, here is
what we think in terms of safety.''
Admiral Sullivan, do you have any thoughts on that?
Rear Admiral Sullivan. Yes, sir. I would like to start by
echoing Admiral Bowman's remarks about a culture of safety. You
can not enforce from above or from beside and catch everything.
You will always need to have everyone from the designers to the
builders to the operators raised in a culture of safety. That
is the best way to get started.
In our submarine safety program, we, in fact, have two
checks and balances on the program office, if you will. And I
have been on both sides of this. I was the Sea Wolf program
manager and the Virginia class program manager, so I have
looked at this issue from both sides. The program managers are,
in fact, driven by cost and schedule, but the technician
authority in NAVSEA is outside of the Program Manager's
organization. And the technical authority is, in fact,
independent of the Program Manager, and they are funded
separately.
The safety--submarine safety organization is also
independent of the Program Manager, so, in fact, we have two
checks and balances. And both of those organizations can put a
stop to a certification process or getting--allowing a ship to
get underway, for instance, if there is an issue. And we stop
until we get it resolved.
Waivers
Chairman Boehlert. I am going to interrupt you for a
minute, because my--the red light is on and we are trying to
stick to the five-minute rule, but I gave you a little
flexibility, so I will take a little flexibility here.
But I assume that each of you have a system for waivers,
and I would like to know, you know, at NASA they got almost
4,000 waivers, some of them--a third of them are over 10 years
old. Do you have a waiver system, Admiral Bowman and Admiral
Sullivan? I will ask you to respond to that. How many waivers
are in place, and how do you deal with the waivers?
Admiral Bowman. There are very few waivers in place in the
unforgiving technology that I deal with, the Naval Nuclear
Reactors Program. When deviations from specifications occur in
manufacturer--in production, they are brought through the
system with recommendations and analysis of the overall impact
of that deviation on the product, on the system, and on the
integrated operation of the plant. Before the decision is made
to agree to any deviation, departure from existing written
specification and manufacturer production, it is brought to me
for final approval. And we, at the table, then, go through that
process that I described earlier asking what is the impact,
what might be the impact, what is the worst that could happen
if we accept this deviation, and what are the minority
opinions. Are there people out there in the organization who
say, ``No, don't accept this product; send it back, start
over.''? We have very, very few of those. It is the--very much
the exception and not the rule.
Chairman Boehlert. So you would say maybe a handful?
Admiral Bowman. Yeah, it would be difficult for me to put a
number, sir, but----
Chairman Boehlert. Certainly not thousands?
Admiral Bowman. Not thousands.
Chairman Boehlert. And are you aware of any waivers that
might be in existence in your Program that are 10 years old?
Admiral Bowman. Deviations from manufacturing tolerances
where a manufacturing tolerance might call for something to be
between five and 10 mils and it is--in fact, it came in at four
mils, we may have those kinds of deviations in existence, but
they have been very thoroughly analyzed and determined not to
impact the----
Chairman Boehlert. Thank you.
Admiral Sullivan, would you care to comment?
Rear Admiral Sullivan. We have a similar process outside
the propulsion plant where waivers are formally submitted and
evaluated. We, too, have few waivers, and I couldn't give you
the numbers off the top of my head, but it is a disciplined,
rigorous process, and yes, the age of our submarines can be up
to--they have about a 30-year service life, but the only
waivers that are allowed to stay on a submarine permanently are
those of a similar nature to what the Admiral just described.
Chairman Boehlert. Ms. Grubbe and Mr. Johnson, I mean you
both addressed this directly in your testimony. Do you have
anything you would like to add before I go to Mr. Hall?
Mr. Johnson. Well, I was just going to add that we do have
a process of working waivers. And to give you an idea of the
typical number on a Titan 4, which is our--a fairly complex
vehicle, we have on the order of about 130 to 150 waivers that
we would be working. That has actually been driven down,
because there has been a real effort to try and reduce the
number of waivers on the vehicle. Probably about four or five
years ago, the number was more like around 400 waivers. But we
have a process that we review each one of those, provide an
engineering assessment and opinion back to the Air Force on
those.
Chairman Boehlert. Ms. Grubbe.
Ms. Grubbe. Nothing to add.
Chairman Boehlert. All right. Thank you very much.
Mr. Hall.
Managing Safety
Mr. Hall. Mr. Chairman, thank you for leading in to the--
your questions with the word safety. And I think when we think
about safety, I guess it is fair to assume that no one at NASA
or any of your organizations would deliberately seek to follow
unsafe practices. That is outrageous and ridiculous to even
think about.
However, back when we were working in the early '80's on
the Clean Air Act and worked--I think it took 12 or 13 years to
do it, there was a poll that came out that--from one of the
Members of the Congress that had sought that poll to try to
pass a stronger Clean Air Act. He had a poll that showed that
82 percent of the people wanted clean air. And I wondered about
that other 18 percent what--just what their choice was. But we
are 100 percent on safety and seeking it and wanting it and
demanding it. And I think that is what you have to do. The
problem, though, arises when the pressures to achieve these
organizational goals that you men and lady set out, I think,
reach the point where the managers and workers find themselves
making compromises to follow that schedule or to try to escape
the use of a waiver or to have to seek something other than the
100 percent perfection that you have to have when you are going
to have safety.
So--well, for example, Admiral Gehman's Investigation Board
found that the pressures exerted by NASA's top management to--
made an arbitrary date for Space Station Core Complete led to
actions being taken that wound up reducing the safety margins
of the Shuttle Program, we are told, and I believe that is
probably right, because I don't hear anybody that negates that.
So I guess I would like to ask each of you, how do you prevent
this kind of a thing from happening in your organizations? How
have--you been successful in your thrust there or you wouldn't
be here. The Chairman selected you to come and give us the best
testimony that is obtainable anywhere in the country, and you
are here, so apparently you have found a way to prevent that
from happening in your organizations. How do you ensure that
safety margins can be protected in the thrust that we are on
right now? I guess I ask any of you, and if that type of
situation does arise, how would you deal with it?
Admiral Bowman.
Admiral Bowman. Yes, sir, Mr. Hall----
Mr. Hall. Skip? They call you ``Skip,'' Admiral Bowman?
Admiral Bowman. Yes, sir, they do.
Mr. Hall. Do just the normal, ordinary, J.G. like I was 60
years ago, call--come up and said, ``Hey, Skip.'' Would that be
okay?
Admiral Bowman. No, sir. Maybe I should have said once.
Your question strikes at the very heart of what we are
talking about today. And again, I would just have to fall back
on the answer that within the Naval Reactors organization, my
line management, who are all direct reports to me, we probably
have one of the flattest organizations in this country, and
certainly within the United States Government, in that all of
my direct reports are the first line reports. There is nobody
between me and the 21 direct reports at headquarters. They all
feel responsible for safety from the beginning. So we don't
allow this competition, this competition between schedule,
costs, and safety to exist, because we built it into the system
from the design, from the redundancy, from the system
oversight, the component oversight as it is being developed.
And so we don't allow that to be a topic of conversation
that we are supposed to go on sea trials on Monday the 15th of
March and if we don't make that, it is going to be a black eye
and now we have this safety issue that has reared its ugly
head. And the answer is very simple: fix it. Fix it. We build
redundancy and safety into our systems for the Commanding
Officer of these ships to exercise at sea in battle or in
untoward situations. And it is not within my purview. I don't
even consider it to be a question that I can remove that
redundancy and that safety from him by making a decision here
in Washington, DC that makes the ship less safe before it goes
to sea.
I might add, by the way, that I ride all of the initial sea
trials on all of these ships and take the ships through all of
their evolutions the--for the very first time. So my staff is
there with me, and we are there watching the results of the
fruits of our labor. So it just doesn't come up. We don't allow
safety to be in competition with schedule and budget.
SUBSAFE
Mr. Hall. Admiral Sullivan, your experience on your SUBSAFE
thrust, give us the benefit of that.
Rear Admiral Sullivan. Yes, sir. First off, as far as
waivers coming up and getting pushed aside by the Program
Manager, the Program Manager does not have unilateral authority
to grant a waiver. He must get technical disposition and that--
and he must take a technically acceptable path to disposition
of that way. And we do not waive fundamental SUBSAFE
requirements, period. And like the Admiral said, when we have
an initial sea trial, the toughest certification is the ship
going to sea for the first time and the Program Manager also
rides.
Mr. Hall. My time is up. Briefly, Mr. Johnson or Ms.--I
called you Ms. Grubbe. Is it Ms. Grubbe?
Ms. Grubbe. Yes, sir, Grubbe.
Mr. Hall. Ms. Grubbe.
Ms. Grubbe. I would just like to add, very similarly to the
other gentlemen, that safety comes first and that anyone at any
time can stop anything. And safety does come before budget. I
find it interesting that in the collective, when over the years
as many people have dealt with safety, we find that we rarely
have money up front to do it right, but we always have lots of
money at the end to fix it once something goes wrong.
Mr. Hall. Mr. Johnson.
Crew Escape
Mr. Johnson. Just very briefly, well, first of all, our
whole purpose is a mission assurance or safety organization. We
are separate from the Air Force in that respect. We also do
have a separate management chain so we are held accountable
up--beyond the people that report directly to the Air Force
program managers that verify that--and maintain that our
mission success focus is something that we never deviate from
and never give in to the pressures of schedule and cost.
Mr. Hall. I have one more quick answer--question to ask. I
won't require anything but a yes or a no. Do you know of any
way that the parents of a person that is going to be launched
in one of our Shuttles can feel completely confident without
having an escape, modular escape vehicle?
Admiral Bowman. Sir, for my purposes, that is outside my
realm of expertise. It certainly sounds----
Mr. Hall. You are going to skip that, huh?
Admiral Bowman. It sounds like something that should be
evaluated. Absolutely.
Mr. Hall. Admiral.
Rear Admiral Sullivan. I don't have anything to add to
that, sir.
Mr. Hall. You are consistent. Go ahead, Mr. Johnson.
Rear Admiral Sullivan. It is--again, it is outside our----
Mr. Hall. Yeah.
Rear Admiral Sullivan. Outside our purview.
Mr. Hall. But it is not above your pay scale, is it?
Mr. Johnson, your answer is probably no and Ms. Grubbe,
yours is probably no. We have got to have an escape if we are
going to feel completely safe, right?
Mr. Johnson. That is correct.
Mr. Hall. That is three to two. So we are pretty--no, thank
you for your answers. We have to have our fun up here.
Chairman Boehlert. Thank you very much, Mr. Hall.
Mr. Burgess.
Handling Anomolies
Mr. Burgess. Well, Mr. Chairman, I want to thank you for
convening this panel today. It has truly been very instructive
and necessary for us as we make our evaluations about the
Columbia Accident Investigation Board report.
The--when Admiral Gehman was here before, he talked about
applying the template to NASA where there is a strict adherence
to safety and how to treat an anomaly and continue flying. And
yet I read in the Washington Post yesterday an editorial about
apparently accepting an anomaly with the on-board environment
on the Space Station and continuing--continue with the mission
to put some additional astronauts up there. So the question
comes up are we really serious about that and, Admiral Bowman,
would that be an acceptable anomaly in your experience to
continue flying?
Admiral Bowman. I fly underwater. If we were faced with a
similar situation of--or if we were faced with a situation of
not being able to monitor the ship's environment, that would be
cause for not allowing the ship to sail.
Mr. Burgess. All right. Thank you.
On the--just following on the same line that the Chairman
and Mr. Hall have been pursuing, do you have--could you share
with us, any of you, a real-world example of how your
organization has handled a particular safety problem,
particularly one where an ongoing mission of your larger
organization had to be interfered with?
Rear Admiral Sullivan. I can give you an example of it some
years ago when we were trying to deliver the Sea Wolf, which
was a program with not a great reputation on the Hill. We were
about six months from final sea--first sea trials and a working
level engineer at one of our ship builders, who was working on
the design, came up with a concern about the Titanium alloy we
were using on the doors to the torpedo tubes, which are the
largest holes on the ship. He pulled the thread on that and
eventually got it pulled up through the organization, which is
also flat. Our organization is not as flat as Naval Reactors,
but it is flat enough that minority opinions, such as this, are
voiced. And it came into--this was in about 1994. It came to
full attention of the program management and technical and
safety staff. And we had to come to a grinding halt, do a bunch
of testing, and replace that material on those doors, and it
delayed the ship delivery a year, and it cost in excess of $50
million by the time we were done. And it is because we couldn't
compromise the safety.
Mr. Burgess. Admiral Bowman, would you have an example from
the Nuclear Reactor Program?
Admiral Bowman. Questions of safety are--with the nuclear
reactors for the Naval Reactors Program are not quite so
dramatic that we get to the end of the trail and suddenly have
to make a decision like Admiral Sullivan just described,
because we begin with safety in mind all of the way at the
beginning of the design and the manufacturing process, and we
will watch it and monitor it. And then as we test the completed
components in a non--not--in a critical reactor environment, we
then may run across things that require safety adjudications.
So we fix it then. And then we go on to the next level of test
program. And so as the test program moves along, safety items
that might exist, that very seldom do exist, but that might
exist, come to the floor earlier than as Admiral Sullivan just
described. So I am racking my brain right now to think of an
equivalent, and I can't think of one.
Mr. Burgess. Well, the yellow light is on, so just for a
minute more, if we had a similar situation or we had the
situation with, of course, the Columbia with the foam, but in
your experience in your organization, it would have never
gotten to the--to that point. That anomaly would have been
selected out much earlier in the process? In the design and
manufacturing?
Admiral Bowman. Well, it is difficult to say conclusively,
but I would dare say yes.
Mr. Burgess. Thank you very much. I will yield back the
balance of my time, Mr. Chairman.
Chairman Boehlert. Thank you very much, Mr. Burgess.
Ms. Johnson.
Ms. Johnson. Thank you, Mr. Chairman, and thank you for
having this hearing. I have an opening statement of which I
will put into the record.
Chairman Boehlert. Without objection, so ordered.
All Members will have their opening statements in the
record immediately following the opening statements from the
distinguished Ranking Member.
Safety Accountability
Ms. Johnson. Thank you. There was comment, I think by the
Admiral, that indicated he thought the CEO should be the one in
charge without a separate organization. I don't think NASA had
a separate organization, but the CEO, the person who occupies
that, did not get the information. How do you think that could
be improved?
Admiral Bowman. Again, an excellent question. I think what
Ms. Grubbe said and I agree with was that her CEO at DuPont
felt himself to be the ``chief safety officer.'' And certainly,
within my organization, I feel myself to be the ``chief safety
officer.'' Let me--if I could for just one minute, I do have,
at Naval Reactors, a safety group, but that safety group is not
responsible on a day-to-day basis for ensuring the safe design
and manufacture and production and operation of the components.
That is the line management's responsibility to me directly. So
the way we do it, as the design is moving along, as the system
is operating, as we go day to day with these 103 reactors that
I spoke of earlier that I am responsible for, I hear in real
time these difficulties that we are encountering. And the line
management know that they are responsible for safety as well as
for delivering the product.
So again, the tension isn't there. What my safety group
does for me is integrate the overall efforts of the
organization. They keep the safety codes. They are responsible
for the computer codes that evaluate the overall safety of the
reactor plant. And they do the liaison with the Nuclear
Regulatory Commission for Naval Reactors for me. But they are
not--and I found this out dramatically early on in my tour when
I asked a safety question about a reactor coolant pump. And I
asked it of the safety group head, and you would have thought
the world was coming to an end. Within minutes, the owner of
that reactor coolant pump, the line manager who designs and
oversees the reactor coolant pump, was in pounding my desk
saying, ``What are you doing asking the safety group head about
my stuff?'' And I think it is that sense of ownership and that
sense of responsibility that leads to this mainstreaming that I
am talking about. And that is the way that we do it at Naval
Reactors. I would hear about it within minutes of something
happening.
Ms. Johnson. So though you have persons that have expertise
generally in particular areas, the communication loop always
includes you for the final decisions?
Admiral Bowman. Yes, ma'am, it does.
Ms. Johnson. Thank you.
Mr. Johnson, is that the way you function at DuPont?
Mr. Johnson. I am The Aerospace Corporation. And actually,
in our case, in the case of the Air Force launch organization,
the CEO, the appropriate person in that same position would
actually be Lieutenant General Arnold, who is the Space and
Missile System Commander. The program managers that manage the
overall launch programs actually work for him. And the
information always flows up to General Arnold, to answer your
question. The program managers do a very good job of doing
that, and the final flight readiness review is actually chaired
by General Arnold, and he is the one that gives the final GO
decision based on the inputs of all of the various agencies,
The Aerospace Corporation being one of them, but also his
Program Manager and several others.
Ms. Johnson. Ms. Grubbe.
Ms. Grubbe. Congresswoman, at the DuPont company, everyone
has the same accountability for safety: from the CEO to the
operator in the control room on the night shift. And it is our
intent to make sure that everyone would behave and make the
decisions with regard to safety in the same way.
Ms. Johnson. Thank you very much.
Does anyone on the panel have a comment of what--your
opinion of what might have broken down at NASA?
Admiral Bowman. As I said, Congresswoman, in my opening
testimony, I just don't consider myself to be expert enough in
this area and have not studied it well enough to offer an
opinion.
Ms. Johnson. Thank you very much.
Is that a signal that my time is up?
Chairman Boehlert. Yeah, that is it. All right.
Ms. Johnson. Thank you.
Decision-making in the Naval Reactors Program
Chairman Boehlert. Thank you very much.
Admiral Bowman, let me ask you, does Naval Reactors make a
decision on when and whether to launch, or does it go topside
at Navy?
Admiral Bowman. I--this gets difficult. I have--both wear a
hat within the Navy as the Director of Naval Reactors as a
four-star admiral, and I am also an Assistant Secretary of
Energy overseeing the safe operation, the oversight regulation
of the safe operation of Naval Reactors. In that job, I have
the final say over whether a Reactor is safe to operate. And so
there is no over my head in that regard. And certainly, I
report to the Secretary of Energy in that regard, in that role,
and to the Secretary of the Navy in the Navy role.
Chairman Boehlert. Well, then you would say you are
comparable to the Administrator of NASA in that regard? In
other words, you have the final say on when and whether to
launch?
Admiral Bowman. When and whether to allow operation of the
Reactor plant. The ship's operation is a different matter. The
Reactor plant is the propulsion system that drives the ship
through the water. Without it, the ship couldn't get underway.
So I do have a veto vote that the ship couldn't leave if I felt
there was something unsafe that--to preclude safe operation of
the Reactor plant. But the contrary is not true. There may be
things that are beyond my purview having to do with the
submarine safety areas that Admiral Sullivan oversees that I
could say my Reactor plant is perfectly ready to go and safe to
operate, but the ship doesn't leave because now it does leave
my hands and go----
Chairman Boehlert. Yeah, I----
Admiral Bowman [continuing]. Above my head. Yes, sir.
Chairman Boehlert. Thank you very much for that
clarification.
Mr. Gutknecht.
Culture and Attitude
Mr. Gutknecht. Thank you, Mr. Chairman.
And I apologize to our distinguished guests for the
attendance here, because you need to understand, we
understand--sometimes people in the audience don't understand
we have a number of other Committee meetings going on at the
same time. And I want to thank the Chairman for calling this
hearing, and I want to thank you for coming. I have never had
the courage to go out on one of these weekend submarine
missions, which some of my colleagues have done. I have spent a
few hours on one, and I must tell you, I am in admiration of
those brave Americans who go out sometimes for months at a time
and serve this country. So please pass that along to the people
that work under you.
Let me--the issue here is about safety, and I want to come
back to something, because I believe the single most important
word in the English vocabulary is the word ``attitude.'' And I
think if anything happened that I have learned so far and in
what we have learned in terms of the Shuttle catastrophe is
that the attitudes at NASA had become a little bit sloppy. And
you went through--the Navy went through a similar process, I
think, after Thresher. I guess the question that this committee
really wants to get at, after the Thresher, and I think this is
for Admiral Sullivan, did you start, essentially, with a blank
sheet of paper and start over, or did you tend to--did you try
to modify the current structure that was there? And I think
that is a fundamental question we need to get at relative to
NASA. And perhaps you could offer some observations on that.
Rear Admiral Sullivan. I would say in response to the
Thresher disaster, we basically went all the way to our roost
and rebuilt the culture. The first thing we did was restrict
the operating depth of all operational submarines at the time.
Then they revised the operating procedures. And of course, this
was many years ago. Submarine operating procedures were
revised. We went through a review of the design of our
submarines and made a number of changes that fundamentally
changed the way we had our safety systems in our submarines
design including redundancy, putting in a special emergency
blow system, and having redundant backups for closing major
openings into the ship if the primary system failed. We also
worked hard on our diving plane hydraulic systems so that we
would have increased reliability. We started the whole audit
process. We formalized--we changed the way we joined our pipes.
Before Thresher, many of the pipes that carried water inside
the ship where they were--water coming in from the sea were
used silver-braise joints. We went from silver-braise joints to
welded joints, which are much more reliable and can be
inspected more easily and with more reliability. So we really
changed the whole operating design and manufacturing culture of
the program. It took a long time.
Mr. Gutknecht. But Admiral, did you change your
organizational structure?
Rear Admiral Sullivan. I wasn't there then. I was a kid.
I--there was no SUBSAFE group, that is for sure.
SUBSAFE's Use of the Challenger Case Study
Mr. Gutknecht. The--and let us come back to that SUBSAFE
group. Now apparently, I am told, that you used the Challenger
accident as part of your training program. Can you tell us a
little bit about that?
Rear Admiral Sullivan. Yeah, I am glad you mentioned that,
because I wanted to talk about how you combat complacency in a
culture of safety. Basically, whenever any complex system
fails, including Challenger and including all of the Soviet
Navy's submarine losses, we try to fold that into our training.
We hold annual training on everyone who works on the submarine
program who works at SUBSAFE. And the training consists of two
parts. One is a kind of review of all of the procedures and
instructions, and the second part is a formal--I will call it a
lecture, but we actually watch a video every year that
describes the whole lead up and loss of Thresher, including a
tape of the audio of the submarine pressure hold breaking up.
And that is pretty sobering to go through every single year.
And you know, I have heard it an untold number of times, and it
sends a chill through my bones every time I listen to that
tape.
So I--again, what you have to do is combat complacency.
Mr. Gutknecht. But do you use the Challenger incident?
Admiral Bowman. My organization uses the Challenger
incident as formal training. In fact, just yesterday I was at
one of my two Department of Energy laboratories speaking to a
fairly large crowd outside. And I spoke then about the Columbia
Accident Investigation Board and its report and how we needed
to do exactly the same thing with Columbia as we have done with
Challenger. One of the first books I read upon taking this job
over seven years ago was Diane Vaughn's book on the loss of the
Challenger. And we have ingrained that training as a formal
routine part of our training at Naval Reactors.
We use a phrase called ``constructive dissatisfaction'' to
attack what Admiral Sullivan was just speaking of, complacency
within an already pretty safe organization. I argue that if we
are not constructively dissatisfied with where we are and with
the status quo, we are going to find ourselves on the right
road but standing still, and we are going to get caught some
day. So the Challenger training is a big part of that training.
Mr. Gutknecht. Well, thank you very much.
NASA/Navy Benchmarking
Chairman Boehlert. Thank you.
Just let me ask you, how long, Admiral Bowman, have you
been in your current job? Eight years?
Admiral Bowman. Seven years and 28 days.
Chairman Boehlert. And Admiral Sullivan, how long?
Rear Admiral Sullivan. I have been at my job just over two
years.
Chairman Boehlert. I am just wondering, between--in the
last half a dozen years or so prior to the tragic February 1
accident of Columbia, was there interaction between NASA and
your organization?
Admiral Bowman. Yes, sir, there was. Early on in Mr.
O'Keefe's tenure, he socialized with me the possibility of
benchmarking the Naval Reactor's culture against what he had
found at NASA. He subsequently formally asked the Secretary of
the Navy for permission to do that discussion, benchmarking
with my organization as well as with Paul Sullivan's
organization. The Secretary of the Navy, of course, obliged
happily, and we began that benchmarking operation months before
the tragedy.
Chairman Boehlert. Of course, Mr. O'Keefe has prior
experience with the Navy, so he was fully aware of your
outstanding program.
Admiral Bowman. Yes, sir.
Chairman Boehlert. But I am comforted to hear that. But you
guys, in the Navy, learn from the Challenger, and that is a
case study.
Admiral Bowman. Sure.
Chairman Boehlert. I sometimes wonder if NASA learned from
Challenger. They ought to study it as seriously as you did.
Mr. Miller.
Mr. Matheson. How about Mr. Matheson? Thanks.
Chairman Boehlert. This paper, who says what? Mr. Matheson.
Yes, sir.
CAIB Recommendations
Mr. Matheson. Thanks. Thanks, Mr. Chairman.
I want to thank you for your testimony on safety practices
in your own organizations. What I would like each of you to
tell us is what specific benchmarks you think ought to be
established to evaluate whether or not NASA is complying with
the Board's organizational recommendations. And as part of your
response, I would like you to give a thought about how long you
think it should take for an organization like NASA to implement
those recommendations.
Admiral Bowman. Boy, that is a good question. And I have
given very little honest thought to it, because it is not my
responsibility. If I could possibly back off for just a couple
of days and provide that answer for the record, I will devote--
--
Mr. Matheson. That would be great.
Admiral Bowman [continuing]. A lot of resources to thinking
about it. But I just haven't given it adequate thought to
answer.
Rear Admiral Sullivan. I would just add that probably the
best forum for that is to just continue the benchmarking effort
that is going on between NASA and NAVSEA right now.
Mr. Matheson. If you--go ahead.
Mr. Johnson. I was just going to add that I think probably
the best benchmarks are the items that are contained in the
recommendations in the report itself. And it could take a
considerable amount of time to set up an organization like
that. Of course, we don't know exactly what it is that NASA is
going to set up, but that could be easily a year-long effort to
set up an organization like that.
Mr. Matheson. Sure. Sure.
Ms. Grubbe. Congressman, I can not speak to the benchmark
question, but in DuPont's work with other clients with regards
to changing their own safety culture, it takes--if management
is committed, if the management of the company is committed, it
takes roughly 18 to 24 months to see substantive changes.
Communicating Risk
Mr. Matheson. You know, one issue that we deal with that,
you know, as Congressmen, we are dealing with the public all of
the time in town meetings or what not. And I am wondering how
do your organizations address public--the public's concern
about risk? How do you try to communicate how you are dealing
with risk? How do you try to build up that knowledge within the
public that your organization is addressing risk issues? And
how do you think that would apply to NASA? You can just go in
the same order. Yeah.
Admiral Bowman. I am going to reverse the seating next
time.
Within Naval Reactors, there has been a consorted effort
over the past five or six years to do more of what you are
suggesting. We are little bit hamstrung, because a great deal
of what I deal with is classified----
Mr. Matheson. Right.
Admiral Bowman [continuing]. And it is protected by the
Atomic Energy Act of 1954. And so I have to be cautious. I
honestly believe that I am dealing with the country's crown
jewels, or at least some portion of them, in our nuclear
submarines and nuclear aircraft carriers. I know, without
question, that my organization is targeted by other nations for
this technology, so we have been careful.
Mr. Matheson. Sure.
Admiral Bowman. That said, we recognize that--the point of
your question, that it was very important to begin developing
more trust with the public than perhaps we had before. So we
asked ourselves what could be discussed, and we began a program
that I--from my Tennessee background, if Mr. Gordon were here,
called hobnobbing. And I began encouraging my field
representatives who oversee the operations in the various ports
where our submarines and aircraft carriers are located or where
my Department of Energy laboratories are to begin discussions
with the public officials, the State officials, and the Federal
officials who co-regulate some of our activities to bring them
in and, at the table over a cup of coffee in a non-extreme kind
of situation, tell them who we are and what we are trying to do
and begin working even on security clearances for some of these
people so that we can bring them into the inner sanctum and let
them know better what we are doing to protect the environment
and to protect the--their public.
We are highly reliant on these State and local officials to
take care of their people in our ports. So we felt very
strongly that it was important to do that. So I would say that
we have had now a number of these discussions with State
officials in all of the states that we operate in as well as
beginning now to do what I call table-top drills, training
scenarios that would walk us through the what-ifs and the
highly improbable event of an incident that would require the
town or the state to mobilize, what would be required. And so
we have been doing a great deal of that, most recently with the
State of Washington and their Adjutant General attended that
with us.
Mr. Matheson. Thank you, sir.
Chairman Boehlert. Thank you very much. The gentleman's
time has expired. Did anyone else need to respond to that?
Thank you very much.
Mr. Smith.
Turnover in the Safety Workforce
Mr. Smith. Mr. Chairman, thank you.
Congress tries to fulfill its role of policy, and sometimes
that policy sort of interferes with some of the goals of the
Administration or the Navy. I served in the Nixon
Administration for about five years. And pretty much what we
were told when we came on the Hill is, you know, try not to
rile any of the Congressmen. Be nice. Be polite. I am a little
concerned with NASA that has been somewhat immune from
political control even--from Congress, but also even from the
White House over the last several years. And so I am trying
to--I guess my question relates partially to the balance of
that policy coming from Congress to--at what point it--is it
disruptive to the mission as determined by the Administration
versus as the responsibility for policy oversight by Congress.
But I don't know how you answer a question that is sort of
vague like that, except let me specifically talk about the
difference between the Navy and the NASA in terms of
complacency, how complacency starts to evolve from employees
that have been doing the same thing for too long a period. And
as I understand it, Admiral Bowman, the Navy has an 8-year
transition in some of the more technical aspects. And NASA has
now told us that they are looking at a rotation of two to three
years, so a new broom will sweep clean, if you will, but--so it
is a balance of the energy and attentiveness of new people
coming on the job versus the potential of complacency. What is
the right length of time for rotation and transition?
Admiral Bowman. Well, that is another very good question
and I think one that should be addressed by this committee in
dealing with this NASA situation. You are right. My particular
position is, by law, eight years. On the day Admiral Rickover
retired, President Reagan wrote an Executive Order that made
that so, and that Executive Order has subsequently been written
into law twice now, making my tenure eight years.
I think longevity in this kind of oversight position that I
find myself in is extremely important to the safe operation of
an organization that deals with an unforgiving technology, such
as mine or NASA's. So I heartily endorse both that concept of
extending the tenures of key technical people at NASA as well
as what Secretary Rumsfeld is trying to do across the Navy for
this--or across the military for----
Mr. Smith. You are recommending that it be done by law?
Admiral Bowman. Well, that is certainly one way to ensure
that it gets done. It is a way that it could happen. It is the
way it has happened with my position.
Mr. Smith. Well, according--but you know, part of my
concern with past hearings on the Columbia disaster, and I
appreciate the question that was asked earlier that the Navy
looks at Columbia in terms of what possible mistakes have they
made in reaction--in relation to what we are doing and how do
we make sure that we don't make the same mistakes. NASA, I
think, is going to start being more conscious of a larger
environment.
Nanotechnology
I have been concerned about the mission. I am Chairman of
the Subcommittee on Research. A lot of the justification for
our NASA effort is research. We have been told that the main
reason that humans are in space is to--studying--
scientifically, at least, is studying the physiological
implications on humans in space flight. I just returned from
Cal Tech and JPL and looking at some of the California science
efforts. And I guess I come back with the conclusion that our
new nanotechnology is going to replace a lot of the manned
space flight. How about nanotechnology in communication to
replace more personnel in the Navy, especially with submarines?
Admiral Bowman. We are headed in that direction, without
question, the entire Navy, not just submarines. Looking at
automation. Nanotechnology may very well have a place in that
in the sensor world, being able to better determine what is
going on inside systems and inside components with
nanotechnology. But reducing the manpower on board our warships
is a stated goal as the Chief of Naval Operations and the
Secretary of the Navy even--one which I endorse.
NASA/Navy Benchmark
Mr. Smith. Is there--just one last quick question.
On your investigation and how it might apply to you and
your responsibilities in terms of reviewing what happened with
Columbia, do you communicate any of that analysis or evaluation
to NASA?
Admiral Bowman. I am sure we will. I say that because of
the earlier questions that indicated that Mr. O'Keefe was keen
on benchmarking his organization against the Navy's
organization. So I would have no doubt that he would be
interested in our views on lessons learned from Columbia. I
would add that we have already conducted training for NASA on
Challenger, giving them our version of the lessons that we
learned from the Challenger disaster----
Mr. Smith. Okay.
Admiral Bowman [continuing]. And I think they found that
very helpful.
Chairman Boehlert. Thank you very much. The gentleman's
time has expired.
Mr. Smith. Thank you.
Chairman Boehlert. Ms. Jackson Lee.
Manned vs. Unmanned Space Flight
Ms. Jackson Lee. Thank you very much. And to the panelists,
I think I associate my remarks with my colleague who has
indicated that there are a number of hearings going on that may
have delayed us in hearing your complete testimony, but I want
to thank the Chairman and Ranking Member for a very, very vital
hearing.
And I would like to probe extensively, within my time
frame, on this question of safety. Realizing that Admiral
Gehman and the Columbia Investigation Board set a standard of
which we should try to achieve, I have noted over the years,
starting halfway, probably, into my term, maybe even earlier,
on this committee, which has been a sizable amount of time,
that safety is the number one responsibility and requirement.
And I would then add to say that we are at a crisis point as it
relates to safety issues in moving NASA forward. Admiral
Bowman, just a quick question. My colleague led you down the
path of technology and manpower and possibly substituting
technology for manpower. I assume reducing manpower does not,
in your mind, equate to eliminating manpower as it relates to
submarines.
Admiral Bowman. In some instances----
Ms. Jackson Lee. In totality, I am trying to say.
Admiral Bowman. No, not in totality. Absolutely not.
Ms. Jackson Lee. Okay. Then let me--I just wanted to make
sure that I got that on the record that technology will never,
in totality, replace the necessity of manpower, humanpower,
womanpower, if you will, if they have reached that point of
staffing on the submarines. And I don't believe that it will
reach the point of eliminating the importance and vitality of
human space flight. You are not here today suggesting that we
should eliminate the human Space Shuttle?
Admiral Bowman. The----
Chairman Boehlert. All right. Excuse me. That is not at all
the purpose of the hearing. The purpose of the hearing is to
learn from them how do we make----
Ms. Jackson Lee. I understand.
Chairman Boehlert [continuing]. Human flight safer.
Ms. Jackson Lee. I appreciate. Let me allow the gentleman--
would you answer my question, please, Admiral? Thank you.
Admiral Bowman. It was certainly not my intent to indicate
any opinion on the elimination of manned space flight in my
answer.
Ms. Jackson Lee. Right. So you are not here suggesting that
that should be eliminated or make a comment on that?
Admiral Bowman. That is correct.
Safety Organization
Ms. Jackson Lee. Okay. The CAIB has indicated that we
should divide the structure of NASA between operations and
safety. Is that along the lines of what you have done with
respect to the operations that you are involved in the Navy?
Admiral Bowman. We really have done almost the opposite.
Ms. Jackson Lee. All right.
Admiral Bowman. We have integrated operations and safety.
We have combined operations and safety from the beginning. As I
have said earlier, the mainstreaming aspect of safety with the
line functions does that for you and makes everybody
responsible for and cognizant of safety.
Ms. Jackson Lee. And how have you found--has that been a
structure that you have had for a number of years? Has it been
a structure that you have implemented in response to actions
that have occurred? Or has this been the Navy's general basis
of operations?
Admiral Bowman. Admiral Rickover set up his office at Oak
Ridge in 1948, and this has been a part of Naval Reactors since
1948.
Ms. Jackson Lee. And in that integration of safety issues,
how do you encourage the personnel in the Navy to be open on
their concerns about safety questions, for example, and I think
it was asked before but I would like to hear it again, if there
is an air quality problem or a safety problem in a submarine
that was about to disembark or about to leave shore, if you
will, with my--with the technology to be refined better? But in
any event, what would be the response to that individual or
individuals?
Admiral Bowman. I think they would be rewarded and
applauded. They certainly would be in my organization in our--
--
Ms. Jackson Lee. And how do they go up the chain of
command?
Admiral Bowman. Within my organization, it is quite easy.
They have direct access to me, number one, through knocking on
my door and coming in the office, calling me on the telephone,
e-mail. They have direct access to their section heads. The
direct reports that I referred to earlier, the 21 direct
reports, know that we are going to be talking at the table in
my office about are there minority opinions, are there
dissenting opinions on the consensus view here. And so they go
out and look for it.
Ms. Jackson Lee. So the atmosphere can be created, you are
saying?
Admiral Bowman. I believe it can, yes, ma'am.
Ms. Jackson Lee. Ms. Grubbe, would you--thank you very
much, Admiral.
Would you help me with the safety question in the private
sector? We find that there are concerns of retaliation and
enforcement questions on how do you enforce the atmosphere or
penalize those who don't do it. What do you do in the private
sector with DuPont?
Ms. Grubbe. We do something very similar to the Navy,
Congresswoman. We reward and highlight people who bring forward
not only safety events that have occurred where no one else was
around, but potential events and make sure that they get broad
communication across the organization and to every plant site
around the world that has a similar kind of apparatus, if it
involves a piece of equipment.
Ms. Jackson Lee. We thank you very much for your reasoning
on this. This will be instructive to us as to what we need to
do, and I thank you for your testimony.
Chairman Boehlert. Thank you very much.
Mr. Rohrabacher.
Mr. Rohrabacher. Well, I am just going to say that I missed
the testimony, and I am sorry, and I apologize. We have got our
Governor-elect Arnold in town, and I was introducing him to
various people, and that is part of my job, and I am sorry. But
I will be reading your testimony. And I appreciate the fact
that you have shared your expertise with us. We have to put
NASA's house in order, and all of us on the outside and the
inside have to work together. And I appreciate your
contribution and appreciate Sherry Boehlert's leadership. Thank
you very much.
Chairman Boehlert. Thank you very much.
And now I would like to thank the panel for participating,
for serving as resources. We value highly your testimony in its
entirety. And all of your complete testimony will be part of
the permanent record and any added material you care to submit.
And stay tuned, we may be back by phone or by written
communication to ask for some amplification of certain segments
of your testimony, but we really appreciate what you have done.
Thank you very much.
Panel II
Our next panel will be a panel of one, the very
distinguished Chairman of the Columbia Accident Investigation
Board, Admiral Harold Gehman. Admiral Gehman has had a busy
day. He has been over to the JV's this morning. He is coming to
the Varsity right now in the Science Committee of the House of
Representatives. As we all know, Admiral Gehman has been just
outstanding in his service to the Nation in a very important
capacity as Chairman of the Columbia Accident Investigation
Board. Let me add, he has also been outstanding in many other
respects, including his availability to all of the Members of
this committee and to the staff of the Committee. We are
working hand-in-glove with the Admiral to ensure that we have
the best possible response to a very tragic situation.
And with that, now that the name tag is properly in place
and the Admiral is prepared, Admiral Gehman, welcome back.
Admiral Gehman. Thank you very much.
Chairman Boehlert. The Floor is yours, sir.
STATEMENT OF ADMIRAL HAROLD W. GEHMAN, JR. (RET.), CHAIRMAN,
COLUMBIA ACCIDENT INVESTIGATION BOARD
Admiral Gehman. Thank you very much, Mr. Chairman.
I will just make a very, very short opening statement here,
and we will get right to the questions.
The panel that you just had, I didn't get to listen to all
of it, but I got to listen to part of it, a very illustrious
panel. I consulted their organizations in the course of our
investigation, and I congratulate this committee for getting
them here and letting them talk about safety and reliability.
Let me just say that the Columbia Accident Investigation
Board was careful to--we tried to be careful to separate safety
from reliability. By safety, we referred to--we refer to things
like untoward incidents in the workplace or hazardous
conditions or hazardous materials or the failure to inspect or
to catch something. Reliability refers to completing the
mission, that is launching safely and returning safely with all
of the humans intact. And we--they are related to each other,
but at the same time, the Board came to the conclusion that the
organization and structure needed to accomplish these two goals
with slightly--a slightly different approach. And therefore, we
made these three organizational and structural organizations
the--that you are conducting this hearing on. And it is the
opinion of the Board that there is almost nothing in our
report, which is more important than getting this right. We
really feel that if the Board--if the Columbia Accident
Investigation Board is going to be viewed as having been
successful, then making these changes in NASA will be the
measure of whether or not we were successful.
In the area of reliability, we feel very strongly that
separating technical and engineering authority from the
operation of the Shuttle is the key to increasing the
reliability and accomplishing the mission. Right now, we are
successfully launching and recovering the crew and the Shuttle
55 out of 56 times. And that is not what I would call a high
reliability record. There are a lot of activities in the United
States which are very dangerous, very hazardous, and which have
success rates far in excess of 55 out of 56. Certainly you had
Naval Reactors here and the Navy Submarine Program as well as
DuPont and The Aerospace Corporation. And they--their goal is
zero failures to accomplish their mission. And they don't
consider 55 out of 56 to be anything to brag about. So the
separation of the technical and engineering authority, we
believe, is one of the keys--is the key to doing that.
The second area is safety. As NASA is organized right now,
the Headquarters safety organization is independent and that is
not the issue. The problem that we have is that the
Headquarters safety organization, Code Q, Mr. Brian O'Connor,
with--in whom we have the highest confidence, does not have any
line authority. He is the policy setter. And it is--it isn't
that the Headquarters safety organization is not independent.
That is not the issue. The problem that we have is that the
Headquarters organization doesn't have any authority. And then
the program and center safety organizations are subordinate and
are dependent upon the programs and centers, that is the very
organizations that they are supposed to check up on, are the
ones that are funding their activities. And we have--it is
the--so it is the program and the center safety programs that
we think are not independent, not the Headquarters safety
program.
The last thing I would say before I respond to your
questions is that the Board carefully studied these
institutions whose representatives you just had here, plus some
others, and we also availed ourselves of more than a dozen
academic experts in the area of high-reliability operations and
safety. And we will admit to you--we will admit, unashamedly,
that we selectively picked and chose the attributes and
characteristics of these organizations, which we thought added
to reliability. We did not copy lock, stock, and barrel either
the Naval Reactor's model, the SUBSAFE model, the Aerospace
model, or any other model. We picked the attributes that we
liked the best and put our formula in the report. And the
longer that this report stands out here, the more scrutiny it
has gotten, the stronger we feel that we got it right.
So with that, Mr. Chairman, I will be glad to answer your
questions.
[The prepared statement of Admiral Gehman follows:]
Prepared Statement of Harold W. Gehman, Jr.
Good afternoon Mr. Chairman, Representative Hall, distinguished
Members of the Committee, ladies and gentlemen.
It is a pleasure to appear today before the House Science
Committee. I thank you for inviting me and for the opportunity to
provide answers to questions you may have as you endeavor to implement
the recommendations of our report on the investigation into the tragic
loss of the Space Shuttle Columbia and her courageous crew of seven.
My intent during my testimony today is to provide the Committee
with information on any of the topics explored by the Columbia Accident
Investigation Board in the final report. I am prepared to explore any
area in which you or the Committee are interested; however, I would
like to remind you that now that the Board has disbanded, my ability to
speak on its behalf is limited. I cannot comment on the progress of the
NASA's return to flight, as I have not been involved in an oversight
role. I do wish to make myself available to explain any facets of the
report that may be unclear or require further clarification.
That said, I would like to turn my attention to the questions
provided in the charter of this hearing.
The first question asks what it means for a safety program to be
independent. I believe we must clarify which independent safety program
we are discussing. The Board found that the NASA Headquarters Code Q
safety organization is completely independent. Our finding referred to
the Center and Program Safety Offices. We do not think the current
process by which the Center and Program Managers ``buy'' as much safety
as they can afford or think they need is the best organizational
construct. When safety competes against all other budget items such as
schedule, maintenance, upgrades, pay raises, etc., safety sometimes is
compromised. In regards to the NASA Headquarters Safety Office
addressed in Recommendation 7-2.5, the Board's concern was not lack of
independence, but rather the lack of a direct line of authority over a
safety organization whose jurisdiction runs all the way down to the
shop floor.
The second question concerns how to balance the organization of
safety programs to give them sufficient robustness and efficiency, but
without preventing the larger organization from carrying out its
duties. Safety organizations should not have veto authority over
operations, but they do need the expertise and depth to understand the
systems completely, the ability to initiate and resource at least a
minimal study or inquiry on their own without having to ask project
management, sufficient personnel to be present at critical tests and
inspections, proper test equipment, and sufficient resources to fund
studies that help reveal what trends mean and what the safety
organization should be looking for.
Thirdly, the Committee asks how to ensure that the existence of an
independent safety program does not allow the larger organization to
absolve itself of responsibility for safety. The safety organization
should not supplant the operations organization for operational
decisions. The safety organization just needs to be robust enough and
independent enough to study an issue, understand multiple sides and all
the implications of the actions contemplated, come to a conclusion that
is supported by analysis, testing and research, and then have a chance
at the proper forum to voice their independent position.
The Committee's last question concerns ensuring that dissenting
opinions are heard, but avoiding the possible impasse resulting from a
safety review process that can never reach closure. The Board has
reached the conclusion that holding and voicing dissenting opinions is
not the problem. The problem comes when dissenting opinions are not
supported by data. What the CAM recommended are procedures that ensure
that reliability and safety matters can be thoroughly examined by
knowledgeable people with sufficient resources. This process does not
guarantee that errors won't be made, but the current NASA process
doesn't even give the system the chance to catch mistakes.
Thank you, Mr. Chairman. This concludes my prepared remarks and I
look forward to your questions.
Discussion, Panel II
ISS Safety and CAIB Recommendations
Chairman Boehlert. Thank you very much, Admiral.
You are aware, and so are all of us, of the issue of the
Space Station and what has transpired over the last several
days and the extensive coverage given to the issue and how it
was handled. If your recommendations had been in place, how do
you think it would have been handled differently?
Admiral Gehman. Mr. Chairman, I do not--I only know about
this case of the air and water quality on the International
Space Station from what I read about in the newspapers. I do
not have any knowledge of the actual details of who said what
to whom and who went to what meeting and all of that sort of
thing. But I can speak to that incident in the context of the
mosaic presented by our report. First of all, if there are
technical standards for air, water quality, and if there are
monitoring instruments up there, the operation of those
instruments and the enforcement of the air--of the
environmental quality and the safety of the people in the
International Space Station would be the purview of this
engineering technical authority. And the Program Manager could
not waive those standards. He could not say, ``No, I am going
to go anyway.'' That is--that would not be one of his
functions. He would have to go to the independent technical and
engineering authority and say, ``Well, I have looked at this,
and I have decided that we should go ahead and replace this
crew. Even though these instruments aren't working the way they
are supposed to, we have no reason to believe that there is''--
anyway, he would make his argument, and it would be up to this
independent technical authority to determine whether or not it
wanted to waive its own standards. If it chose not to waive--
and to get to your question specifically, the--whoever these
people were who decided not to sign off on the flight readiness
review, they would be operating in an environment in which they
would be on the inside. That is, they are in an engineering
environment in which actions like this are rewarded and are
encouraged rather than having to prove that something was
wrong.
Sooner or later, it would have to come to some person,
probably the head of human space flight, or something like
that, who would have to decide which way to go. That is okay.
And if they decided to go ahead anyway, that would be fine. But
I--but the big difference would--the big difference in my view
would be that, as I understand it, and Mr. O'Keefe sat beside
me a couple of hours ago and he just explained his action here,
as I understand it, these dissenting opinions were encouraged.
They were fired up on. They were taken seriously, but they were
all taken seriously because of the good graces and the
cooperative attitude of management. And I--the history of the
Space Shuttle Program and NASA, going all of the way back to
Apollo, indicates that over a period of 18 to 24 months, those
good graces and that cooperative attitude will atrophy and the
old pressures of schedule and manifest and cost will come back
again.
Chairman Boehlert. And it never got topside until the last
72 hours. I mean----
Admiral Gehman. Yeah, that--I don't know any of those
details, but the big difference would be, in my opinion, that
these dissenting opinions, these concerns would be voiced in an
organization that was not concerned about schedule, not
concerned about cost, and it would be in a friendly
environment. These people would not be, kind of, on the outside
trying to get their way in.
Safety Program Independence
Chairman Boehlert. Well, what--how do you consider the
Naval Reactors Program independent, because we just heard from
Admiral Bowman that there is nothing separate? I mean, safety
is everybody's business. It is the culture that he is talking
about. Everybody is totally immersed in safety first and
foremost. And it--there doesn't seem to be the independence
that you outlined, the Board outlined in its recommendations.
Admiral Gehman. Mr. Chairman, I listened to part of that,
and I think that there was a misunderstanding, even though
Admiral Bowman tried to clear it up at the end. Admiral Bowman
and his organization are responsible for the Reactor and all of
the requirements of the Reactor, all waivers to the Reactor,
and all operations of the Reactor, but they are not responsible
for the ship, the submarine. There is a--the Fleet is
responsible for the operations of the submarine. And that is
our model with--the Program Manager who is responsible for the
operations of the manifest of the Shuttle and then a technical
authority that is responsible for the technical specs and
requirements of the Shuttle.
Admiral Bowman and his organization can say, ``That Reactor
is not ready to operate,'' in which case the Fleet Commander
can't operate the submarine. But Admiral Bowman doesn't operate
the submarine. Once he says it is okay, then someone else
decides where the submarine goes, how fast it goes, what date
it goes out----
Chairman Boehlert. Got it.
Admiral Gehman [continuing]. When it comes back, and so
when he says that the whole line organization is responsible
for safety, he was referring to his line organization. He was
referring to his pump guys and his----
Chairman Boehlert. Thank you for that clarification.
Admiral Gehman. Yeah.
Chairman Boehlert. Ms. Jackson Lee.
ISS Safety
Ms. Jackson Lee. Thank you very much, Mr. Chairman, again.
And thank you, Admiral Gehman----
Admiral Gehman. Thank you.
Ms. Jackson Lee [continuing]. For having the willingness to
be at bat more than once today.
Since you have been here, your work is continuing, and our
challenges are continuing. And so rather than dance around the
question, let me go right to it. You had been answering the
question, but might I say that I think we were engaged earlier,
as you well know, when I say we, myself in questioning, raised
the issue of safety on the International Space Station. And I
think now we are in dialogue through written communications to
try and expand on that understanding. I believe that maybe it
was good for us to have this happen sooner rather than later
with respect to the issue of exposing the difficulties.
There are two prongs that I would like to probe with you.
One, we found, again, if you will, and you have not done an
extensive review of the Space Station but use your background
and experience with your view of Columbia 7, the tragedy that
occurred there. The first prong, of course, is that there were,
in this instance, two very vocal scientists who offered their
opinion and, I believe, refused to sanction and/or prove the
sending of two additional astronauts to that--to the Station.
What should have happened or what went wrong, maybe that would
be the better approach, that they were either overrun,
superseded? Was that healthy? Was there--and you may be
gleaning this from newspaper articles, but what went wrong from
that perspective?
The other perspective is that is it viable and important at
this time now to do a comprehensive safety assessment on the
Space Station? Again, I remain committed to the value of humans
in space and certainly human Space Shuttle. But for it to be a
successful experiment, which I think Space Station is, there is
no doubt that we are still experimenting with what goes on in
space, but do we need that right now without one moment's rest
or stop in beginning to assess the safety issues on that--on
Space Station?
Admiral Gehman. Thank you very much, Ms. Jackson Lee.
From what I understand of the incident over--the incident
having to do with the approval of the Crew 8 mission, I believe
that it is--if you take the matrix or the test of the Columbia
Accident Investigation Board report and apply it to that event,
I believe it looks like this. In the first case, there is some
good news. For example, one of the issues that we raised in our
report was it--that it seemed to us that over the years that
engineers and scientists had to prove that a situation was
unsafe before the Shuttle Program would take any action,
whereas in the original days, you had to prove it was safe in
order to go forward. And the fact that the test now seems to be
``prove to me that it is unsafe'' is the wrong question. For
example, in the case of the engineers in the case of Columbia
who wanted photography, wanted imagery on-orbit, they were told
to prove that there was a problem before management would go
ahead and get the photography. That is a case of ``prove that
it is unsafe before I take any action,'' whereas the original
Apollo philosophy was ``you have to prove to me that it is safe
or I am not going to go forward.''
Okay. In the case of the atmosphere and the water
situation, the human conditions on board the International
Space Station, it does appear to me that NASA management asked
the question, ``All right, you are going to have to prove to me
that it is safe.'' That is the correct question. So it looks to
me like they have learned that--in this case, they have learned
their lesson. The--so that is the good news in this particular
incident.
The bad news, or the thing that I am concerned about is the
same issue that I brought up with the Chairman and that is it
appears to me that it took the intervention, the act of
intervention of management to resolve this issue. In other
words, the system didn't take care of this problem by itself.
And a year from now, or 18 months from now, when cost and
schedule pressures have resumed, I am--I don't think we want to
rely upon the intervention of management to snatch victory from
the jaws of defeat. I think we want to institutionalize a
process by which these issues can be raised and sorted out
without having top-level management intervene.
Chairman Boehlert. Thank you very much, Admiral.
Admiral Gehman. And the second question, to get to your
second question, we kind of have a cookbook here. We only
looked at the Shuttle Program. I think that probably the
International Space Station Program ought to be looked at,
also, but I--but not with the same urgency, of course.
Ms. Jackson Lee. Thank you.
Chairman Boehlert. Thank you, Ms. Jackson Lee.
Mr. Rohrabacher.
Leadership Confidence
Mr. Rohrabacher. Yes. Admiral Gehman, Mr. O'Keefe, Director
O'Keefe, has my full faith in his decision-making. Does he have
your faith?
Admiral Gehman. Yes, sir. I--of course, I only have seven
months of experience, I mean, since the 1st of February, and--
--
Mr. Rohrabacher. Almost as much as his.
Admiral Gehman. Well, that is right. He is--that is right.
He has only been there slightly longer than that, but in the
course of this investigation, he has provided us all support,
everything we have asked for. He has taken all of the right
moves, as far as I can tell, so yes. The answer is yes.
ISS Safety
Mr. Rohrabacher. Okay. And the episode with this Space
Station decision that had to be made, you were satisfied with
the way that that has been handled?
Admiral Gehman. Well, once again, I don't know the details
of who said what to whom. And--but it did appear to me, just
based on the limited knowledge that I have, including listening
to Mr. O'Keefe explain it to the CST this morning, that it took
the active intervention of management to bring this issue up to
the proper level. And I would rather see a system at work in
which it didn't take the active intervention of senior managers
to bring something up. It ought to come up automatically.
Mr. Rohrabacher. And since the issuance of your report,
your--you would give NASA an ``A''? A ``B''? A ``C''? An ``F''?
Admiral Gehman. Since the issuance of our report, myself
and other members of the Board have continued to dialogue not
only with NASA on a regular basis, we have been asked--invited
by Mr. O'Keefe to come over and address his senior management,
and we continue to hammer, and hammer, and hammer. But also, we
have an active dialogue going on with the Stafford Covey Return
To Flight Task Group so that they understand exactly what we
mean by every recommendation. So we are--you know, it is early
yet, and we are still in the thinking stage. We are not in the
doing stage yet, but so far, so good.
Vision
Mr. Rohrabacher. One of the things that I believe we
discussed when you were sitting there before was the lack of--
the importance of a lack of vision statement and the importance
of lack of an overall goal that people would--could unify
behind and those type of goals actually energize the system. I
haven't seen anything come forward from the Administration yet
along those terms. Is it necessary? Do you still believe that
it is necessary to have this vision and unified concept for
NASA to work at its peak efficiency?
Admiral Gehman. Yes, sir. The Board was quite
straightforward and firm in that finding. It wasn't a
recommendation, but we felt very strongly that the lack of an
agreed, and by agreed I mean both ends of Pennsylvania Avenue
as well as the American public, an agreed vision for what we
want to do in space gets in the way of a lot of very practical
day-to-day things. For example, NASA doesn't know, nor do you
know, how much money to put into infrastructure upgrades if you
don't know where you are going. You don't know how much money
and how high a priority Shuttle upgrades and Shuttle safety
upgrades should be accorded, because you don't know how long
the Shuttle is going to last. You don't know--NASA doesn't know
how to justify to you major investments. And indeed, in the
case of the orbital space plane, it is not clear exactly what
this thing is supposed to do because we don't have an agreed
vision as to what we want to do.
So it gets in the way of doing business on a daily basis,
not only at the national level, not only at your level, but at
the practical level down at the Cape and down at Marshall,
because they----
Mr. Rohrabacher. And in terms of the individual level, you
might correct me if you disagree, but I imagine you do, that
individuals who are working within a system are energized and
there is a new dynamic created in their--in the way they work
and the care that they take if they feel that they are part of
something that is much larger than just the task of the day.
And without a consensus or a concept that is going to--a
unifying concept, we are not going to be able to do our job,
are we?
Admiral Gehman. Well, I think that the--all of the workers
and all of the scientists and engineers as well as the
contractors that we came in contact with, which was quite
extensive, as you know, because we did interviews on the shop
floor, we did interviews in the back room, they all appeared to
be motivated and serious and quite dedicated to their project.
I think I mentioned to you and to other Members of this
committee that early in our investigation, we were--when we
were doing view graph 101, when we were getting hundreds and
hundreds of view graphs, we actually had presenters choke up
and break down while they were briefing us, just to show how
dedicated they are.
But I believe that--in the--that where your question really
hits the mark, Mr. Rohrabacher, is in the area of problem
solving. Now if we don't really have a good vision, a good,
exciting vision that people can buy into, we don't really
address some of the problems as aggressively and imaginatively
as they would if they knew where they were going.
Mr. Rohrabacher. Thank you very much. Thank you, Mr.
Chairman.
Chairman Boehlert. Thank you very much.
Mr. Wu.
Expedition 8 Launch Decision-making Process
Mr. Wu. Thank you, Mr. Chairman.
Thank you for coming again, Admiral.
I want to ask one question and then one follow-up. And the
question is--somewhat follows up on the Chairman's earlier
question and Ms. Jackson Lee's earlier question about the
decision to launch this latest group of people to the
International Space Station and the fact that there were, in
fact, in essence, two dissenting opinions. And there was a
process. There was dissent. There was discussion, and
apparently that occurred over a period of time, and now there
are two astronauts in the International Space Station. We have
a solar flare that occurred yesterday and it is arriving just
about at this time: an unpredicted event, difficult to predict,
and in this case, unpredicted. Was this decision-making process
and the fact that now these two astronauts have to get into the
thickest part of the International Space Station and move water
around, perhaps, and so on, is that a sign that the process is
working because two people were able to consent, or is that a
sign that this process is not improving because we are where we
are with the solar flare and two astronauts up and the
radiation monitors not working?
Admiral Gehman. Right. Well, my understanding--and
certainly we studied this in the case of the Shuttle Program in
great detail. My understanding is that in the process of
certifying a vehicle for a launch or a mission to go, I would
consider dissent to be a good thing. There are so many
variables and so many pieces and so many subsystems that--there
are so many risks and so many assumptions that have to be made
that if everybody said, ``Yes, yes, we are ready to go. No
problems. Everything is good to go,'' I would be suspicious
that somebody is hiding something from me, because it is so
complex and so dangerous. There is so much energy involved.
There are so many systems involved. There has got to be some--
out there, there has got to be somebody who is having a little
problem with his system or he has some doubts about something.
And if that person doesn't speak up, that is what I would be
concerned about.
So the fact that there were some environmental scientists,
or medical doctors in this particular case, who were concerned
about some aspect of it, to me is not a sign of a failure or a
sign that anything is going wrong or anything like that. The
lack of any dissent would cause my suspicions to go up. And
once again, I do not know in detail of how this dissent was
handled or who did what to whom and who held what meeting, only
what I have heard Mr. O'Keefe testify to this morning and what
I have read in the newspapers. And I had already said that it
looked to me like it took active management intervention to get
that sorted out. And that is not a long-term formula for
success.
Mr. Wu. Thank you, Admiral.
The follow-up question I have is that, according to what I
have heard, Administrator O'Keefe learned of this problem only
days before the launch even though the dissents occurred a
significant time prior to that. And as a Member of this
committee, I don't know if the Chairman had better access to
the information, but I learned about the dissents through the
newspaper. Is this--the panel we had earlier said, ``You know,
one of the things about safety is you build it in so that it
goes to the top and everyone has responsibility and the loop
loops in the person who is ultimately responsible.'' And the
fact that, perhaps Administrator O'Keefe did not know until,
maybe, soon before the launch and that members of this
oversight committee didn't know until it was published in the
newspaper post-launch, is that a sign of a challenge or a
problem to be faced?
Admiral Gehman. I think we should not comment on that here,
because in his testimony this morning before the Senate, Mr.
O'Keefe said that that was not true. And we ought to let him
sort this out. As I say, I do not know who said what to whom on
what day, but in his testimony this morning, Mr. O'Keefe said
that that press report of when he was told and how he was told
was inaccurate. And so we ought to let him sort that out.
Mr. Wu. Thank you, Admiral.
Chairman Boehlert. Thank you.
Mr. Wu. Thank you, Mr. Chairman.
ITEA and Safety Staff Turnover
Chairman Boehlert. A quick one before I go to Mr. Smith for
the final question for you. How important do you think it is,
Admiral, to have longevity in the staff of the independent
technical and safety organizations?
Admiral Gehman. Well, I think that longevity is one of the
attributes that would aid in the efficiency and effectiveness
of that organization. It is also the opinion of the Board, by
the way, that this independent technical and engineering
authority or whatever it eventually gets called, would also aid
in some of NASA's career progression and retaining issues,
because right now there are very troublesome career moves of
into contractors and out of contractors and back and forth. And
I would really like to see a more healthy progression of, you
know, into the--into a true engineering organization than back
into the program and back into engineering. So we think it is
very important.
Chairman Boehlert. That is a view we share. It is--we are
working with NASA to give them the ability to restructure in
how they do things and to treat their workforce a little bit
differently because of the proven need.
All right. Mr. Smith, for the final----
ISS Review
Mr. Smith. Mr. Chairman, I am--very briefly. And Mr.
Chairman, I agree with you that Administrator O'Keefe was
correct when he decided that the reorganization of NASA should
occur before the return to flight, really setting a more
ambitious schedule than that called for by the CAIB.
Admiral, let me ask you exactly what you meant when you
said there should be a further evaluation of the Space Station.
Are you talking about policy, goals, objectives, what it is
accomplishing, or are you talking about safety?
Admiral Gehman. Any kind of a review whatsoever. I am
speaking--that was a private opinion. So I have got no evidence
to go on to indicate that there were--there are any problems in
International Space Station.
Mr. Smith. Well, there is hope----
Admiral Gehman. But my private opinion is, though, that the
kind of look we looked at their management schemes here and how
safety is handled probably would be a good idea for the
International Space Station to get the same kind of
examination.
Mr. Smith. But even more than that, I would think, last
weekend, I am sure you are aware that a report by NASA
scientists was, for lack of a better word, leaked that
described the human physiological research at the Station as
voodoo science. And NASA science, I think, has identified that
the physiological research on humans is essentially all of the
justification why humans would be in space. And of course, I am
an advocate of dramatic reductions at this time of real
financial problems with the Federal Government and the debt
that we are facing to review all programs. And so I think when
we look at the Space Station, we also need to look at what it
has accomplished. And I think that we should consider, in some
kind of investigation, whether it is--and I suspect maybe you
would like to visit with your family some more as far as you
taking the responsibility of it, but should we drastically
reduce manned space flight and should we maybe abandon the
Space Station?
Admiral Gehman. I am sorry. I am going to have to defer on
that----
Mr. Smith. I knew you--all right.
Admiral Gehman [continuing]. Mr. Smith. We did not look--we
did a lot of ancillary research to make sure that the report
that we wrote was--is in much context as we possibly could. We
put it in budget context, history context, everything else
like--but the one context that we did not look at was the
argument between how much human space flight is enough. And so
I just am not a----
Mr. Smith. And again, thank you for your great work and
service to the country.
Admiral Gehman. Thank you.
Mr. Smith. And Mr. Chairman, I yield back. Thank you.
Chairman Boehlert. Thank you very much. And what you said,
very eloquently, and you have said it many times, we need a
national debate, a good thorough vetting of the issues. And we
have got to reach some sort of a consensus that gives us a
vision.
Admiral Gehman. Yeah.
Chairman Boehlert. And we have got to work toward it. Thank
you very much, Admiral Gehman.
Admiral Gehman. May I make one 30-second last closing
statement here----
Chairman Boehlert. By all means.
Admiral Gehman [continuing]. And that is that the
fundamental--the three fundamental organizational
recommendations that we made that is there should be an
independent technical engineering authority. That is the most
important one. That the Headquarters safety organization should
have line authority. Now that doesn't mean that the Program
can't have a safety organization and the center can't have a
safety organization. They certainly can. But for the--for your
head of safety to be only a policy-setter doesn't seem to be--
--
Chairman Boehlert. Right.
Admiral Gehman [continuing]. Reason for us. And the last
one, that the Shuttle Program should have a true integration--a
systems integration office, which it does right now. In
reflection over time and listening to all of the experts, we
are more convinced than ever that those are good, solid
recommendations, and we stand by them. And I didn't hear
anything from this panel this morning which changed my opinion.
Thank you very much, Mr. Chairman.
Chairman Boehlert. Well, thank you. And you have not
disappointed us. We have always come to recognize that we get
good, solid recommendations from you.
Thank you very much. This hearing is adjourned.
[Whereupon, at 12:19 p.m., the Committee was adjourned.]
Appendix 1:
----------
Answers to Post-Hearing Questions
Responses by Admiral F.L. ``Skip'' Bowman, Director, Naval Nuclear
Propulsion Program, U.S. Navy
Questions submitted by Representative Ralph M. Hall
Columbia Accident Investigation Board Recommendations
Q1. How will we know that NASA has implemented the Columbia Accident
Investigation Board (CAIB) recommendations? What measures do you use in
your organization to determine that your safety mechanisms are working?
A1. I do not have firsthand knowledge of the pertinent details of
NASA's technology and organization. However, I do note that in many
ways they are different from that of the Naval Nuclear Propulsion
Program (NNPP). Therefore, I cannot provide useful guidance on how to
best determine if the CAIB's recommendations are implemented.
As to how I determine if safety mechanisms are working in my own
Program, I have several methods using many inputs. My staff and I are
personally informed of or briefed on every significant naval nuclear
propulsion plant problem; from this, we determine if additional causes
need to be identified or if additional corrective actions (technical or
administrative) need to be taken. In addition to performing site
inspections, Reactor Safeguards Examinations (RSE), and personal site
or ship visits, my staff and I receive reports from my many field
representatives, from contractor and other Program organizations, and
from commanding officers of nuclear-powered ships. I expect them to
find problems--if they don't, my instincts based on a more than 30-year
career as a nuclear-trained operator tell me that they probably aren't
looking hard enough. Issues identified in those reports are evaluated
to see whether corrective actions (again, either technical or
administrative) are required. Similarly, I expect dissenting opinions
on difficult decisions and if there are no dissenting opinions, my
experience tells me that they haven't asked all the right people for
input. In addition, I frequently insert my own ``dissenting opinions''
(``devil's advocate'') into the discussion and have those carefully
examined. As Admiral Rickover said, ``One must create the ability in
his staff to generate clear, forceful arguments for opposing viewpoints
as well as for their own. Open discussions and disagreements must be
encouraged, so that all sides of an issue will be fully explored.''
My safety inspection process is extensive. Headquarters personnel
at the most senior level personally evaluate performance and compliance
in the field. Headquarters staff conducts regular inspections of work,
safety, and environmental and radiological controls. Headquarters
evaluation teams are made up of the technical-requirements owners (who
are responsible to me for all safety aspects of their areas) for the
particular areas being assessed. This ensures that the evaluation team
has an indepth understanding of not only the requirement, but also its
significance, letting the evaluation team identify issues and trends
that might not be discerned if auditing were done solely by checklist.
Additionally, field office personnel routinely conduct audits and
inspections as part of their responsibility to monitor the work of
Program laboratories, prototypes, the Fleet, shipyards, and prime
contractors. The DOE laboratories, the nuclear-capable shipyards, and
the Fleet also must conduct self-audits, assessments, and inspections.
My Headquarters staff, field office personnel, senior Fleet personnel,
and I then critique these self-reviews, as appropriate.
Of course, the bottom-line measure of the success of the safety
mechanisms is prevention of any event that could affect the health and
safety of the public and Navy personnel or the environment. Therefore,
we don't let near misses or even initiating events pass unchallenged.
The hallmark of a strong safety culture is to look continually and
actively address the minor problems in order to prevent the major
problems.
Q2. The CAIB recommends a separation between the operational aspects
of the Shuttle program and the organizations providing engineering and
safety support. Based on your experience:
Q2a. Do you agree with this as a principle for managing your program?
A2a. In the Naval Nuclear Propulsion Program (NNPP), my Headquarters
and Field Office staff that provides engineering and safety support
also provides operational oversight (as opposed to operational control,
which is assigned to the Fleet for ships and to the Prime Contractors
for their laboratories and prototype reactors). I do not agree with the
principle of completely divorcing all operational aspects of a
technical program from engineering and safety support for that program.
The technical expertise from engineering and safety is necessary in the
proper oversight of operations. Most importantly, I consider it vital
for the technical authority to be one and the same as the safety
oversight to ensure indepth and continuing understanding, awareness,
and ownership of all aspects of design and operation.
For Fleet operations, Headquarters and Field Offices are
responsible for the engineering and safety aspects relating to nuclear
power. The Fleet operates the nuclear-powered warships in accordance
with the safe operating procedures my organization provides them. The
Prime Contractors operate prototype propulsion plants, following
similar procedures. Changes to technical standards or operational
procedures require my Headquarters' approval.
Q2b. Where do you place the boundaries between these three program
elements in your program and how do they interact?
A2b. Within my organization, safety is the responsibility of everyone
at every level: equipment suppliers, contractors, laboratories,
shipyards, training facilities, the Fleet, field offices, and
Headquarters. It is not a responsibility unique to a segregated safety
department that then attempts to impose its oversight on the rest of
the organization. Put another way, safety is mainstreamed. I expect to
be able to ask any of my direct reports about the safety significance
of any action in which they are involved and have them be able to
explain the issues and why the action is satisfactory.
Because of the mainstreaming philosophy, some elements of the
Program (such as shipyards and the Fleet) do not even have a separate
reactor safety department. However, I do have a small group of people
responsible for reactor plant safety analysis, who provide policy
oversight as well as most of the liaison with other safety
organizations (such as the NRC) to help ensure that we are using best
practices. They also maintain the documentation of procedures and
responsibility for the modeling codes used in our safety analyses. They
are full-time safety experts who provide our corporate memory of what
the past problems were, what we have to do to maintain a consistent
safety approach across all projects, and what we need to know about
civilian reactor safety practices. In addition, this group is part of
our technical reviews to ensure that our mainstreamed safety practices
are in fact working the way they should by providing an independent
verification that we are not ``normalizing'' threats to safety.
While safety is mainstreamed throughout the Program, technical
authority is vested in my Headquarters. Any other Program organization
must get my Headquarters' agreement for any changes in technical
standards and operational procedures. Sometimes this requires decisions
that affect ship operations, which is one reason the Director of the
NNPP needs to have a technical engineering background, with career-long
experience in naval nuclear propulsion, and the seniority of a four-
star admiral. Congress recognized this need and enacted it as a
requirement in law.
Q2c. What training and experience do, you require, in your senior
managers, and what incentives do you provide such managers?
A2c. Nearly all of my technical staff at Headquarters came to the NNPP
right out of college and with science or engineering degrees. They
receive NNPP-specific engineering training during their early years
with the Program and continue to receive specialized training
throughout their careers with us. At the end of their initial
obligation, we offer permanent positions to those individuals who in
our judgment have the requisite technical capabilities that best
embrace our cultural values, such as mainstreaming safety. These are
the people that go on to become my senior managers--a great many
spending their entire adult lives and careers in the Program.
My section heads, the senior managers who report directly to me,
have an average of more than 25 years of Program experience. However,
mere longevity is not a requirement: a suitably capable individual with
less time in service could become a section head. I select the best-
qualified personnel as my senior managers.
As a performance measure, safety is not tied to incentives. Rather,
it is a shared value among all engineers within the NNPP. My engineers
won't be promoted to senior positions unless they demonstrate that they
have embraced the importance of safety in their work and have ingrained
this attitude in their subordinates, including fairly and completely
vetting dissenting opinions.
Threats From Minor Problems
Q3. In both Shuttle accidents, NASA failed to appreciate the threat to
the vehicle from what seemed a minor problem--O-ring seals that did not
seem to work well in cold weather and foam that sometimes struck the
Orbiter's thermal protection system.
Q3a. How does your organization deal with similar ``weak signals''?
A3a. In a high-risk environment, there are no guarantees of success,
but our record demonstrates the value of hard work in addressing the
``weak signals.'' As an organization, we do not allow weak signals to
go unanswered. An important part of our technical effort is working on
small problems to prevent bigger problems from occurring. We measure
and track minor deficiencies to identify trends. Then we ask the hard
questions on even apparently minor issues: What are the facts? How do
you know? Who is responsible? Who else knows about the issue and what
are they doing about it? What other ships or activities (e.g., the labs
or prototypes) could be affected? What is the plan? When will it be
completed? Is this within our design, test, and operational experience?
What are the expected outcomes? What is the worst that could happen?
What are the dissenting opinions? These and other questions like them
help us to solve the problem at hand before it gets worse. As an
example, I personally read letters (required at least quarterly) from
each of the commanding officers of our 82 nuclear-powered warships. I
look for these ``weak signals'' in their reports and flag them to
cognizant headquarters personnel for resolution through this process.
Additionally, my Headquarters and field organizations conduct periodic
inspections in the field to determine the effectiveness of the
individual activities in identifying, assessing, and resolving such
deficiencies.
Q3b. How does your organization evaluate problems to determine if they
represent recurring failures that require changes in design or
processes if they are to be dealt with? Who conducts those evaluations?
A3b. Even minor problems under Headquarters' consideration require
formal and disciplined review, together with official action and
resolution correspondence signed by the cognizant Headquarters
engineers. Any issue that, in our view, could recur and have
undesirable consequences is assessed for the need for corrective action
by my Headquarters staff. Where my staff concludes that action is
warranted, I task the prime contractor laboratories with further
assessment and with recommending corrective action. If the issue is
time-sensitive, the Naval Nuclear Propulsion Program (NNPP) will
immediately issue guidance by naval message to any ships or in writing
to any training reactors that may be affected.
Q3c. For recurring problems, does your organization have the
capability to analyze the trend to determine if it could contribute to
a low-probability, high-consequence accident?
A3c. The Naval Nuclear Propulsion Program (NNPP) conducts extensive
self-audits and performs various analyses of trends. Multiple
organizations (my Headquarters organization, Nuclear Propulsion
Examining Boards, Fleet headquarters, type commanders, naval squadrons,
shipyards, and laboratories) are notified when problems arise and can
call for further evaluation and correction based on recognition of a
trend or precursor event requiring correction. Put simply, recurring
problems aren't ``normalized.'' We do everything we can to engineer
them out of our system before they become major issues.
Q3d. How much certainty would your organization require to take action
in a case where your relevant technical expert strongly believed a
catastrophe could occur but did not have the engineering evaluations to
confirm that judgment--and little or no time to conduct such
evaluations?
A3d. To determine the relative importance of individual discrepancies,
I rely on my engineering judgment and that of my experienced managers
and engineers throughout the Program. If there were a strong belief,
even if only by a single individual, those unacceptable consequences
are a possibility, the issue would be attacked at: the technical level
by my DOE labs and Headquarters experts and then discussed with me. All
relevant technical facts would be presented, and an appropriately
conservative course, balanced by military necessity, would then be
chosen. This would not always mean that the reactor, and therefore the
ship, must stand down from operation, but it might require additional
operational precautions that suitably offset the situation under
consideration. The Director, as a four-star admiral with a career of
nuclear experience and a long tenure (the law stipulates eight years),
is essential to making this come out right. Engineering is not an exact
process--there is no single absolutely correct answer to every problem.
The NNPP, as instituted by Admiral Rickover and as it continues to this
day, embraces the philosophy that airing dissenting opinions helps
invigorate the technical evaluation process and minimize the chance
that a technically significant issue is overlooked.
Question submitted by Representative Bart Gordon
Operational and Developmental Safety Structures
Q1. Does it matter in your organization whether a vehicle or product
is deemed ``operational'' versus ``experimental/developmental''? Do you
have a different safety structure for operational activities versus
those that are developmental in nature?
A1. Our safety structure and processes are independent of the
operational designation of the product. However, the margin of
conservatism will be even greater when we are dealing with a
developmental system. We test components, subsystems, and then systems
(often to the point of failure in tests prior to ships' use), to ensure
that unexpected results are minimized in operational warships. We then
thoroughly test the ships and crew pier side to confirm the
acceptability of the systems and the training of the crew. When I take
a ship to sea for the first time, on sea trials in which I directly
participate, I confirm that both the propulsion plant and crew are
fully capable and ready to join the Fleet. Once a ship is in
commission, it is deemed ``operational''--regardless of whether it is
the first or the last of a class.
Questions submitted by Representative Nick Lampson
Safety at Every Level
Q1. Admiral Bowman testified that, ``Safety is the responsibility of
everyone at every level in the organization,'' a sentiment echoed by
Ms. Grubbe in her statement--but in day-to-day program activities,
safety is not a primary metric for measuring performance. Safety
usually becomes an issue only after it is clearly seen to be absent.
What specific actions does your organization take to maintain the focus
on safety when the pressures to achieve organizational goals inevitably
build?
A1. Safety is an overarching organizational goal. We recognize that the
ability of the Navy to operate nuclear-powered warships in over 150
ports of call in more than 50 countries around the world is based on
the trust we have earned and maintained by safely steaming over 129
million miles. If we do not deliver and maintain safe naval nuclear
propulsion plants, we have failed our crews, our Navy, and our country.
Everyone in the Naval Nuclear Propulsion Program (NNPP) understands
this. We all understand (and are trained in this from our first day in
the NNPP) that the only acceptable answer is the technically correct
solution. We also recognize that no technology is risk-free. We
benchmark actions against requirements and past practices, require that
a design or change be proven technically correct, and identify any
alternatives. If the only technically safe acceptable action is one
that affects cost and schedule to an extent that cannot be accommodated
within available resources or schedule, we slow the schedule and/or add
the additional resources.
Additionally, the very fabric of my Headquarters organization
ensures that safety is mainstreamed for the long haul. Headquarters
personnel are handpicked and have a common broad heritage of technical
Program training and experience that permit the necessary esprit de
corps and shared values. These factors (together with the independence
of our technical authority from others in the Navy who are primarily
charged with ``cost, schedule, and mission'') permit us to provide
effective direction and oversight. Safety is not just a way to measure
performance: it's the result of a process that must be followed from
start to finish if we are to achieve the desired result.
Technical Authority and Safety Assurance
Q2. In your organization, do you have units performing the functions
of an independent technical authority and office of safety assurance?
How do they interact within your organization? If you don't, why not?
A2. In my DOE ``hat,'' my Headquarters is the absolute technical
authority for all naval reactor plants. Therefore, any other
organization must get my Headquarters' agreement for any changes in
technical standards and operational procedures. Sometimes this requires
decisions that affect ship operations, which is one reason the director
of the Naval Nuclear Propulsion Program (NNPP) needs the seniority of a
four-star admiral. Congress recognized this need and enacted it as a
requirement in law.
I don't separate technical authority and safety assurance. They are
part and parcel of the same process. For the Navy, my organization is
responsible for the engineering and safety aspects relating to nuclear
power. The Fleet operates the nuclear-powered warships in accordance
with safe operating procedures my organization provides them. In the
NNPP, the same staff that provides engineering and safety support also
provides operational oversight (as opposed to the Fleet's operational
control). Safety is the responsibility of everyone at every level of
the Program. In other words, safety is mainstreamed. It is not a
responsibility unique to a segregated safety department that then
attempts to impose its oversight on the rest of the organization. This
is the only way safety can be ensured effectively, since no separate
office of safety can have the depth of technical knowledge and
personnel resources to cover an entire, complex technical program in
the detail necessary to fulfill a safety responsibility.
Although the various elements of the Program (such as shipyards and
the Fleet) do not have a separate reactor safety department, I do have
a small group of people responsible for reactor plant safety analysis.
They provide policy oversight as well as most of the liaison with other
safety organizations (such as the Nuclear Regulatory Commission) to
help ensure that we are using best practices. They also maintain the
documentation of procedures and upkeep of the modeling codes used in
our safety analyses. As full-time safety experts, they provide our
corporate memory of what the past problems were, what we have to do to
maintain a consistent safety approach across all projects, and what we
need to follow in civilian reactor safety practices. By providing an
independent verification that we are not ``normalizing'' threats to
safety, each additional group involved in a technical review also
ensures that our mainstreamed safety practices are in fact working the
way they should.
Questions submitted by Representative Sheila Jackson Lee
Safety Training and Awareness
Q1. How is safety training done in your organization? How is safety
awareness maintained in your organization? Please describe the kinds of
training materials you use.
A1. Allow me to break my answer into elements dealing with my
Headquarters and the U.S. Navy Fleet.
Safety awareness is built into every part of our work, including
our extensive training programs. Thorough training minimizes problems,
results in quick and efficient responses to issues, and helps ensure
safety. At my Headquarters, I select the best graduate engineers I can
find, with the highest integrity and the willingness to accept complete
responsibility for every aspect of nuclear-power operations. After I
hire them, the training they need to be successful begins immediately.
All members of my technical staff undergo a technical indoctrination
course during their first several months at Headquarters. Next, they
spend two weeks at one of our training reactors (prototypes), learning
about the operation of the reactor and observing and participating in
the training our Fleet sailors are undergoing. This involves an actual,
operating reactor plant, not a simulation or a PowerPoint
presentation--and it is an important experience. It gives them an
understanding that the work they do affects the lives of the sailors
directly, while they perform the Navy's vital national defense role.
This direct experience helps reinforce the tenet that the components
and systems we provide must perform when needed.
Shortly after our new people return from the training reactor, they
spend 6 months in residence at one of our DOE laboratories, completing
an intensive, graduate-level course in nuclear engineering. Once that
course is complete, they spend three weeks at a nuclear-capable
shipyard, observing production work and work controls. Finally, they
return to Headquarters and are assigned to work in one of our various
technical jobs. They then attend a six-month series of seminars on a
wide range of technical and regulatory matters, led by the most
experienced members of my staff. Each of these training experiences is
saturated with the principles of reactor safety through high quality
assurance of plant material, conservative design, and verbatim
adherence to procedures.
At Headquarters, there is a continual emphasis on professional
development. We typically provide training courses that are open to the
entire staff each month on various topics, technical and non-technical.
In particular, we have many interactive training sessions on lessons
we've learned--mistakes that we, or others, have made--in order to
prevent similar mistakes in the future. These sessions teach both the
specific issues and the right questions to ask.
Throughout their careers, the members of my staff are continually
exposed to the end product, spending time on the waterfront, at the
shipyards, in the laboratories, at the vendor sites, or interacting
directly with the Fleet. In addition, the constant interaction among
Headquarters personnel provides me with an arsenal of individuals who,
though charged with responsibilities in specific areas, are capable and
knowledgeable of overarching Program interests and are expected to act
accordingly. Every one of these activities and perspectives emphasizes
the vital role of safety.
My responsibilities also include training the operators of nuclear-
powered warships. I require both officer and enlisted operators to
undergo 6 months of formal academic instruction in nuclear propulsion
theory and technology, followed by 24 weeks of hands-on operational and
casualty training at an operating prototype or moored training ship
(MTS). Even after completing this training and qualification as an
operator at a prototype or MTS, personnel must completely requalify
(including familiarization steps and watch standing under instruction)
on the ship to which they are assigned before they are permitted to man
a propulsion plant watch station on that ship. For both officer and
enlisted nuclear-trained personnel, there is continuing training and
required periodic requalification in the Fleet throughout their
careers. My prime contractor personnel who operate the prototype
reactors get equivalent training.
For the officers, a significant milestone in their career path is
qualification as an engineer officer. This signifies an officer has
obtained sufficient knowledge to supervise safe, effective maintenance
and operation of the ship's propulsion plant. When the commanding
officer (CO) is satisfied with a junior officer's knowledge level, he
recommends him or her to take the Engineer's Examination. The
Engineer's Examination is administered at my Headquarters and consists
of a written examination (about five hours long) and at least two
detailed technical interviews. I personally approve qualification of
each engineer officer. The best of these junior officers are
subsequently assigned to submarines as the engineer officer or to
aircraft carriers as a principal assistant to the reactor officer.
The commanding officer (CO) is charged with the absolute
responsibility for all aspects of ship operation, including safe and
effective operation of the reactors. Personnel who become COs of
nuclear-powered submarines are all Engineering Officer of the Watch
qualified with about 17 years of experience in the Navy. They have
qualified as an engineer officer on a nuclear-powered submarine, have
served as an executive officer and have successfully completed an
intense, technical/safety course during a three-month Prospective
Commanding Officer School at Naval Nuclear Propulsion Program
Headquarters.
The path for becoming a CO of a nuclear-powered aircraft carrier is
similar. Personnel who become COs of a nuclear-powered aircraft
carriers are Engineering Officer of the Watch qualified officers with
over 20 years of experience in the Navy. They have completed a three-
month Prospective Commanding Officer School at Naval Nuclear Propulsion
Program Headquarters and have served as an executive officer on a
nuclear-powered aircraft carrier.
Every segment of every training experience for both Headquarters
and Fleet personnel emphasizes the absolute need for ``safety first.''
Lessons learned from historical problems are discussed in detail. The
conservative design of our plants and the need for strict adherence to
written, formal procedure is taught and tested. There is no confusion
regarding our philosophy that safety comes first.
Safety Audit Process
Q2. Please describe your safety audit process. What is its scope? How
often is it done? Who does it? To whom, are the results reported? What
is done with the results?
A2. My safety inspection process is extensive. Inspection and
corrective action follow-up are essential aspects of being the
technical authority for the Program and its current 103 reactor plants.
Headquarters personnel at the most senior level personally evaluate
performance and compliance in the field. Headquarters staff conducts
regular inspections of work, safety, environmental and radiological
controls. Additionally, field office personnel routinely conduct audits
and inspections as part of their responsibility to monitor the work of
Program laboratories, prototypes, the Fleet, shipyards, and prime
contractors. The DOE laboratories, the nuclear-capable shipyards, and
the Fleet also conduct self-audits, assessments, and inspections at
almost every organizational level. These reviews are then critiqued by
Headquarters, field office, and senior Fleet personnel (as appropriate)
and then reported to me. An important part of these reviews is
evaluating the activity's ability to look critically at itself--in
keeping with the principle that each activity must identify, diagnose,
and resolve its own problems when outside inspectors are not present to
do so. This effort, along with other requirements, makes clear that
day-to-day excellent performance must be the goal (and the norm), not
merely ``peaking'' for an annual audit or inspection. In fact, my
evaluation teams make ``inadequate self-assessment'' a finding of its
own, when appropriate. My teams will then closely follow the efforts of
activity management to improve this crucial ability.
Headquarters evaluation teams always include the technical-
requirements owners for the particular areas being assessed. This
ensures that the team has an indepth understanding of not only the
requirement, but also its significance, letting the evaluation team
identify issues and trends that might not be discerned if auditing were
done solely by checklist. My field offices, largely composed of
qualified personnel drawn from the Fleet and from Headquarters, are
located at all major Program sites and at each Navy Fleet concentration
area.
The Naval Nuclear Propulsion Program (NNPP) continually evaluates
operational information for trends and lessons learned. For example, my
staff annually assesses--and I personally review plant-aging concerns
to ensure that trends in equipment corrosion, wear, and maintenance
performance are acceptable.
To meet regulatory responsibilities for oversight of nuclear-
powered warship operations, the NNPP relies in part on the Nuclear
Propulsion Examining Board (NPEB). The NPEB, comprising nuclear-trained
officers who have served as commanding officers or engineer officers of
nuclear-powered warships, performs annual Operational Reactor
Safeguards Examinations (ORSE) and inspects the material condition of
each plant in the Fleet. During an ORSE, the NPEB reviews documentation
of normal operation (including operational, maintenance, and crew
training records); observes and assesses current plant operations (both
normal and in response to casualty drills); and reviews any off-normal
events that may have occurred during the preceding year. The NPEB
reports directly to me in parallel with the command authority for that
ship (the Fleet Commander). As discussed above, the ship's day-to-day
performance and ability to self-assess are emphasized through
evaluation of records, training, evolutions, lessons learned, and
overall plant conditions. If ships do not meet standards, they would
have their authorization to operate removed until they are upgraded,
reexamined, and deemed satisfactory.
Dissenting Opinions
Q3. In your organization, is there a channel specifically for
dissenting opinions?
Q3a. How do you generate a dissenting opinion in a case where a strong
technical consensus exists? What prevents that from becoming an empty
exercise?
Q3b. How would a dissenting technical opinion be evaluated?
A3a,b. There are several channels through which individuals can air
dissenting opinions. At my prime contractor laboratories, any
dissenting opinion must be documented, along with a discussion of the
reason why the majority opinion is being recommended. (In some cases
the process results in the formerly ``dissenting'' opinion becoming the
recommended approach.) In the case of a dissenting opinion that could
affect safety, further analysis and discussion are required to attempt
to reach a satisfactory resolution. If the dissenter is not satisfied,
the recommended action must be agreed to by the laboratory general
manager, and the dissenting opinion is documented in the recommendation
to me with an explanation as to why it was not accepted. This allows my
staff and me to see that dissenting opinion firsthand as we evaluate
the recommendation.
Similarly, within Headquarters, if a dissenting opinion is not
resolved, the issue must be cleared with me. When I discuss a complex
issue, I frequently ask if there were any dissenting opinions to ensure
that personnel have the opportunity to air any remaining concerns. If I
am satisfied that I have enough data to make an informed decision, I
will do so. In any other case, I will request additional information or
the involvement of additional personnel to help me reach the correct
technical decision.
Q3c. In cases where dissenting opinions question the safety of reactor
operations for a ship (or class of ships) deployed and operating, are
reactors immediately shut down or is a risk assessment performed to
determine whether operations can continue?
A3c. Nuclear-powered warships are designed to survive under battle
conditions. The inherent conservatism and redundancy built into these
ships, along with the extensive training provided every operator, make
it highly unlikely that any unexpected problem will pose an immediate
threat to public or environmental safety. If such an unlikely problem
ever were to occur, we would balance the multiple safety
responsibilities of reactor, crew, ship, and public safety. Where there
is a reactor safety concern, we immediately determine whether the
problem is likely to occur, the potential consequences, its potential
impact on ship operations and safety, and any alternatives that may
mitigate the problem. Since our designs include significant redundancy,
shutting down all or part of the reactor plant system of concern might
still allow safe operation of the reactor. If necessary, the reactor
would be shut down and the problem repaired, even at sea.
Q3d. While dissenting opinion may be welcomed in the Naval Reactors
program, how do you demonstrate to new junior officers that expressing
such opinions will not create problems for their careers in the Navy
outside the program--particularly if that opinion is left unsupported
by later analysis?
A3d. In the Fleet, dissenting opinions are raised through the chain of
command. Dissenting opinions are not just welcomed, they are highly
valued. For the Fleet, asking questions and raising concerns is
highlighted during training for junior officers and enlisted personnel
from their first day in the Program. In fact, we teach and require
forceful backup. If expected indications and conditions are not
observed during an evaluation, other members of the watch team are
required to point that out. There cannot be any fear of reprisal for
raising concerns or issues. The best proof of this is our record. I
can't think of a single example when a junior officer brought up a
safety issue and it created a problem for that officer's career. On the
contrary, if an officer of any rank is aware of a safety issue and
doesn't bring it up, that officer would be held accountable.
Answers to Post-Hearing Questions
Responses by Rear Admiral Paul E. Sullivan, Deputy Commander, Ship
Design, Integration and Engineering, Naval Sea Systems Command,
U.S. Navy
Questions submitted by Representative Ralph M. Hall
NASA Implementation of Investigation Board Recommendations; SUBSAFE
Program Measures
Q1. How will we know that NASA has implemented the Columbia Accident
Investigation Board (CAIB) recommendations?
A1. Respectfully, this question may be best posed to the CAIB, or
similar independent board. As a practical matter, it is beyond the
purview of the Naval Sea Systems Command (NAVSEA) to monitor NASA's
implementation of the CAIB recommendations, and therefore, we are
unable to offer a substantive response in this area. However, as noted
in my testimony, NAVSEA is a continuing participant in the NASA/Navy
Benchmarking Exchange. To that extent, we are engaged in the process of
sharing information with NASA on all aspects of the Submarine Safety
(SUBSAFE) Program, so that NASA itself can evaluate the potential
adaptability of any part of the SUBSAFE Program to the NASA Safety
Program.
Q1a. What measures do you use in your organization to determine that
your safety mechanisms are working?
A1a. The Navy uses a tiered approach to ensure Submarine Safety
(SUBSAFE) Program safety mechanisms are working. The Naval Sea Systems
Command Submarine Safety and Quality Assurance Office (NAVSEA 07Q) has
overall responsibility for overseeing the SUBSAFE Program and verifying
compliance with its requirements.
The purpose of the SUBSAFE Program is to provide
maximum reasonable assurance of a submarine's watertight
integrity and its ability to recover from a flooding casualty.
It is important to note that the SUBSAFE Program does not
spread or dilute its focus beyond this purpose. The technical
and administrative requirements of the SUBSAFE Program are
applied specifically to a carefully defined set of ship systems
and components that are critical to the safety of the
submarine. The tenets of the SUBSAFE Program are invoked in a
submarine's initial design, through construction and initial
SUBSAFE Certification, and throughout its service life.
The first tier of the SUBSAFE Program is a Quality
Program at each activity that performs SUBSAFE work. Each
facility is required to have a quality system such as that
defined by MIL-Q-9858 (Quality Program Requirements) or ISO
9000, etc. The quality assurance organization at each facility
plays a key role in validating compliance with SUBSAFE Program
requirements and in compiling the objective quality evidence
necessary to support SUBSAFE certification. A local SUBSAFE
Program Director (SSPD) provides oversight for work at each
facility and is responsible for independently verifying
compliance with the SUBSAFE Manual requirements. At private
contractor shipbuilding facilities, a U.S. Navy Supervisor of
Shipbuilding, Conversion and Repair (SUPSHIP) organization is
also assigned to monitor compliance with SUBSAFE work and
process requirements.
The second tier is the SUBSAFE audit program. NAVSEA
07Q audits the policies, procedures and practices at each
facility as well as the effectiveness of the oversight provided
by the local SSPD and SUPSHIP. There are two types of audits:
(1) the Functional Audit, which evaluates the organization's
programs and processes for compliance with SUBSAFE
requirements; and (2) the Ship Certification Audit, which
evaluates the work and processes used to overhaul or construct
each individual submarine for compliance with SUBSAFE
requirements prior to SUBSAFE certification.
The final tier is program oversight. Several
organizations provide forums for program evaluation, process
improvement, and senior level oversight. The SUBSAFE Working
Group, chaired by the Director of the Submarine Safety and
Quality Assurance Office (NAVSEA 07Q), is comprised of NAVSEA,
field activity and contractor SSPDs and meets semi-annually to
review program status and discuss recommendations for
improvement. The SUBSAFE Steering Task Group, chaired by the
NAVSEA Deputy Commander for Undersea Warfare (NAVSEA 07),
reviews program progress and provides policy guidance for the
SUBSAFE Program. The SUBSAFE Oversight Committee, chaired by
the NAVSEA Vice Commander (NAVSEA 09), provides independent
command-level oversight of the SUBSAFE Program to ensure the
purpose and intent of the SUBSAFE Program are being met.
Separation Between Operational Aspects of Program and Organizations
Providing Engineering and Safety Support
Q2. The CAIB recommends a separation between the operational aspects
of the Shuttle program and the organizations providing engineering and
safety support. Based on your experience:
Q2a. Do you agree with this as a principle for managing your program?
A2a. Yes. The separation of Program Management, the Technical
Authority, and the Safety Organization has proven an effective approach
for the Navy's Submarine Safety (SUBSAFE) Program during the last 40
years.
Q2b. Where do you place the boundaries between these three program
elements in your program and how do they interact?
A2b. The three groups--Program Management, Technical Authority, and
Safety Organization--work together to discuss issues and reach
agreement on final decisions. However, each has its own authority and
responsibility:
The Program Manager has overall authority and
responsibility for the success of his program (Quality, Cost,
Schedule). However, the Program Manager is not a technical
authority and may not make technical decisions unilaterally.
The Program Manager has the authority to choose among the
technically acceptable solutions provided by the Technical
Authority.
The Technical Authority bears ultimate responsibility
for the adequacy of the technical solutions provided to the
Program Manager.
The Safety Organization has the authority and
responsibility to ensure that compliance with SUBSAFE Program
requirements is achieved. The Safety Organization is staffed
with engineers giving it the acumen to understand the technical
issues and providing it with the credentials to challenge the
Technical Authority and the Program Manager when appropriate.
Q2c. What training and experience do you require in your senior
managers, and what incentives do you provide such managers?
A2c. Senior managers are hand picked based on detailed submarine
experience. Senior managers receive continuous training on safety and
participate in the audit process. Our senior managers, military and
civilian, are required to achieve a broad scope of experience and
formal training as they progress in their career. Both the Navy and the
Office of Personnel Management establish supervisory and management
training programs to enhance career paths and assist in developing the
knowledge, skills and abilities necessary to achieve success in the
senior management levels of the Naval Sea Systems Command (NAVSEA) and
the Navy.
Recognition and Analysis of Safety Threats
Q3. In both Shuttle accidents, NASA failed to appreciate the threat to
the vehicle from what seemed a minor problem--O-ring seals that did not
seem to work well in cold weather and foam that sometimes struck the
Orbiter's thermal protection system.
Q3a. How does your organization deal with similar ``weak signals''?
A3a. Dealing with and resolving ``weak signals'' before they become
major problems, or even disasters, is very difficult for a large
organization. It requires constant vigilance. These signals get missed
when people become complacent and accept seemingly minor unsatisfactory
conditions. As I noted in my testimony, our review of the Submarine
Safety (SUBSAFE) Program during the 1985-86 timeframe noted an
increasing number of incidents and breakdowns that raised concerns
about the quality of SUBSAFE work and thus, the level of discipline
with which that work was being performed. As a result, we established
additional program requirements and actions to improve the
understanding of SUBSAFE Program requirements, to provide increased
emphasis on oversight, and to find problems and fix them. They are
still in place today, but personal vigilance is still required as the
potential exists for complacency to creep into any organization. For
example, less than two years ago, we nearly lost the USS DOLPHIN (AGSS
555) to a flooding casualty. While it was not a SUBSAFE issue, the
casualty was due, in part, to allowing a less than acceptable condition
to exist that made it easier for water to enter the submarine when
transiting on the surface. Only the skills and exceptional action on
the part of the well-trained crew prevented disaster. Although crew
selection and training aren't part of SUBSAFE, the Navy gives them the
appropriate level of attention to ensure the crews are highly trained,
competent and motivated. Corrective and other follow-up actions are
still in progress from the incident.
Q3b. How does your organization evaluate problems to determine if they
represent recurring failures that require changes in design or
processes if they are to be dealt with? Who conducts those evaluations?
A3b. We have several formal programs for evaluating failures and
conditions that may require program or design changes. Periodic
inspections and tests are required to be performed to validate that the
condition of the submarine and its critical components support
continued unrestricted operation. The results of these inspections and
tests are tracked over time and across submarines to ensure conditions
are not degrading. During component major maintenance or overhaul, the
conditions found must be documented and reported for technical
evaluation, again, to determine if any unexpected degradation may be
occurring and to maintain a history, that is used to evaluate the need
for maintenance program or design changes. Audits of facilities and
submarines are conducted to evaluate performance and acceptability of a
submarine for SUBSAFE certification. During the service life of a
submarine and facility, problems or failures may occur that are outside
the scope of the formal inspection and audit programs. These are
required to be formally investigated and reported to Naval Sea Systems
Command (NAVSEA) as Trouble Reports. The results of audits and Trouble
Reports are tracked, maintained and trended over time, and are used to
evaluate the health of program and determine if changes are required or
appropriate to consider. Responsibility for these programs, including
implementation of changes, is assigned to specific offices or
organizations within NAVSEA. However, recommendations for significant
changes in technical requirements or program procedures are reviewed
and concurred with by members of the Technical Authority, Program
Manager and Safety Offices.
Q3c. For recurring problems, does your organization have the
capability to analyze the trend to determine if it could contribute to
a low-probability, high-consequence accident?
A3c. Trending and analysis are an integral part of the Submarine Safety
(SUBSAFE) Program and are used to guide future actions. In addition, an
annual SUBSAFE Program assessment is prepared with input from SUBSAFE
Working Group members, and is briefed to the SUBSAFE Steering Task
Group and the SUBSAFE Oversight Committee. Hazard analyses of specific
conditions or component or system operations are conducted when
warranted to assess risk and potential consequence, and to determine
what actions must be taken to mitigate risk if the condition is to be
allowed to exist.
Q3d. How much certainty would your organization require to take action
in a case where your relevant technical expert strongly believed a
catastrophe could occur but did not have the engineering evaluations to
confirm that judgment--and little or no time to conduct such
evaluations?
A3d. When we identify a significant technical/safety concern, the
normal approach is to suspend work, testing, or ship deployment until
the relevant engineering evaluations are obtained. For a significant
and imminent wartime condition or situation, a risk assessment would be
presented to the Fleet Type Commander for decision.
Questions submitted by Representative Bart Gordon
Operational vs. Developmental Safety Structure
Q1. Does it matter in your organization whether a vehicle or product
is deemed ``operational'' versus ``experimental/developmental''? Do you
have a different safety structure for operational activities versus
those that are developmental in nature?
A1. No, Submarine Safety (SUBSAFE) Program requirements are invoked in
design contracts and construction contracts, including those for
experimental or developmental items placed on our submarines. The
SUBSAFE Program structure is the same whether an item is operational or
developmental.
Dealing with Downsizing and Aging Workforce Challenges
Q2. You mentioned in your written testimony the challenge you faced in
1998 with downsizing and an aging workforce. Please describe the
magnitude of the problem and the steps you took to maintain the
integrity of the SUBSAFE Program in the face of this challenge? How are
you dealing with these problems?
A2. Over the past decade, the Naval Sea Systems Command (NAVSEA) has
undergone a significant loss of experience and depth of knowledge due
to downsizing and an aging workforce. The size of the independent
technical authority staff at NAVSEA headquarters has been reduced from
1300-1400 people in 1988 to approximately 300 today. Beginning in 1995,
NAVSEA undertook an approach to provide continued support of critical
defense technologies with a smaller Headquarters workforce. This was
accomplished through the development of a war-fighting system
engineering hierarchy that defined the necessary engineering capability
requirements. NAVSEA began to refocus our workforce on core equities or
competencies:
Setting technical standards and policies,
Certifying and validating delivered products, and
Providing a vision for the future, i.e., technology
infusion and evolution.
NAVSEA also initiated a recruitment program to hire engineering
professionals, primarily in our field activities, but headquarters
engineering staff continued to decrease.
As a result of the noted reduction in NAVSEA headquarters
independent technical authority staff over the past 15 years, we have
remained continuously engaged in balancing the need to maintain our
culture of safety while becoming more efficient.
NAVSEA currently is contemplating modest increases in staffing in
the independent technical authority and SUBSAFE and quality assurance
organizations to manage the increasing SUBSAFE workload in design,
construction and maintenance, and to bolster and renew the workforce as
our older experts retire.
Questions submitted by Representative Nick Lampson
Specific Actions to Maintain Focus on Safety
Q1. Admiral Bowman testified that, ``Safety is the responsibility of
everyone at every level in the organization,'' a sentiment echoed by
Ms. Grubbe in her statement--but in day-to-day program activities,
safety is not a primary metric for measuring performance. Safety
usually becomes an issue only after it is clearly seen to be absent.
What specific actions does your organization take to maintain the focus
on safety when the pressures to achieve organizational goals inevitably
build?
A1. First, Admiral Bowman and Ms. Grubbe are correct. The culture of
safety must be instinctive. Training, instructions and written
performance requirements are not enough to ensure safety. In the final
analysis, each person who operates, designs, constructs, maintains or
tests submarines must have the culture of safety as part of his or her
basic work ethic. This culture is instilled in our sailors from the
first day of submarine basic training, and in the civilian workforce by
continuous grooming from their leaders. It is reinforced for all by
periodic mandatory Submarine Safety (SUBSAFE) training.
Second, we cannot afford for safety to become ``absent'' and we
work constantly to ensure that does not happen. We do that by keeping
the requirements of our Submarine Safety (SUBSAFE) Program visible at
all levels. Critical safety requirements and implementation methods are
clearly defined. These safety requirements are protected regardless of
pressures. Program Managers cannot tailor them or trade them against
other technical or programmatic variables. The Technical Authority and
the Safety Office do not compromise the technical or safety
requirements to relieve a Program Manager's schedule or cost pressures.
This separation of Program Management, the Technical Authority and the
Safety Office has proven to be an effective organizational structure in
support of Submarine Safety. Our routine SUBSAFE training includes
lessons learned with strong emotional ties. Our SUBSAFE audit programs
focus on technical and safety compliance and provide additional
visibility to the importance of safety.
Finally, for the U.S. Navy Submarine Force, safety IS an
organizational goal. It is tracked carefully and reviewed frequently by
senior management, and corrective action is rapid.
Lessons from the Challenger Accident
Q2. What lessons does the Navy take away from its review of the
Challenger accident?
A2. As noted in my testimony, the Challenger accident occurred at the
same time the Naval Sea Systems Command (NAVSEA) was conducting an in-
depth review of the Submarine Safety (SUBSAFE) Program. The Challenger
accident gave added impetus to, and helped focus our effort in, several
critical areas: disciplined compliance with requirements, thoroughness
and openness of technical evaluations, and formality of our readiness
for sea certification process.
As a result of our review, we have: maintained increased visibility
on mandatory and disciplined compliance with requirements and
standards; upgraded our engineering review system (technical authority)
to ensure responsibilities and expectations for thorough engineering
reviews with discipline and integrity are clear; and established a
safety and quality assurance organization with the authority and
organizational freedom to function without external pressure. We use
annual training with strong, emotional lessons from past failures to
ensure that all members of the Navy's Submarine community fully
understand the need for constant vigilance in all SUBSAFE matters.
NASA/Navy Benchmarking Exchange
Q3. Please provide your impression of the NASA/Navy Benchmarking
Exchange (NNBE) undertaken in August of 2002. What specific plans, if
any, are there for continuing this interaction? What changes in this
interaction do you anticipate because of the Columbia accident?
A3. The NNBE has been a valuable process for both NASA and the
submarine Navy. Two reports outlining the results of the NNBE to date
have been issued, the first in December 2002 and the second in July
2003. After the loss of Columbia, NNBE activity was temporarily placed
on hold to allow NASA to focus on the accident investigation. Specific
exchanges under the NNBE process since the Columbia accident have
included Navy presentations to the NASA Engineering and Safety Center
Management Team and to the SUBSAFE Colloquium held at NASA headquarters
in November 2003. On December 2, 2003, both parties signed a Memorandum
of Agreement for participation in engineering investigations and
analyses. A Memorandum of Agreement for participation in Functional
Audits is currently being developed and is scheduled to be signed in
early 2004. In the NNBE forum, we have initiated exchanges regarding
processes for specification control, waivers to requirements, life
cycle extension, software safety and human systems integration. More
detailed discussions on these common processes are planned in 2004. We
also expect benefits from planned collaboration of technical experts in
welding, materials, life support and other areas of special interest.
Questions submitted by Representative Sheila Jackson Lee
Safety Training
Q1. How is safety training done in your organization? How is safety
awareness maintained in your organization? Please describe the kinds of
training materials you use.
A1. The Submarine Safety (SUBSAFE) Manual requires that organizations
performing SUBSAFE work establish and maintain procedures for
identifying training needs and provide for the training of all
personnel performing activities affecting SUBSAFE quality. This
requirement includes periodic SUBSAFE Awareness training. During
Functional Audits of these organizations we evaluate the adequacy of
training programs and the level of knowledge of personnel performing
SUBSAFE work. Our SUBSAFE requirements are generally integrated into
specific technical process or work-skill training. This training and
its periodicity are established and provided by each organization to
meet its needs for the work it performs.
One of the keys to SUBSAFE Program awareness is the fact that many
of the senior Navy and civilian managers and personnel have either
served aboard or temporarily embarked on submarines during their
careers. This ``underway'' experience, in addition to regular visits to
submarines undergoing construction, repair or maintenance, fosters a
heightened level of understanding in program management that is
important to maintaining the requisite level of vigilance and
visibility for SUBSAFE matters.
SUBSAFE Program Awareness Training is usually given on an annual
basis. It consists of a review of requirements, a brief history of the
SUBSAFE Program and a discussion of recent relevant program events,
e.g., changes, problems, and failures (and their causes). SUBSAFE
training beyond the annual awareness training takes a variety of forms.
Web-based training is becoming the most common. This is supported by
classroom lecture and discussion. Skills-training takes the same form
and is supplemented by practical exercises and on-the-job training. By
combining personal experience, training and our requirements in this
way, we keep the SUBSAFE Program and its requirements visible to and
fresh in the minds of the Navy's Submarine community personnel, ashore
and afloat.
Safety Audit Process
Q2. Please describe your safety audit process. What is its scope? How
often is it done? Who does it? To whom are the results reported? What
is done with the results?
A2. There are two primary types of audits in the Submarine Safety
(SUBSAFE) Program: Certification Audits and Functional Audits.
In a SUBSAFE Certification Audit, we look at the Objective Quality
Evidence associated with an individual submarine to ensure that the
material condition of that particular submarine is satisfactory for sea
trials and unrestricted operations. These audits are performed at the
completion of new construction and at the end of major depot
maintenance periods. They cover a planned sample of specific aspects of
all SUBSAFE work performed, including inspection of a sample of
installed equipment. The results and resolution of deficiencies
identified during such audits become one element of final Naval Sea
Systems Command (NAVSEA) approval for sea trials and subsequent
unrestricted operations.
In a SUBSAFE Functional Audit, we periodically--either annually or
bi-annually depending on the scope of work performed--review the
policies, procedures, and practices used by each organization,
including contractors, that performs SUBSAFE work. The purpose is to
ensure that those policies, procedures and practices comply with
SUBSAFE requirements, are healthy, and are capable of producing
certifiable hardware or design products. This audit also includes
surveillance of actual work in progress. Organizations audited include
public and private shipyards, engineering offices, the Fleet, and
NAVSEA headquarters.
Audits are performed by a team of 12 to 25 auditors, led by the
NAVSEA Submarine Safety and Quality Assurance Office (NAVSEA 07Q).
Auditors are experienced subject matter experts drawn from NAVSEA and
our field organizations that perform SUBSAFE work, e.g., shipyards,
engineering offices, etc. To ensure consistent and thorough coverage of
the areas of concern, audits are conducted using formal audit plans or
guides. In functional audits, guides are supplemented with pre-audit
analysis reports,
that assess the prior health of the organization and point out past
problems so that the effectiveness of corrective actions can be
evaluated. The results of audits are formally documented and reported
to the organization and to senior NAVSEA management. They are also
provided to other SUBSAFE organizations for lessons learned purposes.
Each deficiency must be corrected and the root cause of the deficiency
identified. The corrective action and root cause is formally reported
back to NAVSEA along with applicable objective quality evidence for
evaluation and approval. Further, each deficiency is tracked by NAVSEA
07Q to maintain its visibility and to ensure it is satisfactorily
resolved. Annually, an analysis report of all audit results, and other
reported problems, is prepared to support a senior management
assessment of the health of the SUBSAFE Program.
Functional Audits are also used to identify areas in which an
organization can initiate process improvements. Although a process or
practice may be in compliance with SUBSAFE requirements, auditors may
make recommendations, which offer the opportunity for significant
improvement in the effectiveness of the process or practice. These
recommendations, categorized as Operational Improvements, are
documented in the report and tracked until the organization provides
its evaluation and any planned actions.
In addition to the audits performed by NAVSEA, our shipyards, field
organizations and the Fleet are required to conduct internal (or self)
audits of their policies, procedures, and practices and of the work
they perform.
Answers to Post-Hearing Questions
Responses by Ray F. Johnson, Vice President, Space Launch Operations,
The Aerospace Corporation
Note of Clarification: Throughout the discussions of CAIB
investigations, the term ``safety'' is used relative to establishing
NASA flight readiness. Since our DOD launches are not human rated, we
use the term ``mission assurance'' in essentially an equivalent
meaning. For DOD launches, the term `flight safety'' is primarily
associated with the risks to the uninvolved public due to catastrophic
failure rather than mission success itself.
Questions submitted by Representative Ralph M. Hall
Q1. How will we know that NASA has implemented the Columbia Accident
Investigation Board (CAIB) recommendations? What measures do you use in
your organization to determine that your safety mechanisms are working?
A1. Following the Space Launch Broad Area Review in 1999, the Air Force
developed an execution plan for each of the Board's recommendations.
Periodically since then the BAR has reconvened and reviewed progress
against their initial recommendations. We would recommend a similar
approach to track NASA's implementation of the CAIB recommendations.
Our mission success record is the best gauge of our mission
assurance processes. Since the Broad Area Review, the renewed rigor in
mission assurance has yielded a 100 percent success rate. We have also
measured our success rate against other launch organizations (i.e.,
commercial, foreign) and found that our processes have consistently
resulted in a higher level of success.
Q2. The CAIB recommends a separation between the operational aspects
of the Shuttle program and the organizations providing engineering and
safety support. Based on your experience:
Q2a. Do you agree with this as a principle for managing your program?
A2a. Our organization and the value of our contributions comes from the
degree of independence we are afforded by our Air Force sponsors. Our
launch programs do not employ separate organizations for safety,
engineering and operations, but rather a triumvirate of program
participants (Air Force, contractor, Aerospace) with individual
responsibilities. Aerospace is the program participant with
responsibility for the independent mission assurance assessment.
Q2b. Where do you place the boundaries between these three program
elements in your program and how do they interact?
A2b. Our independent mission assurance role uses a cadre of engineering
talent with skills comparable to that of the contractor who has the
primary engineering and operational responsibility. Aerospace provides
a final launch readiness verification to the SMC Commander that is
independent from the contractor's assessment. The SMC Commander, in his
role as ultimate flight worthiness certification authority, employs an
additional oversight review team to ensure that the program
participants properly execute their responsibilities.
Flight safety is the responsibility of the Range Safety
organization at the launch sites. Range Safety is not only completely
separate from the launch system program, it is under a separate Air
Force organization. Range Safety's primary role is to protect
resources, personnel, and general public from the hazards of launch.
Q2c. What training and experience do you require in your senior
managers, and what incentives do you provide such managers?
A2c. We are essentially an engineering and scientific organization and
our role in space launch does not typically require formal
certification training of our personnel. Our engineering staff is made
up of career professionals who typically have many years experience
either in industry or academia. Many of these are the foremost
specialists in their fields. Our senior managers (up to and including
our president) all have strong technical backgrounds as well. Our field
site personnel, who are associated with vehicle operations and exposed
to hazardous conditions, are certified as required by the local safety
organizations. We are incentivized by our accountability to mission
success as well as formal recognition through a corporate awards
program.
Q3. In both Shuttle accidents, NASA failed to appreciate the threat to
the vehicle from what seemed a minor problem--O-ring seals that did not
seem to work well in cold weather and foam that sometimes struck the
Orbiter's thermal protection system.
Q3a. How does your organization deal with similar ``weak signals''?
A3a. We apply rigor in defining system performance specifications and a
continuous oversight presence in identifying any out-of-family
condition following every launch. Any out-of-family deviation is
thoroughly evaluated to determine the associated risk and corrective
action.
Q3b. How does your organization evaluate problems to determine if they
represent recurring failures that require changes in design or
processes if they are to be dealt with? Who conducts those evaluations?
A3b. Each flight is thoroughly analyzed by domain experts to identify
any anomalies. These anomalies are compared to other missions to
evaluate trends and out-of-family performance. Each item is then
assessed for mission risk and corrective action is established. Unless
the risk can positively be established as low, the corrective action is
made a lien against the next launch of that system. These evaluations
are performed by the contractor and independently by Aerospace using
separately acquired, processed, and analyzed telemetry, video and radar
data. Results and findings are compared at formal Post-Flight Reviews.
Q3c. For recurring problems, does your organization have the
capability to analyze the trend to determine if it could contribute to
a low-probability, high-consequence accident?
A3c. Yes, we not only have the capability to independently analyze
these conditions, we have the obligation to ensure they are
accomplished. We maintain a separate database of launch vehicle flight
data that our engineering team uses to maintain recurring flight
records. We have also developed unique analytical tools for the
engineers to use in analyzing and identifying trends. We recently
identified a potential problem during trend analysis of actuator
performance that was ultimately traced to internal contamination. Due
to the consequences of failure from debris migration, all actuators of
like manufacture were processed through a new cleaning procedure before
another flight was allowed.
Q3d. How much certainty would your organization require to take action
in a case where your relevant technical expert strongly believed a
catastrophe could occur but did not have the engineering evaluations to
confirm that judgment--and little or no time to conduct such
evaluations?
A3d. We believe that we are required to take the necessary time to
validate a condition such as this and would request the launch be held
if need be. Our first obligation is to validate the concern through our
readiness review process, then elevate in time to effect the launch
decision. A recent example illustrates our process. Our experts
identified a concern for dynamic instability on an upcoming Titan
launch. This was based on observations noted on other launches but
could not be readily quantified for this mission. Due to the risks
involved, we requested a launch slip of several weeks while additional
modeling was developed and analyses performed. The Air Force was
persuaded by the preliminary analysis that a more definitive answer was
warranted and delayed the launch. The results of this analysis created
sufficient concern that flight changes were made that successfully
mitigated the risk of occurrence.
Questions submitted by Representative Bart Gordon
Q1. Does it matter in your organization whether a vehicle or product
is deemed ``operational'' versus ``experimental/developmental''? Do you
have a different safety structure for operational activities versus
those that are developmental in nature?
A1. Space Launch is an inherently engineering intensive activity. This
is partly due to the high performance, low margins, numerous hazards,
and consequences of failure. But it is also due to the very low
production and flight rates with equally low repeatability and assembly
before flight. By any comparison to other transportation media, space
launch operations would not be considered an operational system and its
inherent reliability viewed as relatively low. Therefore as a space
organization we have no truly operational systems and continuous
engineering involvement is mandatory for mission assurance.
As mentioned in response to Mr. Hall's questions, Range Safety is
responsible for flight safety of our launches. When a vehicle strays
from its intended flight path, it is destroyed to protect the public
from an errant vehicle. This approach would unlikely be employed in an
operational transportation system. Also, a comparison of flight safety
procedures for space launch and air traffic control yields many
significant differences which can be attributed to the non-operational
nature of launch.
Q2. In your written testimony you noted that a root cause of some
launch failures in National Security Space programs was ``the lack of
disciplined system engineering in the design and processing of launch
vehicles exacerbated by a premature dismantling of government oversight
capability.. . .''
Q2a. Could you elaborate on the circumstances of this ``premature
dismantling'' and how it contributed to the launch failures studied in
the Broad Area Review?
A2a. The Broad Area Review found that a combination of budget
reductions and program reforms that occurred in the early-mid 1990s
converged to dilute program effectiveness. Pressures to reduce costs
resulted in reduction of government oversight, quality assurance,
erosion of expertise, and emphasis on cost savings over mission
assurance. In addition specs, standards, and policies were abandoned
and the mission assurance technical focus eroded in favor of an
``operational'' orientation. This was particularly true on Titan, one
of the most complex launch systems in use, where manpower reductions in
the government and Aerospace staff approached 50 percent. The Broad
Area Review referred to this as a ``premature going out of business
mindset'' in anticipation of flying out the remaining vehicles as the
new EELV families were in development, whereas, in reality, the Titan
launch rate was increasing. The Broad Area Review also found that the
recent failures it examined could be attributed to engineering and
workmanship (i.e., human) errors that should have been avoidable.
Q2b. How similar are the findings and conclusions of the Broad Area
Review and the Columbia Accident Investigation Board report?
A2b. In both reviews it was found that lines of responsibility,
accountability, and authority were fragmented, which resulted in an
inadequate decision process. We also see similarities in findings that
the government entity relied more and more on the contractor, allowed
organic capabilities to erode, and became more complacent.
Q2c. With Aerospace Corporation's experience in independently
assessing launch readiness, what capabilities do you expect to see in
the Air Force organizations involved in the launch decision to be
confident of a successful launch?
A2c. We expect our Air Force customer to hold us accountable for our
mission assurance responsibilities and to demand the appropriate rigor
and technical discipline in our independent assessments and
recommendations.
Q2d. How do you evaluate the relationships between the Air Force and
the contractors supplying the launchers when certifying readiness to
launch? What represents an appropriate relationship between those two
groups?
A2d. We rely on the contractors as the primary source of all data and
the first line of defense in the mission assurance/readiness process.
They provide assurance in their hardware, software, and procedures. It
is our job to independently verify that all critical items (i.e.,
hardware, software, analyses, processes, and procedures) are
technically acceptable. The appropriate relationship is one of
cooperation and technical interchange with the independent technical
party providing additional confidence through verification. The Air
Force holds both the contractor and Aerospace accountable for
independent mission assurance assessments.
Q3. In your testimony you state, ``dissenting opinions are heard.. .
.'' What specifically are the forums for these dissenting opinions? How
does your organization encourage dissent?
A3. For each launch we conduct a series of technical reviews at each
level of management up to the corporation president. At each stage of
these reviews, all disciplines and domain experts are represented and
their findings and conclusions are presented. The launch vehicle
programs rely on the domain experts in the Engineering and Technology
Group to provide the technical basis for all positions. Each discipline
presents all findings and must be in agreement on the readiness state.
If a dissenting position is presented, it will be flagged and actions
assigned to resolve. The existence of these issues is also tracked and
the dispositions presented throughout the process. This process is also
overseen by the Independent Readiness Review Team that reports to the
SMC Commander at the Flight Readiness Review in the form of a risk
assessment.
Question submitted by Representative Nick Lampson
Q1. Admiral Bowman testified that, ``Safety is the responsibility of
everyone at every level in the organization,'' a sentiment echoed by
Ms. Grubbe in her statement--but in day-to-day program activities,
safety is not a primary metric for measuring performance. Safety
usually becomes an issue only after it is clearly seen to be absent.
What specific actions does your organization take to maintain the focus
on safety when the pressures to achieve organizational goals inevitably
build?
A1. We maintain an independent chain of mission assurance
responsibility within our organization that flows up to our president.
Although we are also responsible to the Air Force program director for
his readiness assessment, our president reports to the SMC Commander
who is above the program director and who ultimately certifies flight
worthiness. It is this chain of command and the accountability expected
at each level that assures our mission assurance focus is maintained.
Questions submitted by Representative Sheila Jackson Lee
Q1. How is safety training done in your organization? How is safety
awareness maintained in your organization? Please describe the kinds of
training materials you use.
A1. True safety training and certification is only required for those
individuals at the launch site who support hazardous operations and are
near the flight hardware. For industrial safety, our Safety and
Security office is responsible for training in various procedures. They
also have safety awareness circulars and other information media, such
as the corporate website. For technical training we also have an
educational arm of the corporation, The Aerospace Institute, that has a
wide curriculum of space and national defense related courses. The
Institute has classroom courses with appropriate text and other
documentation for student's use. Our launch systems, systems
engineering, and mission assurance functions are all contained in
different modules within these courses. For those assigned specific
mission assurance functions, we maintain a well-defined process and
mentoring program that supports our technical staff.
Answers to Post-Hearing Questions
Responses by Deborah L. Grubbe, P.E., Corporate Director, Safety and
Health, DuPont
Questions submitted by Representative Ralph M. Hall
Q1. How will we know that NASA has implemented the Columbia Accident
Investigation Board (CA1B) recommendations? What measures do you use in
your organization to determine that your safety mechanisms are working?
A1. We will know when the CAIB recommendations are in place when we see
NASA leadership and management more focused on safety than on schedule.
The diagnostic is as simple and as difficult as to watch what is done.
In my firm we measure outcome metrics, e.g., the number of injuries and
we also measure leading indicators, which is a measure of the general
safety attitudes and procedures. With NASA I would start by looking at
contractor and employee injury rates. If those start to improve, the
indicator is there that management and leadership are taking safety
seriously. There are literally hundreds of measures within an world
class safety program.
Q2. The CAIB recommends a separation between the operational aspects
of the Shuttle program and the organizations providing engineering and
safety support. Based on your experience:
Q2a. Do you agree with this as a principle for managing your program?
A2a. Yes, my firm has independent authorities for both safety and for
engineering.
Q2b. Where do you place the boundaries between these three program
elements in your program and how do they interact?
A2b. All elements in my firm: manufacturing, safety and engineering
interact at the local site, where the work is being done. In NASA
terms, the work comes together at the center. We try to work with no
boundaries at all times. We work to ensure alignment against the
highest objective, which is to safely meet our customers' needs. If
there is a point of disagreement, the management of the respective
organizations are called in to help resolve the best approach.
Q2c. What training and experience do you require in your senior
managers, and what incentives do you provide such managers?
A2c. Most managers have been ``in those chairs'' and know what it is
like to see someone hurt. None of us who have been there ever want to
see that again. The only true incentive for safety is, in the end, that
everyone under my charge left today with all the parts they came with.
There is a small monetary incentive at the corporate level, which may
be as little as $500/year to someone making six figures. This money is
really not much incentive, and is more recognition of job well done.
Q3. In both Shuttle accidents NASA failed to appreciate the threat to
the vehicle from what seemed a minor problem--O-ring seals that did not
seem to work well in cold weather and foam that sometimes struck the
Orbiter's thermal protection system.
Q3a. How does your organization deal with similar ``weak signals''?
A3a. My firm investigates anything that seems ``out of the ordinary''
or unexpected. We drive the answer to root cause, and put the fix into
place as soon as practical. The important aspect of this work is to fix
it before it becomes more serious.
Q3b. How does your organization evaluate problems to determine if they
represent recurring failures that require changes in design or
processes if they are to be dealt with? Who conducts those evaluations?
A3b. Our engineering and safety organizations, along with the
collaboration of our manufacturing organization, looks to discern
common cause and special cause variation. Both common cause and special
cause variation provide data to direct the needed change.
Q3c. For recurring problems, does your organization have the
capability to analyze the trend to determine if it could contribute to
a low-probability, high-consequence accident?
A3c. Yes. Our organization, primarily our engineering organization, can
do the analysis to quantify risk.
Q3d. How much certainty would your organization require to take action
in a case where your relevant technical expert strongly believed a
catastrophe could occur but did not have the engineering evaluations to
confirm that judgment--and little or no time to conduct such
evaluations?
A3d. My firm instructs its employees that if they do not feel safe,
they are to stop their job and get someone to help them determine a
better, safer way to do the work. An engineering evaluation does not
have to do be done, someone just has to sense that ``something is not
right.''
Questions submitted by Representative Bart Gordon
Q1. Does it matter in your organization whether a vehicle or product
is deemed ``operational'' versus ``experimental/developmental''? Do you
have a different safety structure for operational activities versus
those that are developmental in nature?
A1. The same safety standards apply whether the process or equipment is
``operational'' vs. ``experimental.''
Q2. One of the ``cultural'' issues raised in the CAIB report is the
lack of respect for the safety organization demonstrated by the
engineering and program offices at NASA. How does DuPont's safety
organization avoid such marginalization?
A2. While there are many safety organizations in DuPont, every DuPont
employee, and every DuPont contractor is accountable for safety. Safety
is a line responsibility. Safety comes first. Period. No questions
asked. No one in DuPont can ignore safety without consequences that
could lead up to and include termination. If I discount safety, I can
expect to hear about it from my boss, and he is not going to be happy!
Likewise, with our corporate group. Since everyone is accountable for
safety, it is never ignored. The safety organization can serve as the
conscience on some occasions; however, you know safety is really
working with the organization serves as its own conscience.
Question submitted by Representative Nick Lampson
Q1. Admiral Bowman testified that, ``Safety is the responsibility of
everyone at every level in the organization,'' a sentiment echoed by
Ms. Grubbe in her statement--but in day-to-day program activities,
safety is not a primary metric for measuring performance. Safety
usually becomes an issue only after it is clearly seen to be absent.
What specific actions does your organization take to maintain the focus
on safety when the pressures to achieve organizational goals inevitably
build?
A1. All major DuPont meetings start with a discussion of safety.
Subjects include: statistics, what happened to me on the way home last
night, weather safety, travel safety, etc. Others actions include the
following: a monthly review of safety statistics at the global
manufacturing meetings, reporting of lost time injuries within 24 hours
to the CEO, and an aggressive off the job safety program where daily
statistics are kept on lost time with off the job fatalities reported
to the CEO within 24 hours. Safety statistics are shared daily with the
whole organization, and we share improvement ideas frequently. We know
that when we go through organizational changes, that safety can suffer,
so we also redouble our efforts during difficult times.
Questions submitted by Representative Sheila Jackson Lee
Q1. How is safety training done in your organization? How is safety
awareness maintained in your organization? Please describe the kinds of
training materials you use.
A1. Safety training starts the first day of employment and continues
monthly until one retires. Safety meeting attendance is mandatory.
Safety awareness is maintained through items like: a global safety
message that is sent out every working day at 2 a.m. EST, tool box
meetings at the start of every shift, supervisor walk-through to
support learning good safety techniques, etc. Training materials are
items like: standards, videos, computer assisted tools, demonstrations,
safety fairs, classes, safety meetings, written job procedures,
pictures on how to best do the task, etc.
Q2. You mentioned in your written testimony that ``any person can stop
any job at any time if there is a perceived safety danger.'' What
incentives do you use to encourage such action?
A2. People who stop a job, and people who offer an alert to an unsafe
situation are highlighted at a safety meeting, or verbally recognized
at a tool box meeting, or are sometimes even offered monetary
recognition. The positive reinforcement is very affirming, and we
continue to see more folks step forward and report unusual events. It
is the driving home of the fixes on these unusual events that helps to
keep people from getting hurt in the first place.
Appendix 2:
----------
Additional Material for the Record