SPEAKERS       CONTENTS       INSERTS    
 Page 1       TOP OF DOC
90–160PS
2004
NASA'S ORGANIZATIONAL AND
MANAGEMENT CHALLENGES IN THE
WAKE OF THE COLUMBIA DISASTER

HEARING

BEFORE THE

COMMITTEE ON SCIENCE
HOUSE OF REPRESENTATIVES

ONE HUNDRED EIGHTH CONGRESS

FIRST SESSION

OCTOBER 29, 2003

Serial No. 108–30

Printed for the use of the Committee on Science

Available via the World Wide Web: http://www.house.gov/science

 Page 2       PREV PAGE       TOP OF DOC
COMMITTEE ON SCIENCE

HON. SHERWOOD L. BOEHLERT, New York, Chairman

LAMAR S. SMITH, Texas
CURT WELDON, Pennsylvania
DANA ROHRABACHER, California
JOE BARTON, Texas
KEN CALVERT, California
NICK SMITH, Michigan
ROSCOE G. BARTLETT, Maryland
VERNON J. EHLERS, Michigan
GIL GUTKNECHT, Minnesota
GEORGE R. NETHERCUTT, JR., Washington
FRANK D. LUCAS, Oklahoma
JUDY BIGGERT, Illinois
WAYNE T. GILCHREST, Maryland
W. TODD AKIN, Missouri
TIMOTHY V. JOHNSON, Illinois
MELISSA A. HART, Pennsylvania
JOHN SULLIVAN, Oklahoma
J. RANDY FORBES, Virginia
PHIL GINGREY, Georgia
ROB BISHOP, Utah
MICHAEL C. BURGESS, Texas
 Page 3       PREV PAGE       TOP OF DOC
JO BONNER, Alabama
TOM FEENEY, Florida
RANDY NEUGEBAUER, Texas

RALPH M. HALL, Texas
BART GORDON, Tennessee
JERRY F. COSTELLO, Illinois
EDDIE BERNICE JOHNSON, Texas
LYNN C. WOOLSEY, California
NICK LAMPSON, Texas
JOHN B. LARSON, Connecticut
MARK UDALL, Colorado
DAVID WU, Oregon
MICHAEL M. HONDA, California
CHRIS BELL, Texas
BRAD MILLER, North Carolina
LINCOLN DAVIS, Tennessee
SHEILA JACKSON LEE, Texas
ZOE LOFGREN, California
BRAD SHERMAN, California
BRIAN BAIRD, Washington
DENNIS MOORE, Kansas
ANTHONY D. WEINER, New York
JIM MATHESON, Utah
DENNIS A. CARDOZA, California
 Page 4       PREV PAGE       TOP OF DOC
VACANCY

C O N T E N T S

October 29, 2003
    Witness List

    Hearing Charter

Opening Statements

    Statement by Representative Sherwood L. Boehlert, Chairman, Committee on Science, U.S. House of Representatives
Written Statement

    Statement by Representative Ralph M. Hall, Minority Ranking Member, Committee on Science, U.S. House of Representatives
Written Statement

    Statement by Representative Bart Gordon, Member, Committee on Science, U.S. House of Representatives

    Prepared Statement by Representative Dana Rohrabacher, Chairman, Subcommittee on Space and Aeronautics, Committee on Science, U.S. House of Representatives

 Page 5       PREV PAGE       TOP OF DOC
    Prepared Statement by Representative Jerry F. Costello, Member, Committee on Science, U.S. House of Representatives

    Prepared Statement by Representative Eddie Bernice Johnson, Member, Committee on Science, U.S. House of Representatives

    Prepared Statement by Representative Sheila Jackson Lee, Member, Committee on Science, U.S. House of Representatives

Panel I

Admiral F.L. ''Skip'' Bowman, Director, Naval Nuclear Propulsion Program, U.S. Navy
Oral Statement
Written Statement
Biography

Rear Admiral Paul E. Sullivan, Deputy Commander, Ship Design, Integration and Engineering, Naval Sea Systems Command, U.S. Navy
Oral Statement
Written Statement
Biography

Mr. Ray F. Johnson, Vice President, Space Launch Operations, The Aerospace Corporation
Oral Statement
Written Statement
 Page 6       PREV PAGE       TOP OF DOC
Biography

Ms. Deborah L. Grubbe, P.E., Corporate Director, Safety and Health, DuPont
Oral Statement
Written Statement
Biography

Discussion, Panel I
ITEA Budget Independence
Waivers
Managing Safety
SUBSAFE
Crew Escape
Handling Anomolies
Safety Accountability
Decision-making in the Naval Reactors Program
Culture and Attitude
SUBSAFE's Use of the Challenger Case Study
NASA/Navy Benchmarking
CAIB Recommendations
Communicating Risk
Turnover in the Safety Workforce
Nanotechnology
NASA/Navy Benchmark
Manned vs. Unmanned Space Flight
 Page 7       PREV PAGE       TOP OF DOC
Safety Organization

Panel II

Admiral Harold Gehman (ret.), Chairman, Columbia Accident Investigation Board
Oral Statement
Written Statement

Discussion, Panel II
ISS Safety and CAIB Recommendations
Safety Program Independence
ISS Safety
Leadership Confidence
ISS Safety
Vision
Expedition 8 Launch Decision-making Process
ITEA and Safety Staff Turnover
ISS Review

Appendix 1: Answers to Post-Hearing Questions

    Admiral F.L. ''Skip'' Bowman, Director, Naval Nuclear Propulsion Program, U.S. Navy

Rear Admiral Paul E. Sullivan, Deputy Commander, Ship Design, Integration and Engineering, Naval Sea Systems Command, U.S. Navy
 Page 8       PREV PAGE       TOP OF DOC

    Mr. Ray F. Johnson, Vice President, Space Launch Operations, The Aerospace Corporation

    Ms. Deborah L. Grubbe, P.E., Corporate Director, Safety and Health, DuPont

Appendix 2: Additional Material for the Record

    Statement of Admiral H.G. Rickover before the Subcommittee on Energy Research and Production, Committee on Science and Technology, U.S. House of Representatives, May 24, 1979

    Report NT–03–1, Environmental Monitoring and Disposal of Radioactive Wastes From U.S. Naval Nuclear-Powered Ships and Their Support Facilities, March 2003, Naval Nuclear Propulsion Program

    Report NT–03–2, Occupational Radiation Exposure From U.S. Naval Nuclear Plants and Their Support Facilities, March 2003, Naval Nuclear Propulsion Program

    Report NT–03–03, Occupational Radiation Exposure From Naval Reactors' Department of Energy Facilities, March 2003, Naval Nuclear Propulsion Program

    Report NT–03–4, Occupational Safety, Health, and Occupational Medicine Report, March 2003, Naval Nuclear Propulsion Program
 Page 9       PREV PAGE       TOP OF DOC

NASA'S ORGANIZATIONAL AND MANAGEMENT CHALLENGES IN THE WAKE OF THE COLUMBIA DISASTER

WEDNESDAY, OCTOBER 29, 2003

House of Representatives,

Committee on Science,

Washington, DC.

    The Committee met, pursuant to call, at 10:10 a.m., in Room 2318 of the Rayburn House Office Building, Hon. Sherwood L. Boehlert [Chairman of the Committee] presiding.

90160a.eps

HEARING CHARTER

COMMITTEE ON SCIENCE

U.S. HOUSE OF REPRESENTATIVES

NASA's Organizational and

Management Challenges in the
 Page 10       PREV PAGE       TOP OF DOC

Wake of the Columbia Disaster

WEDNESDAY, OCTOBER 29, 2003

10:00 A.M.–12:00 P.M.

2318 RAYBURN HOUSE OFFICE BUILDING

1. Purpose

    On Wednesday, October 29, 2003 at 10:00 a.m., the House Committee on Science will hold a hearing to address the organizational and management issues confronting the National Aeronautics and Space Administration (NASA) in the aftermath of the Space Shuttle Columbia accident. According to the Columbia Accident Investigation Board (CAIB), NASA's ''organizational culture and structure'' had as much to do with the Columbia's demise as the physical causes of the accident. During the course of its nearly seven months of investigation into the causes of the accident, the CAIB encountered an ineffective and disengaged safety organization within NASA that ''failed to adequately assess anomalies and frequently accepted critical risks without qualitative or quantitative support.'' Based on its findings, the CAIB recommended significant changes to the organizational structure of the Space Shuttle Program (detailed below).

    To give a sense of some of the ways NASA could be restructured to comply with its recommendations, the CAIB report provided three examples of organizations with independent safety programs that successfully operate high-risk technologies. The examples were: the United States Navy's Submarine Flooding Prevention and Recovery (SUBSAFE) and Naval Nuclear Propulsion (Naval Reactors) programs and the Aerospace Corporation's independent launch verification process and mission assurance program for the U.S. Air Force.
 Page 11       PREV PAGE       TOP OF DOC

    This hearing will provide an opportunity to examine each of these examples in depth, as well as the safety programs of the Dupont Corporation (an acknowledged industry leader in safety), to help determine how NASA should be reorganized.

2. Critical Questions

    The CAIB determined that reorganizing NASA is a critical requirement if the Shuttle is to fly safely over the long term. To provide adequate oversight of NASA's reorganization plans, the Committee needs to understand how different organization structures can contribute to safety. To that end, the following questions were submitted in advance to each of the witnesses:

a. What does it mean for a safety program to be ''independent''? How can safety organizations be structured to ensure their independence?

b. How can safety programs be organized to ensure that they are robust and effective, but do not prevent the larger organization from carrying out its duties?

c. How do you ensure that the existence of an independent safety program does not allow the larger organization to absolve itself of responsibility for safety?

d. How do you ensure that dissenting opinions are offered without creating a safety review process that can never reach closure?

 Page 12       PREV PAGE       TOP OF DOC
3. Background

Recommendations of the CAIB and previous reports

    Since the loss of the Space Shuttle Challenger in 1986, numerous outside experts have reviewed NASA's human space flight safety programs and found them lacking. For instance, in the immediate aftermath of the Challenger accident, the Rogers Commission issued recommendations calling for the creation of an independent safety oversight function. Despite NASA's compliance efforts, the U.S. General Accounting Office concluded in 1990 that NASA still ''did not have an independent and effective safety organization.'' Nine years later, the Shuttle Independent Assessment Team and NASA Integrated Action Team likewise issued findings that were critical of NASA's safety programs and echoed the Roger Commission's call for the creation of an independent safety oversight function. Finally, in 2002, the Space Shuttle Competitive Task Force reiterated the call for an independent safety assurance function at NASA with ''authority to shut down the flight preparation processes or intervene post-launch when an anomaly occurs.''

    In August of 2003, the CAIB released Volume I of its report on the Columbia accident. Consistent with previous analyses of NASA's safety programs, the CAIB Report discovered fundamental, structural deficiencies in NASA's safety programs. For example, the report states, ''the Shuttle Program's complex structure erected barriers to effective communication and its safety culture no longer asks enough hard questions about risk.. . .[T]he mistakes that were made on [the Columbia mission] are not isolated failures, but are indicative of systemic flaws that existed prior to the accident.. . .[A successful safety process] demands a more independent status than NASA has ever been willing to give its safety organizations, despite the recommendations of numerous outside experts over nearly two decades[.]''
 Page 13       PREV PAGE       TOP OF DOC

    According to the CAIB Report, NASA's current approach to safety and mission assurance ''calls for centralized policy and oversight at Headquarters and decentralized execution of safety programs at the enterprise, program, and project levels.'' Under the existing organizational rubric, ''safety is the responsibility of program and project managers'' who are given flexibility ''to organize safety efforts as they see fit.''

    To remedy the current organization deficiencies, the primary CAIB recommendation on organization calls on NASA to ''establish an independent Technical Engineering Authority'' that would be ''responsible for technical requirements and all waivers to them'' and that would be ''funded directly from NASA Headquarters, and should have no connection to or responsibility for schedule or program cost.'' The CAIB's fundamental goal is to separate the responsibility for safety from the Shuttle program's responsibility for cost and schedule. The current NASA structure, in which the Shuttle program itself is ultimately responsible for cost, schedule and safety inevitably leads to ''blind spots''—serious safety problems that are not properly analyzed or addressed, the CAIB concluded. The CAIB did not specify precisely how NASA should be reorganized to implement its recommendations, leaving that up to the agency.

    While the CAIB report does not label the implementation of a new organizational structure as a ''return to flight'' requirement, the report does say that NASA must ''prepare a detailed plan for defining, establishing, transitioning and implementing an independent Technical Engineering Authority, independent safety program, and a reorganized Space Shuttle Integration Office'' prior to returning to flight.

    NASA is in the process of preparing such a plan. Administrator Sean O'Keefe has tasked the Associate Administrator for Safety and Mission Assurance, Bryan O'Connor, with coming up with a proposed reorganization plan. O'Connor has circulated a ''white paper'' outlining his ideas for reorganization among NASA staff. Before being implemented, any reorganization plan will be reviewed both by the Stafford-Covey Task Force (the task force of outside experts set up by O'Keefe to evaluate return-to-flight activities, which is headed by former astronauts Tom Stafford and Richard Covey) and by the Space Flight Leadership Council, which comprises top NASA officials. NASA is also in the process of setting up a new NASA Engineering and Safety Center (NESC), which would be able to ''independently'' review aspects of programs. It is not clear how the NESC would relate to a new Independent Technical Engineering Authority, but Admiral Harold Gehman, the chairman of the CAIB, has testified that the NESC does not, by itself, fulfill the CAIB's recommendations related to organization.
 Page 14       PREV PAGE       TOP OF DOC

Model safety organizations

    The CAIB Report cites three examples of organizations with successful safety programs and practices that could be models for NASA: the United States Navy's Naval Reactors and SUBSAFE programs and the Aerospace Corporation's independent launch verification process and mission assurance program for the U.S. Air Force.

    The Naval Reactors program is a joint Navy/Department of Energy organization responsible for all aspects of Navy nuclear propulsion, including research, design, testing, training, operation, and maintenance of nuclear propulsion plants on-board Navy ships and submarines. The Naval Reactors program is structurally independent of the operational program that it serves. Although the naval fleet is ultimately responsible for day-to-day operations and maintenance, those operations occur within parameters independently established by the Naval Reactors program. In addition to its independence, the Naval Reactors program has certain features that might be emulated by NASA, including an insistence on airing minority opinions and planning for worst case scenarios, a requirement that contractor technical requirements are documented in peer reviewed formal written correspondence, and a dedication to relentless training and retraining of its engineering and safety personnel.

    SUBSAFE is a program that was initiated by the Navy to identify critical changes in submarine certification requirements and to verify the readiness and safety of submarines. The SUBSAFE program was initiated in the wake of the USS Thresher nuclear submarine accident in 1963. Until SUBSAFE independently verifies that a submarine has complied with SUBSAFE design and process requirements, its operating depth and maneuvers are limited. The SUBSAFE requirements are clearly documented and achievable, and rarely waived. Program mangers are not permitted to ''tailor'' requirements without approval from SUBSAFE. Like the Naval Reactors program, the SUBSAFE program is structurally independent from the operational program that it serves. Likewise, SUBSAFE stresses training and retraining of its personnel based on ''lessons learned,'' and appears to be relatively immune from budget pressures.
 Page 15       PREV PAGE       TOP OF DOC

    The Aerospace Corporation operates as a Federally Funded Research and Development Center that independently verifies safety and readiness for space launches by the United States Air Force. As a separate entity altogether from the Air Force, Aerospace conducts system design and integration, verifies launch readiness, and provides technical oversight of contractors. Aerospace is indisputably independent and is not subject to schedule or cost pressures.

    According to the CAIB, the Navy and Air Force programs have ''invested in redundant technical authorities and processes to become reliable.'' Specifically, each of the programs allows technical and safety engineering organizations (rather than the operational organizations that actually deploy the ships, submarines and planes) to ''own'' the process of determining, maintaining, and waiving technical requirements. Moreover, each of the programs is independent enough to avoid being influenced by cost, schedule, or mission-accomplishment goals. Finally, each of the programs provides its safety and technical engineering organizations with a powerful voice in the overall organization. According to the CAIB, the Navy and Aerospace programs ''yield valuable lessons for [NASA] to consider when redesigning its organization to increase safety.''

4. Witnesses

First Panel

a. Admiral Frank L. ''Skip'' Bowman, United States Navy (USN), is the Director of the Naval Nuclear Propulsion (Naval Reactors) Program. In this capacity, Admiral Bowman is responsible for the program that oversees the design, development, procurement, operation, and maintenance of all the nuclear propulsion plants powering the Navy's fleet of nuclear warships. Admiral Bowman is a graduate of Duke University and the Massachusetts Institute of Technology.
 Page 16       PREV PAGE       TOP OF DOC

b. Rear Admiral Paul Sullivan, USN, is the Deputy Commander for Ship Design Integration and Engineering for the Naval Sea Systems Command, which is the authority for the technical requirements of the SUBSAFE program. Admiral Sullivan is a graduate of the U.S. Naval Academy and the Massachusetts Institute of Technology.

c. Mr. Ray F. Johnson is the Vice President for Space Launch Operations for the Aerospace Corporation, located in El Segundo, California. Mr. Johnson is responsible for Aerospace's support for all Air Force space launch programs, including Aerospace's certification reviews prior to launch. Mr. Johnson holds a B.S. degree in mechanical engineering from the University of California at Berkeley and an MBA from the University of Chicago.

d. Ms. Deborah L. Grubbe is the Corporate Director for Safety and Health at Dupont. In this capacity, Ms. Grubbe is tasked with leading new initiatives in global safety and occupational health for Dupont. Ms. Grubbe and is a past director of DuPont Nonwovens, where she was accountable for manufacturing, engineering, and safety. Ms. Grubbe holds a B.S. degree in chemical engineering from Purdue University and a Certificate of Post-Graduate Study in chemical engineering from Cambridge University.

Second Panel

    Admiral Harold Gehman, Jr., USN (retired), chaired the Columbia Accident Investigation Board.

5. Attachment
 Page 17       PREV PAGE       TOP OF DOC

    Excerpt from the Columbia Accident Investigation Board Report, Volume I (August 2003), Chapter 7, Section 7.3 (pp. 182–184).

Attachment

90160b.eps

90160c.eps

90160d.eps

    Chairman BOEHLERT. We might as well start. We thank you for being punctual, and I tried very hard to be punctual, too.

    I want to welcome everyone to today's hearing, which concerns one of the most critical recommendations of the Columbia Accident Investigation Board. The CAIB was clear and on-target in citing organizational deficiencies as a leading cause of the Columbia accident. It was also clear and on-target in calling for the establishment of a new Independent Technical Engineering Authority and of a truly independent safety organization. And in both instances, I stress the word ''independent''.

    In both its conclusions and its recommendations on organization, the Columbia Accident Investigation Board was, unfortunately, able to follow a well-worn path. The Rogers Commission and the Shuttle Independent Assessment Team, among others, had made similar recommendations. They all apparently fell on deaf ears. This must not be allowed to happen again.
 Page 18       PREV PAGE       TOP OF DOC

    NASA Administrator Sean O'Keefe is to be applauded for deciding that the reorganization of NASA should occur before return to flight, setting a more ambitious schedule than that called for by the CAIB. He should also be congratulated for recognizing NASA's organizational deficiencies before the Columbia accident, which led him to initiate the so-called ''benchmarking studies'' comparing NASA with the Navy, something with which he is most familiar.

    But, of course, undertaking the right studies and setting the right schedule is not enough. NASA must actually come up with the right reorganization plan and make sure that it is taken to heart.

    The CAIB did not dictate exactly how NASA should carry out its recommendations, so NASA is now in the process of drawing up its plans, and this committee will have to review those plans with a fine-tooth comb.

    The purpose of today's hearing is to help give us the background to do just that. We will hear from organizations that the CAIB cited as possible models for NASA to follow and from an industrial leader in safety. Obviously, there are differences among these models, and any one of them would have to be adapted to apply to NASA, but they all highlight characteristics of high-reliability organizations that NASA has been lacking. We will learn from Admiral Gehman precisely why and how the Navy and Air Force safety programs can be seen as models for NASA.

    I have no doubt that this committee will have ample opportunity over the next year or so to put to use the information we gather today. As I noted earlier, NASA is just in the initial stages of putting together and organizational plan, and I have complete confidence that Administrator O'Keefe has taken the CAIB recommendations to heart.
 Page 19       PREV PAGE       TOP OF DOC

    But that said, I must note that I believe the initial organization ideas being circulated by NASA fall significantly short of the mark. We look forward to working with NASA as it continues to rework its plans.

    Today's hearing, though, is not on any specific proposal. Rather, our goal today is to learn what has worked elsewhere and why and to start thinking how the experience of others could be put to work to help NASA.

    This is one of the most important tasks facing this committee, and I am eager to hear from our witnesses today. And I want to thank you all for being resources.

    [The prepared statement of Mr. Boehlert follows:]

PREPARED STATEMENT OF CHAIRMAN SHERWOOD BOEHLERT

    I want to welcome everyone to today's hearing, which concerns one of the most critical recommendations of the Columbia Accident Investigation Board (CAIB).

    The CAIB was clear and on-target in citing organizational deficiencies as a leading cause of the Columbia accident. It was also clear and on-target in calling for the establishment of a new Independent Technical Engineering Authority and of a truly independent safety organization.

    In both its conclusions and its recommendations on organization, the CAIB was, unfortunately, able to follow a well-worn path. The Rogers Commission and the Shuttle Independent Assessment Team, among others, had made similar recommendations. They all apparently fell on deaf ears. That must not be allowed to happen again.
 Page 20       PREV PAGE       TOP OF DOC

    NASA Administrator Sean O'Keefe is to be applauded for deciding that the re-organization of NASA should occur before return-to-flight, setting a more ambitious schedule than that called for by the CAIB. He should also be congratulated for recognizing NASA's organizational deficiencies before the Columbia accident, which led him to initiate the so-called ''bench-marking studies'' comparing NASA with the Navy.

    But, of course, undertaking the right studies and setting the right schedule is not enough. NASA must actually come up with the right reorganization plan and make sure that it is taken to heart.

    The CAIB did not dictate exactly how NASA should carry out its recommendations, so NASA is now in the process of drawing up its plans, and this committee will have to review those plans with a fine-tooth comb.

    The purpose of today's hearing is to help give us the background to do just that. We will hear from organizations that the CAIB cited as possible models for NASA to follow and from an industrial leader in safety. Obviously, there are differences among these models, and any one of them would have to be adapted to apply to NASA. But they all highlight characteristics of high-reliability organizations that NASA has been lacking. We will learn from Admiral Gehman precisely why and how the Navy and Air Force safety programs can be seen as models for NASA.

    I have no doubt that this committee will have ample opportunity over the next year or so to put to use the information we gather today. As I noted earlier, NASA is just in the initial stages of putting together an organization plan, and I have complete confidence that Administrator O'Keefe has taken the CAIB recommendations to heart.
 Page 21       PREV PAGE       TOP OF DOC

    But that said, I must note that I believe the initial organization ideas being circulated by NASA fall significantly short of the mark. We look forward to working with NASA as it continues to rework its plans.

    Today's hearing, though, is not on any specific proposal. Rather, our goal today is to learn what has worked elsewhere and why, and to start thinking how the experience of others could be put to work to help NASA.

    This is one of the most important tasks facing this committee, and I am eager to hear from our witnesses today.

    Chairman BOEHLERT. The gentleman from Texas, Mr. Hall.

    Mr. HALL. Thank you, Mr. Chairman. I certainly join you in welcoming the panel and Admiral Bowman and Admiral Sullivan, Mr. Johnson, and Ms. Grubbe. And Admiral Gehman is to be here. I think he has a conflict right now, but he is to join us. We look forward to his input and his backing up the testimony that we are going to be hearing here and to thank him again for an excellent job that he did at a time when we really needed an excellent job to be done.

    As we continue to address the recommendations of the panel, we now come to absolutely the most important part of it. We have talked about organizational items, and we were organized then, but we just weren't organized properly. And we need organizational changes now. And that has got to be the thrust. The Columbia Accident Investigation Board, the CAIB, report devotes an entire chapter to the organizational causes of the accident. And in it, the CAIB makes three specific recommendations, and those are based on the CAIB's investigation of organizations that have had success in setting up and maintaining highly regarded safety procedures. They have had some experience and they know what they are doing. They know what they are recommending.
 Page 22       PREV PAGE       TOP OF DOC

    So three of the organizations represented by our witnesses here are specifically named by CAIB as examples of organizations, and I quote, ''highly adept in dealing with inordinately high risk by designing hardware and management systems that prevent seemingly inconsequential failure from leading to major disasters.'' And you almost have to read that and read it again to really get the full impact of it. But we want to hear from each of you about the characteristics of your approaches to safety that you think are important for NASA to adopt.

    However, setting up the right organizational structure is only part of the job. Ensuring that the organization carries through on safe practices is equally important. That is where independent oversight can play a valuable role, and that is why the Chairman emphasizes independence, independence, independence. After the Apollo fire in 1968, Congress set up the Aerospace Safety Advisory Panel, ASAP, to provide that function for the agency. And in recent years, it has become apparent that NASA had not followed through on a number of the ASAP's constructive recommendations. As many of you know, the entire membership of ASAP resigned last month. And that is highly irregular. I can't even remember such an action ever occurring. I think we need to find out why they resigned and what we need to do to address their concerns.

    One of the ASAP's recommendations concerned the need for a crew escape system for the Shuttle. And I think ASAP was exactly right on that. I would also note that the appendices to the CAIB report that were released this week make it clear that we can and we should be doing more to ensure crew survivability on the Shuttle. I don't understand why we can't. I am going to press—continue to press for NASA action on a crew escape system if the Shuttle is going to be flying for many more years. If it is going to be flying for another year, I want us to be underway at doing it. I would hate to have a tragedy at the end of this year and not have already launched a method for them to escape whether we are able to get that in place. It is just like Reagan's star wars. I don't think Russia ever knew if we had one in place or not, but I think it helped that we were on our way there. And the fact that we were working toward it gave us a lot electronically and even nationally defense-wise. And it was worthwhile. It was worth what we spent for it.
 Page 23       PREV PAGE       TOP OF DOC

    So I—and I have another concern. Admiral Gehman has made the point in recent months that he is concerned about NASA not following through on the CAIB recommendations once the Shuttle returns to flight. I also share his concern. I think an independent group is needed to monitor NASA's implementation of the CAIB recommendations. One potential approach is contained in H.R. 3219, a bill I recently introduced that directs the NASA Administrator to work with the National Academies of Science and Engineering to establish such an independent oversight committee. It would report yearly to Congress for five years following the launch of the next Shuttle. As I have said, it is one potential approach. It is not the only one. There may be others. There may be a better way to go about ensuring continuing, independent oversight of NASA's Shuttle program. And I am open to suggestions. But I think we need to take action. I introduced that to get something kicked off, to get it going in the right direction. And if anybody can pick a better direction or a faster direction or a safer direction, then I am certainly interested in looking at. I—but I don't want CAIB's recommendations to wind up being ignored.

    Well, I won't take any more time, Mr. Chairman, to discuss these issues. I know we all want to hear from the witnesses, very valuable witnesses, and people that are givers and not takers. You have had to prepare yourself to come here. You had to prepare yourself to know what you know and to do what you have done and then to share it with us. I appreciate it, and I know the Chair and this committee does.

    And I yield back my time.

    [The prepared statement of Mr. Hall follows:]

 Page 24       PREV PAGE       TOP OF DOC
PREPARED STATEMENT OF REPRESENTATIVE RALPH M. HALL

    Good morning. I want to join the Chairman in welcoming Admiral Bowman, Admiral Sullivan, Mr. Johnson, and Ms. Grubbe to our hearing. Admiral Gehman, welcome back to our committee. We again look forward to your comments.

    As we continue to address the recommendations of the Gehman Panel, we now come to one of the most important areas—organizational changes. The Columbia Accident Investigation Board (CAIB) report devotes an entire chapter to the organizational causes of the accident. In it, the CAIB makes three specific recommendations. Those recommendations are based on the CAIB's investigation of organizations that have had success in setting up and maintaining highly regarded safety procedures.

    Three of the organizations represented by our witnesses are specifically named by the CAIB as examples of organizations ''highly adept in dealing with inordinately high risk by designing hardware and management systems that prevent seemingly inconsequential failure from leading to major disasters.'' We want to hear from each of you about the characteristics of your approaches to safety that you think are important for NASA to adopt.

    However, setting up the right organizational structure is only part of the job. Ensuring that the organization carries through on safe practices is equally important. That's where independent oversight can play a valuable role. After the Apollo fire in 1968, Congress set up the Aerospace Safety Advisory Panel (ASAP) to provide that function for the agency. In recent years, it has become apparent that NASA has not followed through on a number of the ASAP's constructive recommendations. As many of you know, the entire membership of the ASAP resigned last month. I can't ever remember such an action occurring, and I think we need to find out why they resigned and what we need to do to address their concerns.
 Page 25       PREV PAGE       TOP OF DOC

    One of the ASAP's recommendations concerned the need for a crew escape system for the Shuttle. I think the ASAP was right. I'd also note that the appendices to the CAIB report that were released this week make it clear that we can and should be doing more to ensure crew survivability on the Shuttle. I'm going to continue to press for NASA action on a crew escape system if the Shuttle is going to be flying for many more years.

    I have another concern. Admiral Gehman has made the point in recent months that he is concerned about NASA not following through on the CAIB recommendations once the Shuttle returns to flight. I share his concern. I think an independent group is needed to monitor NASA's implementation of the CAIB recommendations. One potential approach is contained in H.R. 3219, a bill I recently introduced that directs the NASA Administrator to work with the National Academies of Sciences and Engineering to establish such an independent oversight committee. It would report yearly to Congress for five years following the launch of the next shuttle. As I said, it is one potential approach. There may be other ways to go about ensuring continuing, independent oversight of NASA's Shuttle program, and I am open to suggestions. But I think we need to take action soon so that the CAIB's recommendations don't wind up getting ignored.

    Well, I will not take any more time to discuss these issues in my opening statement. I know we all want to hear from the witnesses, and I will continue this discussion during the question period.

    I look forward to your testimony, and I yield back the balance of my time.

    Chairman BOEHLERT. Thank you very much, Mr. Hall.
 Page 26       PREV PAGE       TOP OF DOC

    The gentleman from Tennessee, Mr. Gordon.

    Mr. GORDON. Thank you, Mr. Chairman. I think that you sent us in a good direction with your earlier remarks, so I will be brief here. I want to also welcome the witnesses. It is my understanding that Admiral Gehman is on his way over from the Senate. And again, I want to thank him for his willingness to appear before the Committee again.

    The Columbia Accident Investigation Board, which he chaired, raised a number of serious issues about the way NASA addressed safety in the Shuttle program. The Board came to the conclusion that should be of concern to all Members, namely, and I quote, ''We are convinced that the management practices overseeing the Space Shuttle program were as much a cause of the accident as the foam that struck the left wing.'' To its credit, the Board did not simply highlight the problem. It also tried to offer some suggestions on how NASA might address the management issue.

    Today, we are going to hear from some non-NASA organizations that the Board thinks may have some lessons learned for NASA. I look forward to their testimony. In particular, I hope that we can—or that they can offer the Committee some benchmarks by which we can judge NASA's responses to the Board's organizational recommendations.

    Beyond that, Mr. Chairman, I hope that this hearing will be just a starting point for our examination of these issues. I hope that we will look at additional models of safety and organizations for insights that they might offer. For example, I think that we should look at how NASA and DOD handled experimental flight testing programs at the Dryden Research Center and Edwards Air Force Base.
 Page 27       PREV PAGE       TOP OF DOC

    I also think that it might be worth taking a look—a closer look at the Russian human space flight program. As I understand it, the Russians haven't had a space flight fatality since 1971, or more than 30 years ago. We might also benefit from the examination of how NASA handled safety in the earlier years, that is during the Apollo moon-landing program. Apollo was an extremely challenging program that may have lessons for us to learn today, also.

    And finally, I want to support Mr. Hall's concerns and comments. I was also very concerned about the mass resignation of the Aerospace Safety Panel. ASAP members, I think we need to hear from them and hear more about why they resigned and what they feel like is necessary for their independence.

    So there is a lot to cover today, and once again, thank you, Mr. Chairman, for bringing us together for this important meeting and I am glad the witnesses are giving their time today.

    Chairman BOEHLERT. Thank you very much, Mr. Gordon and Mr. Hall.

    [The prepared statement of Mr. Rohrabacher follows:]

PREPARED STATEMENT OF REPRESENTATIVE DANA ROHRABACHER

    Mr. Chairman, your leadership has enabled this committee to carefully deliberate on the root causes that contributed to the Columbia Space Shuttle accident and critical issues surrounding the future of our civil space program in the wake of this tragedy.
 Page 28       PREV PAGE       TOP OF DOC

    Admiral Gehman and his colleagues found that overconfidence and an overly bureaucratic nature dominated NASA's historical decision-making of Shuttle Program managers. Although NASA claims it has made safety a high priority within the Space Shuttle Program, ''blind spots'' inherent in its culture impeded its ability to detect risks posed by something as simple as form.

    NASA must get its house in order before it attempts to meet the challenge of space exploration. Our witnesses will provide us insight on how their organizations apply best practices for reducing the likelihood of accidents. Let's hope that what we learn today is useful for getting NASA on the path of recovery tomorrow.

    Thank you Mr. Chairman.

    [The prepared statement of Mr. Costello follows:]

PREPARED STATEMENT OF REPRESENTATIVE JERRY F. COSTELLO

    Good morning. I want to thank the witnesses for appearing before our committee to discuss the organizational and management issues confronting NASA in the aftermath of the Space Shuttle Columbia accident. Today's hearing serves has an opportunity for Congress to gain a better understanding of the Columbia Accident Investigation Board (CAIB) recommendations and the successful safety programs of the organizations represented at this hearing so as to have an informed basis for judging whether NASA is in compliance with the CAIB recommendations.
 Page 29       PREV PAGE       TOP OF DOC

    I have been concerned with the Safety and Health regulation structure used by the DOE civilian labs. My colleague, Congressman Ken Calvert, has worked with me to introduce a bill ending DOE's self-regulation and opening the civilian labs up to regulation by OSHA and the NRC. The Jet Propulsion Laboratory (JPL) has been drawn into this discussion inadvertently due to its inclusion in the DOE 2002 Best Practices Study. That report, coupled with reviews done by the General Accounting Office, draws attention to the relative efficiency of JPL's management processes and provides a snapshot for what we would like to see at the civilian labs.

    The same can be said about the Naval Nuclear Propulsion Program, the SUBSAFE program, and Aerospace Corporation in relation to NASA and evaluating best safety practices. You each represent organizations that have been identified as leaders in safety. The CAIB report recommends that NASA establish an independent Technical Engineering Authority that is responsible for all technical requirements and waivers to them. Further, the CAIB's fundamental goal in establishing this independent body is to separate the responsibility for safety from the Shuttle's program responsibility for cost and schedule.

    I am interested to know if each of your organizations has an independent technical engineering authority or something similar and how it is independent from other elements of the organization, funded and staffed. Further, I am interested to know from Admiral Gehman how he and CAIB view the role of the Shuttle program manager in light of the CAIB recommendations.

    I welcome our panel of witnesses and look forward to their testimony.

    [The prepared statement of Ms. Johnson follows:]
 Page 30       PREV PAGE       TOP OF DOC

PREPARED STATEMENT OF REPRESENTATIVE EDDIE BERNICE JOHNSON

    Thank you, Mr. Chairman. I would like to thank you for calling this hearing today, and I would also like to thank our witnesses for agreeing to appear here today to answer our questions.

    Today we are here to discuss issues concerning organization and management at the National Aeronautics and Space Administration (NASA).

    At the end of the past summer, the final report of the Columbia Accident Investigation Board (CAIB) was released. While much of it focused on the technical causes, there was also a substantial emphasis on poor decisions and other organizational issues that may have led to the accident. Included in this report are communications about how repeated foam strikes on the Shuttle became damaged, as well as communications and decision-making issues among engineers and managers while the Shuttle was in orbit. These types of mistakes are entirely too costly.

    We are now seeing the warning signs that show that NASA is an agency in trouble. The Columbia Accident Investigation Board sharply criticized NASA's safety and management procedures. With problems escalating rather than abating, NASA still seems ready to put the mission ahead of an abundance of caution. What could be the disastrous affects if the Space Station is not being properly maintained and supplied, increasing the risk to its crew? In this environment, if senior safety officials cannot halt the launch of a replacement crew to a deteriorating Space Station, who at NASA can and would abort a dangerous mission?
 Page 31       PREV PAGE       TOP OF DOC

    We must put forth a more concerted effort to protect the safety of our astronauts.

    It was over 40 years ago that this nation's leaders in human space travel were given the foresight to recognize the importance of space exploration. It is my hope that NASA will continue this exploration, with the intent of making safety first in all of their endeavors.

    [The prepared statement of Ms. Jackson Lee follows:]

PREPARED STATEMENT OF REPRESENTATIVE SHEILA JACKSON LEE

Mr. Chairman,

    Thank you for calling yet another critical hearing in this series to ensure that we in Congress are doing all we can do to help NASA get back on track to fulfilling its vital mission in Space. I have been pleased by the bipartisan spirit here and in the Space Subcommittee since February, when we lost the Shuttle Columbia and her brave crew. Fulfilling the call of the Gehman Board and changing the culture at NASA will take hard work, creativity, and good ideas from both sides of the aisle.

    But we do not need to re-invent the wheel. As was stated in the Columbia Accident Investigation Board Report, there are several excellent models of organizations that work in high-risk areas, and still maintain solid safety records. I thank the representatives from those groups for joining us today, to enlighten us on the management practices they use to ensure that safety is not an afterthought, but a top priority.
 Page 32       PREV PAGE       TOP OF DOC

    Working together, I hope we can draw from their experiences and craft policies for NASA that will ensure that Shuttles and the Space Station, as well as the spaceships of the future, are robust and reliable.

    I am especially interested in their opinions on the role of whistleblower protections and retaliation prevention in promoting open dialogue and safety. After the Columbia Disaster, it was painful to hear from the CAIB that there were people at NASA—and not just some interns with naive notions—but experienced engineers, who had recognized the dangers, and tried to take prudent steps to get images that may have averted disaster. Those experts were ignored. That is truly painful to think about. The report gave great insight into the broken culture of safety at NASA that impeded the flow of critical information from engineers up to program managers. I quote: ''Further, when asked by investigators why they were not more vocal about their concerns, Debris Assessment Team members opined that by raising contrary points of view about Shuttle mission safety, they would be singled out for possible ridicule by their peers.''

    That reaffirms to me that strong whistleblower protections do not just protect workers. They protect lines of communication and dialogue that prevent waste, fraud, and abuse, and, in this case, might have saved lives. I have been working with union representatives to develop a pathway within NASA, through which workers with serious concerns about the safety of a mission or the survivability of crew can go to express their opinions. That body will make sure that due attention is given to their concerns. After that, the same office will be charged with following the employee that came to them over time, to ensure that they are not harassed or retaliated against in any way.
 Page 33       PREV PAGE       TOP OF DOC

    Workers that think critically and act responsibly should be rewarded, not punished. Protecting such workers will send a signal to all workers that safety must always come before speed. I would like to hear the panelists' opinions of this approach.

    I am also interested in their opinions of what proportion of their budgets are dedicated to safety and quality assurance. Budgets are tight these days, and many important programs are being cut. However, if we are going to continue our mission in space—as I believe we must—we need to spend the appropriate funds to protect our investments and our astronauts. How much will that cost?

    I am also pleased to see Admiral Gehman here again to share his expertise and insights with us. I would like to continue the dialogue we started last month, exploring how we can ensure that the lessons we learn about how to make the Shuttle safer also carry over to the Space Station and other NASA programs. Recent revelations that the new Space Station crew was sent up against the will of senior medical personnel were disturbing. It was even more disturbing to hear that the internal debates about hazards to the crew did not percolate up to the Administrator until a couple of days before flight—and never made it to us in Congress. I hope it is not business-as-usual at NASA. I would like to hear the Admiral's ideas on this matter.

    I look forward to the discussion. Thank you.

Panel I

    Chairman BOEHLERT. Let us get right to our panel.
 Page 34       PREV PAGE       TOP OF DOC

    The panel consists of: Admiral F.L. ''Skip'' Bowman, Director, Naval Nuclear Propulsion Program; Rear Admiral Paul E. Sullivan, Deputy Commander, Ship Design, Integration and Engineering, Naval Sea Systems Command; Ray F. Johnson, Vice President, Space Launch Operations, The Aerospace Corporation; and Ms. Deborah Grubbe, Corporate Director, Safety and Health, DuPont. Thank you all for your willingness to serve as resources for this committee. And as you will discover, we are going to listen in wrapped attention, because what you have to say is very important to us and—as we go about our very important work. And I would ask that you try to summarize your statement. The Chair is not going to be arbitrary. What you have to say is too darn important to confine it to 300 seconds, but that would be sort of a benchmark of five minutes or so, so that we will have ample time for a dialogue and an exchange so that we can learn. Thank you very much.

    Admiral Bowman, you are first up.

STATEMENT OF ADMIRAL F.L. ''SKIP'' BOWMAN, DIRECTOR, NAVAL NUCLEAR PROPULSION PROGRAM, U.S. NAVY

    Admiral BOWMAN. Mr. Chairman, Mr. Hall, Members of the Committee, thank you very much for the opportunity to testify today on the culture of safety that has allowed Naval Reactors to be successful for the last 55 years.

    First, let me say that I wish the circumstances that brought me here were different. I am sure it is true with you, also. Obviously, the underlying reason I am here involves your oversight of NASA in the aftermath of the Space Shuttle Columbia tragedy.
 Page 35       PREV PAGE       TOP OF DOC

    I want to begin, then, by extending my sympathy to all of the families, colleagues, and friends of the Columbia crew. I must also tell you that although there has been, and continues to be, much public discussion of the tragedy, why it happened and what changes NASA should pursue, I do not know firsthand the details surrounding the accident nor am I an expert on spacecraft or the NASA organization. I am therefore not qualified to make judgments about the causes of the tragedy or to even suggest changes that NASA may implement to prevent our nation from suffering another terrible loss. However, I have studied, very carefully, the final report of the Columbia Accident Investigation Board, and I believe, therefore, that you might draw some useful thoughts from my testimony today.

    I am often asked, Mr. Chairman, how it is that Naval Reactors has been able to maintain its impeccable safety record for these 55 years. Just last week, I participated in a conference that asked these same questions, commemorating the 50th anniversary of President Eisenhower's ''Atoms for Peace'' speech, which partially addressed these very questions that I will address today. And many of the things that I have said then are applicable today.

    Since Admiral Hyman Rickover began the Naval Reactors Program in 1948, we have insisted that the only way to operate our nuclear power plants, the only way to ensure safe operation generation after generation, is to embrace a system that ingrains in each operator a total commitment to safety, a pervasive, enduring devotions to a culture of safety and environmental stewardship.

    To ensure the Program's success, as our record of safety clearly demonstrates, Admiral Rickover established these core values, which endure today. First, technical excellence and technical competence are absolutely required in our work. Because things do happen, especially at sea, we rely on a multi-layered defense against off-normal events. Our reactor designs and operating procedures are uncomplicated and conservative, and we build in redundancy. Next, we still, and always will, select the very best people we can find with the highest integrity and professional competence; then we rigorously train them and continually challenge them. Third, we require formality and discipline, and we insist on forceful backup from the very youngest sailor on board all of the way up through to the commanding officer. And fourth, every level of the Program must accept inescapable, cradle-to-grave responsibility for every aspect of nuclear power operations. These core values, among others, are what define our organizational culture. They are visible in everything we do and have done for the last 55 years.
 Page 36       PREV PAGE       TOP OF DOC

    Today, in my eighth year as Admiral Rickover's successor, the fourth director of Naval Reactors, I oversee the operation of 103 naval reactors, equaling the number of commercial reactors in this country. These reactors, powering U.S. Navy ships, are welcomed in more than 150 ports and more than 50 countries around the world.

    That welcome access is primarily due to our safety record. Safety is embedded in our organization in every individual at every level. Put another way, we use the word ''mainstreamed.'' Safety is mainstreamed. It is not a responsibility unique to a segregated safety department that then attempts to impose its oversight on the rest of the organization. Each individual is completely responsible for his or her component, his or her system, from cradle to grave and this drives two other vital aspects of the way we do business.

    First, when solving a problem, we determine the range of technically acceptable answers first. Then we find out how to fit one of those solutions into our other constraints, specifically cost and schedule, without imposing any undue risk and without challenging the safety aspects of the technically acceptable answers. If we need more time or more money, we simply ask for it. Although we pride ourselves as stewards of the Government's resources, we don't let funding or schedules outweigh sound technical judgment.

    Second, the decision-making process occasionally brings out dissenting or minority opinions. When this occurs, my staff presents the facts from both sides of the issues to me directly. Before a final decision is made, every opinion is aired. There is never any fear of reprisal for not agreeing with the proposed recommendation; rather, if there is not a minority opinion, I ask why not and solicit that minority opinion, treat it with the same weight as the consensus view. If I determine that there is enough information to make a decision, then I make a decision. If more data are needed, then we get more data.
 Page 37       PREV PAGE       TOP OF DOC

    In the aftermath of Three Mile Island, the accident in 1979, Admiral Rickover was asked to testify before Congress in a context very similar to my appearance here today. In his testimony, he said the following: ''Over the years, many people have asked me how I run the Naval Reactors Program so that they might find some benefit for their own work. I am always chagrined at the tendency of people to expect that I have a simple, easy gimmick that makes my program function. Any successful program functions as an integrated whole of many factors. Trying to select just one aspect as the key one will not work. Each element depends on all of the others.''

    I wholeheartedly agree with what Admiral Rickover said those years ago. As I said earlier, there is no magic formula. Safety must be in the mainstream.

    Mr. Chairman, with your permission, I will submit a copy of my written testimony along with Admiral Rickover's 1979 testimony for the record. This testimony is very relevant, because it describes many of the same attributes and core values that I have discussed today, demonstrating that in fact these key elements of Naval Reactors are timeless and enduring. That testimony also details the continual training program for the nuclear-trained Fleet operators. I have taken the opportunity to update the statistics on the first four pages of Admiral Rickover's testimony to put them in perspective for today's real numbers. Also, with your permission, I will submit a copy of the Program's annual environmental, occupational radiation exposure, and occupational safety and health reports for the Committee's perusal.

    Our basic organization responsibilities, and, most importantly, our core values have remained largely unchanged since Admiral Rickover founded Naval Reactors. These core values that I have discussed today are the foundation that have allowed our nuclear-powered ships to safely steam more than 128 million miles, equivalent to over 5,000 trips around the Earth, without a reactor accident, indeed, with no measurable negative impact on the environment or human health.
 Page 38       PREV PAGE       TOP OF DOC

    Thank you very much for allowing me to testify today.

    [The prepared statement of Admiral Bowman follows:]

PREPARED STATEMENT OF ADMIRAL F.L. ''SKIP'' BOWMAN

    Mr. Chairman and Members of this committee, thank you for giving me the opportunity to testify today on the subject of the culture of safety that has allowed Naval Reactors to be successful for the last 55 years.

    But first, let me say that that I wish the circumstances that brought me here were different. Obviously, the underlying reason I'm here involves your oversight of NASA in the aftermath of the Space Shuttle Columbia tragedy. I want to begin, then, by extending my sympathy to all the families, colleagues, and friends of the Columbia crew. I must also tell you that although there has been and continues to be much public discussion of the tragedy—why it happened, what changes NASA should pursue, and others—I do not know first-hand the details surrounding the accident, nor am I an expert on spacecraft or the NASA organization. I therefore am not qualified to make judgments about the causes of the tragedy or to suggest changes that NASA may implement to prevent our nation from suffering another terrible loss. However, having studied the final report of the Columbia Accident Investigation Board, I believe you may draw some useful conclusions from my testimony.

    My area of expertise is the Naval Reactors Program (NR), so it's better for me to talk about that. Admiral Hyman G. Rickover set up NR in 1948 to develop nuclear propulsion for naval warships. Nuclear propulsion is vital to the Navy today for the reasons Admiral Rickover envisioned 55 years ago: it gives our warships high speed, virtually unlimited endurance, worldwide mobility, and unmatched operational flexibility. When applied to our submarines, nuclear propulsion also enables the persistent stealth that allows these warships to operate undetected for long periods in hostile waters, exercising their full range of capabilities.
 Page 39       PREV PAGE       TOP OF DOC

    In 1982, after almost 34 years as the Director of Naval Reactors, Admiral Rickover retired. Recognizing the importance of preserving the authority and responsibilities Admiral Rickover had established, President Reagan signed Executive Order 12344. The provisions of the executive order were later set forth in Public Laws 98–525 [1984] and 106–65 [1999]. The executive order and laws require that the Director, Naval Reactors, hold positions of decision-making authority within both the Navy and the Department of Energy (DOE). Because continuity and stature are vital, the director has the rank of four-star admiral within the Navy and Deputy Administrator within the Department of Energy's National Nuclear Security Administration and a tenure of eight years.

    Through the Executive Order and these laws, the director has responsibility for all aspects of naval nuclear propulsion, specifically:

 Direct supervision of our single-purpose DOE laboratories, the Expended Core Facility, and our training reactors.

 Research, development, design, acquisition, procurement, specification, construction, inspection, installation, certification, testing, overhaul, refueling, operating practices and procedures, maintenance, supply support, and ultimate disposition of naval nuclear propulsion plants and components, plus any related special maintenance and service facilities.

 Training (including that which is conducted at the DOE training reactors), assistance and concurrence in the selection, training, qualification, and assignment of personnel reporting to the director and of personnel who supervise, operate, or maintain naval nuclear propulsion plants.
 Page 40       PREV PAGE       TOP OF DOC

 Administration of the Naval Nuclear Propulsion Program, including oversight of Program support in areas such as security, nuclear safeguards and transportation, public information, procurement, logistics, and fiscal management.

 And finally, perhaps most relevant to this committee, I am responsible for the safety of the reactors and associated naval nuclear propulsion plants, and control of radiation and radioactivity associated with naval nuclear propulsion activities, including prescribing and enforcing standards and regulations for these areas as they affect the environment and the safety and health of workers, operators, and the general public.

    For more than seven years, I have been the director, the third successor to Admiral Rickover. I am responsible for the safe operation of 103 nuclear reactors—the same number as there are commercial nuclear power reactors in the U.S. Roughly 40 percent of the Navy's major combatants are nuclear powered, including 10 of its 12 aircraft carriers plus 54 attack submarines, 16 ballistic missile submarines, and two former ballistic missile submarines being converted to SSGNs (guided missile submarines). Also included in these 103 reactors are four training reactors and the NR–1, a deep submersible research submarine. The contribution these ships and their crews make to the national defense and, more recently, to the Global War on Terrorism is remarkable. And the Program's safety record speaks for itself: these warships have steamed over 128 million miles since 1953 and are welcomed in over 150 ports of call in over 50 countries around the world.

    Safety is the responsibility of everyone at every level in the organization. Safety is embedded across all organizations in the Program, from equipment suppliers, contractors, laboratories, shipyards, training facilities, and the Fleet to our Headquarters. Put another way, safety is mainstreamed. It is not a responsibility unique to a segregated safety department that then attempts to impose its oversight on the rest of the organization.
 Page 41       PREV PAGE       TOP OF DOC

    To clarify what I mean by mainstreaming, let me tell you a story from my days as Chief of Naval Personnel. I was speaking to a large gathering of Army, Navy, Air Force, and Marine Corps military and civilian personnel at the Defense Equal Opportunity Management Institute. I startled the group by beginning with the phrase, ''I'm here to tell you about plans to put you out of your jobs in a few years!'' I explained that a worthwhile goal would be to have an organization that didn't need specialists to monitor, enforce, and remind line management to do what's right. That's mainstreaming.

    Our record of safety is the result of our making safety part of everything we do, day to day, not a magic formula. To achieve this organizational culture of safety in the mainstream, Admiral Rickover established certain core values in Naval Reactors that remain very visible today. I will discuss four of them: People, Formality and Discipline, Technical Excellence and Competence, and Responsibility.

PEOPLE

    Admiral Rickover has been rightly credited with being an outstanding engineer and a gifted manager of technical matters. His other genius lay in finding and developing the right people to do extremely demanding jobs.

    At NR, we still, and we always will, select the best people we can find, with the highest integrity and the willingness to accept complete responsibility over every aspect of nuclear-power operations. Admiral Rickover personally selected every member of his Headquarters staff and every naval officer accepted into the Program. This practice is still in place today, and I conduct these interviews and make the final decision myself.
 Page 42       PREV PAGE       TOP OF DOC

    It doesn't end there. After we hire the best men and women, the training they need to be successful begins immediately. All members of my technical staff undergo an indoctrination course that occupies their first several months at Headquarters. Next, they spend two weeks at one of our training reactors, learning about the operation of the reactor and the training our Fleet sailors are undergoing. This is experience with an actual, operating reactor plant, not a simulation or a PowerPoint presentation—and it is an important experience. It gives them an understanding that the work they do affects the lives of the sailors directly, while they perform the Navy's vital national defense role. This helps reinforce the tenet that the components and systems we provide must perform when needed.

    Shortly after they return from the training reactor, they spend six months at one of our DOE laboratories for an intensive, graduate-level course in nuclear engineering. Once that course is complete, they spend three weeks at a nuclear-capable shipyard, observing production work and work controls. Finally, they return to Headquarters and are assigned to work in one of our various technical jobs. During the next six months, they attend a series of seminars, covering broad technical and regulatory matters, led by the most experienced members of my staff.

    At Headquarters, there is a continued emphasis on professional development as we typically provide training courses that are open to the entire staff each month on various topics, technical and non-technical. In particular, we have many training sessions on lessons we've learned—trying to learn from mistakes that we, or others, have made in order to prevent similar mistakes from recurring.

 Page 43       PREV PAGE       TOP OF DOC
    Throughout their careers, the members of my staff are continually exposed to the end product, spending time on the waterfront, at the shipyards, in the laboratories, at the vendor sites, or interacting directly with the Fleet. My staff audits nuclear shipyards, vendors, training facilities, laboratories, and the ships to validate that our expectations are met. In addition, we receive constant feedback from the Fleet by several means. When a nuclear-powered ship returns from deployment, my staff and I are briefed on the missions the ship performed and any significant issues concerning the propulsion plant. Additionally, I have a small cadre of Fleet-experienced, nuclear-trained officers at Headquarters who, like me, bring operational expertise and perspective to the table.

    My Headquarters staff is very small, comprised of about 380 people, including administrative and support personnel. We are also an extremely ''flat'' organization. About 50 individuals report directly to me, including my Headquarters section heads, plus field representatives at shipyards, major Program vendors, and the laboratories. Included in this is a small section of people responsible for Reactor Plant Safety Analysis. In an organization where safety is truly mainstreamed, one might ask why we have a section for Reactor Plant Safety Analysis. Here's why: they provide most of the liaison with other safety organizations (such as the NRC) to help ensure we are using best practices and to champion the use of those practices within my staff. They also maintain the documentation of procedures and upkeep of the modeling codes used in our safety analysis. Last, they provide one last layer that our mainstreamed safety practices are in fact working the way they should—an independent verification that we are not ''normalizing'' threats to safety. Thus, they are full-time safety experts who provide our corporate memory of what were past problems, what we have to do to maintain a consistent safety approach across all projects, and what we need to follow in civilian reactor safety practices.

 Page 44       PREV PAGE       TOP OF DOC
    Nearly all my Headquarters staff came to Naval Reactors right out of college. A great many of them spend their entire careers in the Program. For example, my section heads, the senior managers who report directly to me, have an average of more than 25 years of Program experience. It is therefore not uncommon that a junior engineer working on the design of a component in a new reactor plant system will be responsible several years later for that same system during its service life.

    Even though the focus of my testimony is on my Headquarters staff, I should also point out the importance of the Navy crews who operate our nuclear-powered warships. Again, I personally select the best people I can find and then train them constantly, giving them increasing challenges and responsibilities throughout their careers. My Headquarters staff and I oversee this training directly.

FORMALITY AND DISCIPLINE

    Engineering for the long haul demands that decisions be made in a formal and disciplined manner. By ''the long haul,'' I mean the cradle-to-grave life of a project, and even an individual reactor plant. Before a new class of ships (which may be in service for more than 50 years) is even put into service, we typically have already determined how we will perform maintenance—and refueling, if needed—and have considered eventual decommissioning and disposal of that ship. In the long life of a project, all requests and recommendations are received as formal correspondence. Resolution of issues is documented, as well. Whether we are approving a minor change to one of our technical manuals or resolving a major Fleet issue, the resolution will be clearly documented in formal correspondence.

 Page 45       PREV PAGE       TOP OF DOC
    That correspondence must have the documented concurrence of all parties within the Headquarters that have a stake in the matter. There are formal systems in place to track open commitments and agreements or dissents with proposed actions. I receive a copy of every recommended action prior to issue, a practice initiated by Admiral Rickover in July 1949; in fact, these recommendations are frequently discussed in detail and, when necessary, ''cleared'' with me prior to issue.

    The 50 individuals who report directly to me inform me regularly and routinely of issues in their area of responsibility. In addition, commanding officers of nuclear-powered warships are required to report to me routinely on matters pertaining to the propulsion plant.

    This organizational ''flatness'' streamlines the flow of information in both directions—allowing me to ensure that the guidance I provide reaches everyone, while ensuring that my senior leaders and I receive timely information vital to making the right decisions.

    In our ships and at our training reactors, we require formality and discipline. Detailed written procedures are in place for all aspects of operation. These procedures are based on over 50 years of ship operational experience, and they are followed to the letter, with what we call verbatim—but not blind—compliance. Independent auditing, coupled with critical self-assessments at all levels and activities, is virtually continuous to ensure that crews are trained and procedures are followed properly. We insist on forceful backup, from young sailor to commanding officer. We also insist that the only way to operate our nuclear power plants—the only way to ensure safe operation, generation after generation—is to embrace a system that ingrains in each operator a total commitment to safety: a pervasive, enduring commitment to a culture of safety and environmental stewardship.
 Page 46       PREV PAGE       TOP OF DOC

TECHNICAL EXCELLENCE AND COMPETENCE

    Technical excellence and competence are required in our work. Nearly all of my managers are technical people with either an engineering or science background. My job requires me to be qualified by reason of technical background and experience in naval nuclear propulsion. I am a qualified, nuclear-trained naval officer, having previously served in many operational billets, including commanding officer of a submarine and of a submarine tender that maintains nuclear ships. It is crucial that the people making decisions understand the technology they are managing and the consequences of their decisions. It is also important that much of the technical expertise reside within the Government organization that oversees the contractor work. This enables the Government to be a highly informed and demanding customer of contractor technology and services.

    An important part of our technical effort is working on small problems to prevent bigger problems from occurring. The way we do this is to ask the hard questions on every issue: What are the facts? How do you know? Who is responsible? Who else knows about the issue and what are they doing about it? What other ships and places could be affected? What is the plan? When will it be done? Is this within our design, test, and operational experience? What are the expected outcomes? What is the worst that could happen? What are the dissenting opinions? When dealing with an issue that seems minor, these and other questions like them not only lead us to solving the current problem before it gets worse, but also help us prevent future problems.

    As we look at the many potential solutions to a given problem, we determine the range of technically acceptable answers first. Then we find out how to fit one of those solutions into our other constraints, specifically cost and schedule, without imposing any undue risk. If we need more time or more money, we ask for it. Although we pride ourselves as stewards of the Government's resources, we do not let funding or schedule concerns outweigh sound technical judgment.
 Page 47       PREV PAGE       TOP OF DOC

    Occasionally, the decision-making process brings out dissenting opinions. When this occurs, my staff presents the facts from both sides of the issue to me directly. Before a final decision is made, every opinion is aired. There is never any fear of reprisal for not agreeing with the proposed recommendation; rather, we solicit and welcome the minority opinion and treat it with the same weight as the consensus view. If I determine there is enough information to make a decision, I decide. If more data are needed, we get more.

    Because things do happen—especially at sea—we rely on a multi-layered defense against off-normal events. Our reactor designs and operating procedures are simple and conservative, and we build in redundancy to compensate for the risks involved and the operational environment. (For example, the pressurized water reactors are self-regulating: the reactor is designed to protect itself during normal operations or casualty situations.) The systems and components are rugged—they must be to withstand battle shock and still perform. In certain key systems, there are redundant components so that if one is unable to function, the other can take over.

RESPONSIBILITY

    Admiral Rickover realized the importance of having total responsibility. He once said:

Responsibility is a unique concept: it can only reside and inhere in a single individual. You may share it with others, but your portion is not diminished. You may delegate it, but it is still with you. You may disclaim it, but you cannot divest yourself of it. Even if you do not recognize it or admit its presence, you cannot escape it. If responsibility is rightfully yours, no evasion, or ignorance, or passing the blame can shift the burden to someone else. Unless you can point your finger at the person who is responsible when something goes wrong, then you have never had anyone really responsible.
 Page 48       PREV PAGE       TOP OF DOC

    His concept of total responsibility and ownership permeates NR at every level. He also realized that while the Navy designed and operated the ships, the Atomic Energy Commission (the forerunner of the Department of Energy) was responsible for the nuclear research and development—he would need to have authority within both activities. Hence, he forged a joint Navy/Atomic Energy Commission program having the requisite authority within each activity to carry out the cradle-to-grave responsibility for all aspects of naval nuclear propulsion, including safety.

CONCLUSION

    In the aftermath of the Three Mile Island accident in 1979, Admiral Rickover was asked to testify before Congress in a context similar to my appearance before you today. In this testimony, he said:

Over the years, many people have asked me how I run the Naval Reactors Program, so that they might find some benefit for their own work. I am always chagrined at the tendency of people to expect that I have a simple, easy gimmick that makes my program function. Any successful program functions as an integrated whole of many factors. Trying to select one aspect as the key one will not work. Each element depends on all the others.

    I wholeheartedly agree. As I said earlier, there is no magic formula. Safety must be in the mainstream.

    Mr. Chairman, with your permission, I will submit a copy of Admiral Rickover's 1979 testimony for the record. This testimony is relevant because it describes many of the same key attributes and core values I have discussed today—demonstrating that in fact, these key elements of Naval Reactors are timeless and enduring. That testimony also details the continual training program for the nuclear-trained Fleet operators I mentioned earlier. I have updated the statistics on the first four pages to make them current and placed them in parentheses beside the 1979 data. Also, with your permission, I will submit a copy of the Program's annual environmental, occupational radiation exposure, and occupational safety and health reports. [Note: These items are located in Appendix 2: Additional Material for the Record.]
 Page 49       PREV PAGE       TOP OF DOC

    Our basic organization, responsibilities, and, most important, our core values have remained largely unchanged since Admiral Rickover founded NR. These core values that I've discussed today are the foundation that have allowed our nuclear-powered ships to safely steam more than 128 million miles, equivalent to over 5,000 trips around the Earth. . .without a reactor accident. . .indeed, with no measurable negative impact on the environment or human health.

    Thank you for allowing me to testify before you today.

BIOGRAPHY FOR ADMIRAL FRANK LEE BOWMAN

    United States Navy, Director, Naval Nuclear Propulsion

    Admiral Frank L. ''Skip'' Bowman is a native of Chattanooga, Tenn. He was commissioned following graduation in 1966 from Duke University. In 1973 he completed a dual master's program in nuclear engineering and naval architecture/marine engineering at the Massachusetts Institute of Technology and was elected to the Society of Sigma Xi. Adm. Bowman has been awarded the honorary degree of Doctor of Humane Letters from Duke University. Admiral Bowman serves on two visiting committees at MIT (Ocean Engineering and Nuclear Engineering), the Engineering Board of Visitors at Duke University, and the Nuclear Engineering Department Advisory Committee at the University of Tennessee.

    His early assignments included tours in USS Simon Bolivar (SSBN 641), USS Pogy (SSN 647), USS Daniel Boone (SSBN 629), and USS Bremerton (SSN 698). In 1983, Adm. Bowman took command of USS City Of Corpus Christi (SSN 705), which completed a seven-month circumnavigation of the globe and two special classified missions during his command tour. His crew earned three consecutive Battle Efficiency ''E'' awards. Adm. Bowman later commanded USS Holland (AS 32) from August 1988 to April 1990. During this period, the Holland crew was awarded two Battle Efficiency ''E'' awards.
 Page 50       PREV PAGE       TOP OF DOC

    Ashore, Adm. Bowman has served on the staff of Commander, Submarine Squadron Fifteen, in Guam; twice in the Bureau of Naval Personnel in the Submarine Policy and Assignment Division; as the SSN 21 Attack Submarine Program Coordinator on the staff of the Chief of Naval Operations; on the Chief of Naval Operations' Strategic Studies Group; and as Executive Assistant to the Deputy Chief of Naval Operations (Naval Warfare). In December 1991, he was promoted to flag rank and assigned as Deputy Director of Operations on the Joint Staff (J–3) until June 1992, and then as Director for Political-Military Affairs (J–5) until July 1994. Adm. Bowman served as Chief of Naval Personnel from July 1994 to September 1996.

    Admiral Bowman assumed duties as Director, Naval Nuclear Propulsion, on 27 September 1996, and was promoted to his present rank on 1 October 1996. In this position, he is also Deputy Administrator for Naval Reactors in the National Nuclear Security Administration, Department of Energy.

    Under his command, his crews have earned the Meritorious Unit Commendation (three awards), the Navy Battle Efficiency ''E'' Ribbon (five awards), the Navy Expeditionary Medal (two awards), the Humanitarian Service Medal (two awards), the Sea Service Deployment Ribbon (three awards), and the Navy Arctic Service Ribbon. His personal awards include the Defense Distinguished Service Medal, the Navy Distinguished Service Medal, the Legion of Merit (with three gold stars), and the Officier de l'Ordre National du Mérite from the Government of France.

    Chairman BOEHLERT. Thank you very much for some very fine testimony. And without objection, your statement, in its entirety, along with the supplemental material, will be included in the record. And that will hold true for the testimony of all of our distinguished witnesses. We want everything you can give us, because we—that is how we learn. And thank you, Admiral, and congratulations, once again, for an outstanding program.
 Page 51       PREV PAGE       TOP OF DOC

    Admiral Sullivan.

STATEMENT OF REAR ADMIRAL PAUL E. SULLIVAN, DEPUTY COMMANDER, SHIP DESIGN, INTEGRATION AND ENGINEERING, NAVAL SEA SYSTEMS COMMAND, U.S. NAVY

    Rear Admiral SULLIVAN. Good morning, Mr. Chairman, Mr. Hall, Members of the Committee. I would like to thank you for the opportunity to testify about the Submarine Safety Program, which we call in the Navy, SUBSAFE.

    I serve as the Naval Sea Systems Command's Deputy Commander for Ship Design, Integration and Engineering. My organization is the authority for the technical requirements that underpin the SUBSAFE Program.

    Mr. Chairman, I have submitted a written statement, which addresses the questions you raised about the SUBSAFE Program, and I will summarize that statement for you now.

    On April 10, 1963, when engaged in a deep test dive, the USS Thresher was lost with 129 people on board. The loss of Thresher and her crew was a devastating event for the submarine community, the Navy, and the Nation.

    Shortly after that tragedy, the SUBSAFE Program was created in June 1963. It established submarine design requirements, initial submarine safety certification requirements, and submarine safety certification continuity requirements.
 Page 52       PREV PAGE       TOP OF DOC

    The purpose of the SUBSAFE Program is to provide maximum reasonable assurance of watertight integrity and the ability of our submarines to recover from flooding. It is important to note that the SUBSAFE Program does not spread or dilute its focus beyond that purpose.

    The heart of the Program is a combination of work discipline, material control, and documentation.

    The SUBSAFE Program has been very successful, however, it has not been without problems. For example, in 1984 NAVSEA directed a thorough evaluation of the SUBSAFE Program to ensure that mandatory discipline had been maintained. As a result, the following year, in 1985, the Submarine Safety and Quality Assurance Division was established as an independent organization within NAVSEA to strengthen compliance with SUBSAFE requirements.

    The SUBSAFE Program continues to adapt to the ever-changing construction and maintenance environments as well as new and evolving technologies as they become used on our submarines.

    Safety is central to the culture of our entire Navy submarine community, including designers, builders, maintainers, and operators. The Navy's submarine safety culture is instilled through the following: first, clear, concise, non-negotiable requirements; second, multiple, structured audits; and third, annual training with strong, emotional lessons learned from past failures.

 Page 53       PREV PAGE       TOP OF DOC
    SUBSAFE certification is a disciplined process that lead to formal authorization for unrestricted operations on a submarine. Once a submarine is certified for unrestricted operation, we use three elements to maintain that certification. The first, the Re-entry Control Process, is used to control work within the SUBSAFE boundary and is the backbone of this certification continuity. The second, the Unrestricted Operation/Maintenance Requirement Program, is used to carry out periodic inspections and tests of critical systems, and that is the technical basis for continued unrestricted operations. Third, SUBSAFE audits are used to confirm compliance with SUBSAFE requirements. We use two primary types of audits. The first is a certification audit, and that audit examines the objective quality evidence, or paperwork, for an individual submarine to ensure that that submarine is satisfactory for unrestricted operations. Functional audits review the organizations that perform SUBSAFE work to ensure that the organization complies with SUBSAFE requirements.

    In addition to these formal NAVSEA audits, our field organizations and the Fleet are required to conduct their own similar internal audits. In fact, we also have the field activities audit the headquarters. We have some homework to do, for instance, from the most recent of those headquarters audits that was performed this summer.

    The SUBSAFE Program has a formal organizational structure, which has key—three key elements: first, technical authority; second, program management; and third, the submarine safety and quality assurance. Each of these elements is organizationally independent and has the authority to stop the certification process until an identified issue has been satisfactorily resolved.

    Our nuclear submarines require a highly competent and experienced technical workforce and constant vigilance to prevent complacency. Despite our past successes, mandated downsizing of our workforce has caused us to continually optimize our processes and to become more efficient while we maintain that culture of safety.
 Page 54       PREV PAGE       TOP OF DOC

    In conclusion, let me reiterate that since the inception of the SUBSAFE Program in 1963, the Navy has had a disciplined process that provides maximum reasonable assurance that our submarines are safe from flooding and can recover from a flooding incident. We have taken the lessons learned from the Thresher to heart, and we have them—made them a part of our submarine culture.

    Thank you.

    [The prepared statement of Rear Admiral Sullivan follows:]

PREPARED STATEMENT OF REAR ADMIRAL PAUL E. SULLIVAN

NAVAL SEA SYSTEMS COMMAND

SUBMARINE SAFETY (SUBSAFE) PROGRAM

    Good Morning Chairman Boehlert, Ranking Member Hall and Members of the Committee.

    Thank you for the opportunity to testify before this committee about the Submarine Safety Program, which the Navy calls SUBSAFE, and how it operates.

    My name is RADM Paul Sullivan, USN. I serve as the Naval Sea System Command's Deputy Commander for Ship Design, Integration and Engineering, which is the authority for the technical requirements of the SUBSAFE Program.
 Page 55       PREV PAGE       TOP OF DOC

    To establish perspective, I will provide a brief history of the SUBSAFE Program and its development. I will then give you a description of how the program operates and the organizational relationships that support it. I am also prepared to discuss our NASA/Navy benchmarking activities that have occurred over the past year.

SUBSAFE PROGRAM HISTORY

    On April 10, 1963, while engaged in a deep test dive, approximately 200 miles off the northeastern coast of the United States, the USS THRESHER (SSN–593) was lost at sea with all persons aboard—112 naval personnel and 17 civilians. Launched in 1960 and the first ship of her class, the THRESHER was the leading edge of U.S. submarine technology, combining nuclear power with a modern hull design. She was fast, quiet and deep diving. The loss of THRESHER and her crew was a devastating event for the submarine community, the Navy and the Nation.

    The Navy immediately restricted all submarines in depth until an understanding of the circumstances surrounding the loss of the THRESHER could be gained.

    A Judge Advocate General (JAG) Court of Inquiry was conducted, a THRESHER Design Appraisal Board was established, and the Navy testified before the Joint Committee on Atomic Energy of the 88th Congress.

    The JAG Court of Inquiry Report contained 166 Findings of Fact, 55 Opinions, and 19 Recommendations. The recommendations were technically evaluated and incorporated into the Navy's SUBSAFE, design and operational requirements.
 Page 56       PREV PAGE       TOP OF DOC

    The THRESHER Design Appraisal Board reviewed the THRESHER's design and provided a number of recommendations for improvements.

    Navy testimony before the Joint Committee on Atomic Energy occurred on June 26, 27, July 23, 1963 and July 1, 1964 and is a part of the Congressional Record.

    While the exact cause of the THRESHER loss is not known, from the facts gathered during the investigations, we do know that there were deficient specifications, deficient shipbuilding practices, deficient maintenance practices, and deficient operational procedures. Here's what we think happened:

 THRESHER had about 3000 silver-brazed piping joints exposed to full submergence pressure. During her last shipyard maintenance period 145 of these joints were inspected on a not-to-delay vessel basis using a new technique called Ultrasonic Testing. Fourteen percent of the joints tested showed sub-standard joint integrity. Extrapolating these test results to the entire population of 3000 silver-brazed joints indicates that possibly more than 400 joints on THRESHER could have been sub-standard. One or more of these joints is believed to have failed, resulting in flooding in the engine room.

 The crew was unable to access vital equipment to stop the flooding.

 Saltwater spray on electrical components caused short circuits, reactor shutdown, and loss of propulsion power.

 Page 57       PREV PAGE       TOP OF DOC
 The main ballast tank blow system failed to operate properly at test depth. We believe that various restrictions in the air system coupled with excessive moisture in the system led to ice formation in the blow system piping. The resulting blockage caused an inadequate blow rate. Consequently, the submarine was unable to overcome the increasing weight of water rushing into the engine room.

    The loss of THRESHER was the genesis of the SUBSAFE Program. In June 1963, not quite two months after THRESHER sank, the SUBSAFE Program was created. The SUBSAFE Certification Criterion was issued by BUSHIPS letter Ser 525–0462 of 20 December 1963, formally implementing the Program.

    The Submarine Safety Certification Criterion provided the basic foundation and structure of the program that is still in place today. The program established:

 Submarine design requirements

 Initial SUBSAFE certification requirements with a supporting process, and

 Certification continuity requirements with a supporting process.

    Over the next 11 years the submarine safety criterion underwent 37 changes. In 1974, these requirements and changes were codified in the Submarine Safety Requirements Manual (NAVSEA 0924–062–0010). This manual continues to be the set of formal base requirements for our program today. Over the years, it has been successfully applied to many classes of nuclear submarines and has been implemented for the construction of our newest VIRGINIA Class submarine.
 Page 58       PREV PAGE       TOP OF DOC

    The SUBSAFE Program has been very successful. Between 1915 and 1963, sixteen submarines were lost due to non-combat causes, an average of one every three years. Since the inception of the SUBSAFE Program in 1963, only one submarine has been lost. USS SCORPION (SSN 589) was lost in May 1968 with 99 officers and men aboard. She was not a SUBSAFE certified submarine and the evidence indicates that she was lost for reasons that would not have been mitigated by the SUBSAFE Program. We have never lost a SUBSAFE certified submarine.

    However, SUBSAFE has not been without problems. We must constantly remind ourselves that it only takes a moment to fail. In 1984 NAVSEA directed that a thorough evaluation be conducted of the entire SUBSAFE Program to ensure that the mandatory discipline and attention to detail had been maintained. In September 1985 the Submarine Safety and Quality Assurance Office was established as an independent organization within the NAVSEA Undersea Warfare Directorate (NAVSEA 07) in a move to strengthen the review of and compliance with SUBSAFE requirements. Audits conducted by the Submarine Safety and Quality Assurance Office pointed out discrepancies within the SUBSAFE boundaries. Additionally, a number of incidents and breakdowns occurred in SUBSAFE components that raised concerns with the quality of SUBSAFE work. In response to these trends, the Chief Engineer of the Navy chartered a senior review group with experience in submarine research, design, fabrication, construction, testing and maintenance to assess the SUBSAFE program's implementation. In conjunction with functional audits performed by the Submarine Safety and Quality Assurance Office, the senior review group conducted an in depth review of the SUBSAFE Program at submarine facilities. The loss of the CHALLENGER in January 1986 added impetus to this effort. The results showed clearly that there was an unacceptable level of complacency fostered by past success; standards were beginning to be seen as goals vice hard requirements; and there was a generally lax attitude toward aspects of submarine configuration.
 Page 59       PREV PAGE       TOP OF DOC

    The lessons learned from those reviews include:

 Disciplined compliance with standards and requirements is mandatory.

 An engineering review system must be capable of highlighting and thoroughly resolving technical problems and issues.

 Well-structured and managed safety and quality programs are required to ensure all elements of system safety, quality and readiness are adequate to support operation.

 Safety and quality organizations must have sufficient authority and organizational freedom without external pressure.

    The Navy continues to evaluate its SUBSAFE Program to adapt to the ever-changing construction and maintenance environments as well as new and evolving technologies being used in our submarines. Since its creation in 1974 the SUBSAFE Manual has undergone several changes. For example, the SUBSAFE boundary has been redefined based on improvements in submarine recovery capability and establishment of a disciplined material identification and control process. An example of changing technology is the utilization of fly-by-wire ship control technology on SEAWOLF and VIRGINIA class submarines. Paramount in this adaptation process is the premise that the requirements, which keep the SUBSAFE Program successful, will not be compromised. It is a daily and difficult task; but our program and the personnel who function within it are committed to it.

 Page 60       PREV PAGE       TOP OF DOC
PURPOSE AND FOCUS

    The purpose of the SUBSAFE Program is to provide maximum reasonable assurance of watertight integrity and recovery capability. It is important to recognize that the SUBSAFE Program does not spread or dilute its focus beyond this purpose. Mission assurance is not a concern of the SUBSAFE Program, it is simply a side benefit of the program. Other safety programs and organizations regulate such things as fire safety, weapons systems safety, and nuclear reactor systems safety.

    Maximum reasonable assurance is achieved by certifying that each submarine meets submarine safety requirements upon delivery to the Navy and by maintaining that certification throughout the life of the submarine.

    We apply SUBSAFE requirements to what we call the SUBSAFE Certification Boundary—those structures, systems, and components critical to the watertight integrity and recovery capability of the submarine. The SUBSAFE boundary is defined in the SUBSAFE Manual and depicted diagrammatically in what we call SUBSAFE Certification Boundary Books.

SUBSAFE CULTURE

    Safety is central to the culture of our entire Navy submarine community, including designers, builders, maintainers, and operators. The SUBSAFE Program infuses the submarine Navy with safety requirements uniformity, clarity, focus, and accountability.

    The Navy's safety culture is embedded in the military, Civil Service, and contractor community through:
 Page 61       PREV PAGE       TOP OF DOC

 Clear, concise, non-negotiable requirements,

 Multiple, structured audits that hold personnel at all levels accountable for safety, and

 Annual training with strong, emotional lessons learned from past failures.

    Together, these processes serve as powerful motivators that maintain the Navy's safety culture at all levels. In the submarine Navy, many individuals understand safety on a first-hand and personal basis. The Navy has had over one hundred thousand individuals that have been to sea in submarines. In fact, many of the submarine designers and senior managers at both the contractors and NAVSEA routinely are on-board each submarine during its sea trials. In addition, the submarine Navy conducts annual training, revisiting major mishaps and lessons learned, including THRESHER and CHALLENGER.

    NAVSEA uses the THRESHER loss as the basis for annual mandatory training. During training, personnel watch a video on the THRESHER, listen to a two-minute long audio tape of a submarine's hull collapsing, and are reminded that people were dying as this occurred. These vivid reminders, posters, and other observances throughout the submarine community help maintain the safety focus, and it continually renews our safety culture. The Navy has a traditional military discipline and culture. The NAVSEA organization that deals with submarine technology also is oriented to compliance with institutional policy requirements. In the submarine Navy there is a uniformity of training, qualification requirements, education, etc., which reflects a single mission or product line, i.e., building and operating nuclear powered submarines.
 Page 62       PREV PAGE       TOP OF DOC

SUBSAFE CERTIFICATION PROCESS

    SUBSAFE certification is a process, not just a final step. It is a disciplined process that brings structure to our new construction and maintenance programs and leads to formal authorization for unrestricted operations. SUBSAFE certification is applied in four areas:

 Design,

 Material,

 Fabrication, and

 Testing.

    Certification in these areas applies both to new construction and to maintenance throughout the life of the submarine.

    The heart of the SUBSAFE Program and its certification processes is a combination of Work Discipline, Material Control, and Documentation:

 Work discipline demands knowledge of the requirements and compliance with those requirements, for everyone who performs any kind of work associated with submarines. Individuals have a responsibility to know if SUBSAFE impacts their work.
 Page 63       PREV PAGE       TOP OF DOC

 Material Control is everything involved in ensuring that correct material is installed correctly, beginning with contracts that purchase material, all the way through receipt inspection, storage, handling, and finally installation in the submarine.

 Documentation important to SUBSAFE certification falls into two categories:

 Selected Record Drawings and Data: Specific design products are created when the submarine is designed. These products consist of documents such as system diagrams, SUBSAFE Mapping Drawings, Ship Systems Manuals, SUBSAFE certification Boundary Books, etc. They must be maintained current throughout the life of the submarine to enable us to maintain SUBSAFE certification.

 Objective Quality Evidence (OQE): Specific work records are created when work is performed and consist of documents such as weld forms, Non-Destructive Testing forms, mechanical assembly records, hydrostatic and operational test forms, technical work documents in which data is recorded, waivers and deviations, etc. These records document the work performed and the worker's signature certifying it was done per the requirements. It is important to understand that SUBSAFE certification is based on objective quality evidence. Without objective quality evidence there is no basis for certification, no matter who did the work or how well it was done. Objective quality evidence provides proof that deliberate steps were taken to comply with requirements.

    The basic outline of the SUBSAFE certification process is as follows:

 Page 64       PREV PAGE       TOP OF DOC
 SUBSAFE requirements are invoked in the design and construction contracts for new submarines, in the work package for submarines undergoing depot maintenance periods, and in the Joint Fleet Maintenance Manual for operating submarines.

 Material procurement and fabrication, overhaul and repair, installation and testing generate objective quality evidence for these efforts. This objective quality evidence is formally and independently reviewed and approved to assure compliance with SUBSAFE requirements. The objective quality evidence is then retained for the life of the submarine.

 Formal statements of compliance are provided by the organizations performing the work and by the government supervising authority responsible for the oversight of these organizations. All organizations performing SUBSAFE work must be evaluated, qualified and authorized in accordance with NAVSEA requirements to perform this work. A Naval Supervising Authority, assigned to each contractor organization, is responsible to monitor and evaluate contractor performance.

 Audits are conducted to examine material, inspect installations and review objective quality evidence for compliance with SUBSAFE requirements.

 For new construction submarines and submarines in major depot maintenance periods, the assigned NAVSEA Program Manager uses a formal checklist to collect specific documentation and information required for NAVSEA Headquarters certification. When all documentation has been collected, reviewed and approved by the Technical Authority and the SUBSAFE Office, the Program Manager formally presents the package to the Certifying Official for review and certification for sea trials. For new construction submarines, the formal presentation of the certification package is made to the Program Executive Officer for Submarines, and for in-service submarines completing a major depot maintenance period the certification package is formally presented to the Deputy Commander for Undersea Warfare. Approval by the Certifying Official includes verification of full concurrence, as well as discussion and resolution of dissenting opinions or concerns. After successful sea trials, a second review is performed prior to authorizing unrestricted operations for the submarine.
 Page 65       PREV PAGE       TOP OF DOC

SUBSAFE CERTIFICATION MAINTENANCE

    Once a submarine is certified for unrestricted operation, there are two elements, in addition to audits, that we use to maintain the submarine in a certified condition. They are the Re-Entry Control Process and the Unrestricted Operation/Maintenance Requirement Card (URO/MRC) Program.

    Re-entry Control is used to control work within the SUBSAFE Certification Boundary. It is the backbone of certification maintenance and continuity. It provides an identifiable, accountable and auditable record of work performed within the SUBSAFE boundary. The purpose is to provide positive assurance that all SUBSAFE systems and components are restored to a fully certified condition. Re-entry control procedures help us maintain work discipline by identifying the work to be performed and the standards to be met. Re-entry control establishes personal accountability because the personnel authorizing, performing and certifying the work and testing must sign their names on the re-entry control documentation. It is the process we use to collect the OQE that supports certification.

    The Unrestricted Operation/Maintenance Requirement Card (URO/MRC) Program facilitates planned periodic inspections and tests of critical equipment, systems, and structure to ensure that they have not degraded to an unacceptable level due to use, age, or environment. The URO/MRC Program provides the technical basis for authorizing continued unrestricted operations of Navy submarines. The responsibility to complete URO/MRC inspections is divided among multiple organizations. Some inspections can only be completed by a shipyard during a maintenance period. Other inspections are the responsibility of an Intermediate Maintenance Activity or Ships Force. NAVSEA manages the program by tracking performance to ensure that periodicity requirements are not violated, inspections are not missed, and results meet invoked technical requirements.
 Page 66       PREV PAGE       TOP OF DOC

AUDITS

    A key element of certification and certification maintenance is the audit program. The audit program was established in 1963. During testimony before Congress Admiral Curtze stated: ''To ensure the adequacy of the application of the quality assurance programs in shipyards a system of audits has been established.. . .'' This system of audits is still in place today. There are two primary types of audits: Certification Audits and Functional Audits.

    In a SUBSAFE CERTIFICATION Audit we look at the Objective Quality Evidence associated with an individual submarine to ensure that the material condition of that submarine is satisfactory for sea trials and unrestricted operations. These audits are performed at the completion of new construction and at the end of major depot maintenance periods. They cover a planned sample of specific aspects of all SUBSAFE work performed, including inspection of a sample of installed equipment. The results and resolution of deficiencies identified during such audits become one element of final NAVSEA approval for sea trials and subsequent unrestricted operations.

    In a SUBSAFE FUNCTIONAL Audit we periodically review the policies, procedures, and practices used by each organization, including contractors, that performs SUBSAFE work, to ensure that those policies, procedures and practices comply with SUBSAFE requirements, are healthy, and are capable of producing certifiable hardware or design products. This audit also includes surveillance of actual work in progress. Organizations audited include public and private shipyards, engineering offices, the Fleet, and NAVSEA headquarters.

    In addition to the audits performed by NAVSEA, our shipyards, field organizations and the Fleet are required to conduct internal (or self) audits of their policies, procedures, and practices and of the work they perform.
 Page 67       PREV PAGE       TOP OF DOC

SUBSAFE ORGANIZATIONAL RELATIONSHIPS

    The SUBSAFE Program maintains a formal organizational structure with clear delineation of responsibilities in the SUBSAFE Requirements Manual. Ultimately, the purpose of the SUBSAFE Organization is to support the Fleet. We strongly believe that our sailors must be able to go to sea with full confidence in the safety of their submarine. Only then will they be able to focus fully on their task of operating the submarine and carrying out assigned operations successfully.

    There are three key elements in our Headquarters organization: Technical Authority, Program Management and Submarine Safety and Quality Assurance. Each of these elements is organizationally independent and has specifically defined roles in the SUBSAFE Program.

    NAVSEA Technical Authority provides technical direction and assistance to Program Managers and the Fleet. In our terms, Technical Authority is the authority, responsibility and accountability to establish, monitor and approve technical products and policy in conformance to higher tier policy and requirements. Technical authorities are warranted (formally given authority) within NAVSEA and our field organizations. Technical warrant holders are subject matter experts. Within the defined technical area warranted, they are responsible for establishing technical standards, entrusted and empowered to make authoritative decisions, and held accountable for the technical decisions made. Where technical products are not in conformance with technical policy, standards and requirements, warrant holders are responsible to identify associated risks and approve non-conformances (waivers or deviations) in a manner that ensures risks are acceptable. NAVSEA is accustomed to evaluating risk; however, non-conformances are treated as an exception vice the norm. Full discussion of technical issues is required before making decisions. Discussions and decisions are coordinated with the Program Management and Submarine Safety and Quality Assurance Offices. However, NAVSEA 05, Ship Design, Integration and Engineering, is the final authority for the technical requirements of the SUBSAFE Program.
 Page 68       PREV PAGE       TOP OF DOC

 Within the Undersea Warfare Directorate (NAVSEA 07) the Director, Submarine Hull, Mechanical and Electrical Engineering Management Division (NAVSEA 07T) is the warranted technical authority and provides system engineering and support for submarine technical SUBSAFE issues.

    Submarine Program Managers manage all aspects of assigned submarine programs in construction, maintenance and modernization, including oversight of cost, schedule, performance and direction of life cycle management. They are responsible and accountable to ensure compliance with the requirements of the SUBSAFE Program and with technical policy and standards established by the technical authority.

    The Submarine Safety and Quality Assurance Office (NAVSEA 07Q) manages the SUBSAFE program and audits organizations performing SUBSAFE work to ensure compliance with SUBSAFE requirements. NAVSEA 07Q is the primary point of contact within NAVSEA Headquarters in all matters relating to SUBSAFE Program policy and requirements.

    In addition, several groups and committees have been formally constituted to provide oversight of and guidance to the SUBSAFE Program and to provide a forum to evaluate and make changes to the program:

 The SUBSAFE Oversight Committee (SSOC) provides independent command level oversight to ensure objectives of the SUBSAFE Program are met. Members are of Flag rank and represent NAVSEA Directorates (SEA 09, PEO–SUB, SEA 05, SEA 04, SEA 07) and the Navy Inventory Control Point.

 The SUBSAFE Steering Task Group (SSSTG) was established based on results of the THRESHER investigation to ensure adequate provision of safety features in current and future submarine construction, conversion, and major depot availability programs. The SSSTG defines the scope of the SUBSAFE Program, reviews program progress and approves or disapproves proposed policy changes. Members include Admirals, Senior Executive Service members and other senior civilian managers with direct SUBSAFE and technical responsibilities, as well as the Submarine Program Managers.
 Page 69       PREV PAGE       TOP OF DOC

 The SUBSAFE Working Group (SSWG) consists of SUBSAFE Program Directors from Headquarters, shipyards, field organizations, and the Fleet. The Working Group meets formally twice a year to provide a forum to discuss and evaluate SUBSAFE Program progress, implementation and proposals for improvement. SUBSAFE Program Directors are the focal point for SUBSAFE matters and are responsible and accountable for implementation and proper execution of the SUBSAFE Program within their respective organizations. They maintain close liaison with NAVSEA 07Q to present or obtain information relative to SUBSAFE issues.

SUBSAFE CERTIFICATION RELATIONSHIPS

    As described earlier in this testimony, each NAVSEA organization is assigned separate responsibility and authority for SUBSAFE Program requirements and compliance. Our technical authority managers are empowered and accountable to make disciplined technical decisions. They are formally given the authority, responsibility and accountability to establish, monitor and approve technical products and policy. The Submarine Program Managers are responsible for executing the SUBSAFE Program for assigned submarines in new construction and major depot availabilities. They have the authority, responsibility and accountability to ensure compliance with technical policy and standards established by cognizant technical authority. NAVSEA 07Q, Submarine Safety and Quality Assurance Office, is responsible and accountable for implementation and management of the SUBSAFE Program and for ensuring compliance with SUBSAFE Program requirements.

    The ultimate certification authority is the Program Executive Officer for Submarines (PEO SUB) for new construction and the Deputy Commander for Undersea Warfare (NAVSEA 07) for major depot availabilities. The Program manager, with the concurrence of and in the presence of the technical authority representative (NAVSEA 07T) and the SUBSAFE office (NAVSEA 07Q), presents the certification package with which he attests that the SUBSAFE material condition of the submarine is satisfactory for sea trials or for unrestricted operation. Each of the participants has the authority to stop the certification process until an identified issue is satisfactorily resolved.
 Page 70       PREV PAGE       TOP OF DOC

NAVSEA PERSONNEL

    Our nuclear submarines are among the most complex weapon systems ever built. They require a highly competent and experienced technical workforce to accomplish their design, construction, maintenance and operation. In order for NAVSEA to continue to provide the best technical support to all aspects of our submarine programs, we are challenged to recruit and maintain a technically qualified workforce. In 1998, faced with downsizing and an aging workforce, NAVSEA initiated several actions to ensure we could meet current and future challenges. We refocused on our core competencies, defined new engineering categories and career paths, and obtained approval to infuse our engineering skill sets with young engineers to provide for a systematic transition of our workforce. We hired over 1000 engineers with a net gain of 300. This approach allowed our experienced engineers to train and mentor young engineers and help NAVSEA sustain our core competencies. Despite this limited success, mandated downsizing has continued to challenge us. I remain concerned about our ability, in the near future, to provide adequate technical support to, and quality overview of our submarine construction and maintenance programs.

NASA/NAVY BENCHMARKING EXCHANGE (NNBE)

    The NASA/NAVY Benchmarking Exchange effort began activities in August 2002 and is ongoing. The NNBE was undertaken to identify practices and procedures and to share lessons learned in the Navy's submarine and NASA's human space flight programs. The focus is on safety and mission assurance policies, processes, accountability, and control measures. To date, nearly all of this effort has involved the Navy describing our organization, processes and practices to NASA. The NNBE Interim report was completed December 20, 2002.
 Page 71       PREV PAGE       TOP OF DOC

    Phase-2 was initiated in January 2003 with 40 NAVSEA personnel spending a week at the Kennedy Space Center (January 13–17) being briefed on a wide array of topics related to the manufacturing, processing, and launch of the Space Shuttle with emphasis on safety, compliance verification, and safety certification processes. A follow-up trip to Kennedy Space Center and a trip to Johnson Space Center were scheduled for early February 2003. After loss of Columbia, the NAVSEA benchmarking of NASA activity was placed on hold until October when 18 NAVSEA software experts were hosted by their NASA counterparts for a week of meetings at Kennedy Space Center and Johnson Space Center. It should also be noted that Naval Reactors hosted 45 senior NASA managers for a ''Challenger Launch Decision'' training seminar at the Washington Naval Yard on May 15.

    Three Memoranda of Agreement (MOA) have been developed to formalize NASA/NAVSEA ongoing collaboration. The first, recently signed, establishes a sharing of data related to contractor and supplier quality and performance. The second MOA, in final preparation, establishes the basis for reciprocal participation in functional audits. The third MOA, also in final preparation, will establish reciprocal participation in engineering investigations and analyses.

    In conclusion, let me reiterate that since the inception of the SUBSAFE Program in 1963, the Navy has had a disciplined process that provides MAXIMUM reasonable assurance that our submarines are safe from flooding and can recover from a flooding incident. In 1988, at a ceremony commemorating the 25th anniversary of the loss of THRESHER, the Navy's ranking submarine officer, Admiral Bruce Demars, said: ''The loss of THRESHER initiated fundamental changes in the way we do business, changes in design, construction, inspections, safety checks, tests and more. We have not forgotten the lesson learned. It's a much safer submarine force today.''
 Page 72       PREV PAGE       TOP OF DOC

BIOGRAPHY FOR REAR ADMIRAL PAUL E. SULLIVAN

    United States Navy, Deputy Commander for Ship Design Integration and Engineering, Naval Sea Systems Command

    Rear Admiral Sullivan is a native of Chatham, N.J. He graduated from the U.S. Naval Academy in 1974 with a Bachelor of Science Degree in Mathematics.

    Following graduation, Rear Adm. Sullivan served aboard USS Detector (MSO 429) from 1974 to 1977, where he earned his Surface Warfare Qualification.

    Rear Adm. Sullivan then attended the Massachusetts Institute of Technology (MIT), where he graduated in 1980 with dual degrees of Master of Science (Naval Architecture and Marine Engineering) and Ocean Engineer. While at MIT, he transferred to the Engineering Duty Officer Community.

    Rear Adm. Sullivan's Engineering Duty Officer tours prior to command include Ship Superintendent, Docking Officer, Assistant Repair Officer and Assistant Design Superintendent at Norfolk Naval Shipyard, where he completed his Engineering Duty Officer qualification; Deputy Ship Design Manager for the Seawolf class submarine at Naval Sea Systems Command (NAVSEA), where he completed his submarine qualification program; Associate Professor of Naval Architecture at MIT; Ohio (SSBN 726) Class Project Officer and Los Angeles (SSN 688) Class Project Officer at Supervisor of Shipbuilding, Groton, Conn.; Team Leader for Cost, Producibility, and Cost and Operational Effectiveness Assessment (COEA) studies for the New Attack Submarine at NAVSEA; and the Director for Submarine Programs on the staff of the Assistant Secretary of the Navy (Research, Development and Acquisition).
 Page 73       PREV PAGE       TOP OF DOC

    Rear Adm. Sullivan served as Program Manager for the Seawolf Class Submarine Program (PMS 350) 1995 to 1998. During his tenure, the Seawolf design was completed, and the lead ship of the class was completed, tested at sea, and delivered to the Navy.

    In September 1998, Rear Adm. Sullivan relieved as Program Manager for the Virginia Class Submarine Program (PMS 450). During his tour the contract for the Virginia Class Submarine Program was signed, construction was initiated on the first four submarines, and most of the Virginia design was completed. In September 2001 he reported to his current assignment as Deputy Commander for Ship Design Integration and Engineering, Naval Sea Systems Command. Rear Adm. Sullivan's awards include the Legion of Merit (two awards), the Meritorious Service Medal (four awards), the Navy Commendation Medal (two awards) and the Navy Achievement Medal.

    Chairman BOEHLERT. Thank you very much, Admiral Sullivan.

    Mr. Johnson.

STATEMENT OF MR. RAY F. JOHNSON, VICE PRESIDENT, SPACE LAUNCH OPERATIONS, THE AEROSPACE CORPORATION

    Mr. JOHNSON. Thank you. Mr. Chairman, distinguished Committee Members, and staff, I am pleased to have the opportunity to describe the capabilities of The Aerospace Corporation as they relate to organizational and management ''best practices'' of successful safety and mission assurance programs.

 Page 74       PREV PAGE       TOP OF DOC
    I will discuss the Committee's questions as outlined in the invitation letter, but first, I would like to present an overview of Aerospace and specifically what we do for the Air Force in the area of launch readiness verification.

    The Aerospace Corporation is a private, non-profit, California corporation that was created in 1960 at the recommendation of Congress to provide research, development, and advisory services to the U.S. Government in the planning and acquisition of space, launch, and ground systems and their related technologies.

    As its primary activity, Aerospace operates a Federally Funded Research and Development Center, or FFRDC, sponsored by the Undersecretary of the Air Force and managed by the Space and Missile Systems Center, or SMC, in El Segundo, California. Our principal tasks are systems planning, systems engineering, integration, flight readiness verification, operations support, and anomaly resolution for DOD, Air Force, and National Security Space systems. Independent launch verification is a core competency of Aerospace, as defined in its charter. As such, Aerospace is directly accountable to SMC for the verification of launch readiness. The verification begins as early as the concept and requirement definition phase of most programs and continues through flight operations. This assessment includes things such as design, qualification, fabrication, acceptance, software, mission analysis, integration, and test.

    Prior to any launch, Aerospace provides a letter to SMC documenting the results of the launch verification process, confirming the flight readiness of the launch vehicle. This letter is not just a formality but represents the culmination of a long and rigorous assessment that draws upon the collective expertise of scientists and engineers within the program office and engineering staff.
 Page 75       PREV PAGE       TOP OF DOC

    Now I will address the Committee's specific questions. The first question: ''What does it mean for a safety program to be ''independent''? How is your organization structured to ensure its independence?''

    The Government's requirement for the Aerospace FFRDC mission requires complete objectivity and freedom from conflict of interest; a highly expert staff, full access to all space programs and contractor data sources; special simulation, computational, laboratory, and diagnostic facilities; and continuity of effort that involves detailed familiarity with the sponsor's programs, past experience, and future needs.

    Although the Aerospace program offices are co-located with the Air Force programs, they are separate organizations with their own management structure. Technical recommendations are worked up through Aerospace management and are then presented to the Air Force.

    The second question was: ''Given that more can always be done to improve safety, how can you ensure that your safety program is independent and vigilant, and that it won't prevent the larger organization from carrying out its duties?''

    Aerospace recognizes its obligation to identify issues in a timely manner and to keep the Air Force aware of any technical issues that may impact the overall program. The launch verification process is involved with all phases of the program and is not merely a final assessment that is done just prior to launch. While our technical rigor can identify otherwise unobserved risks, the entire team must work together to allow the larger organization to carry out its duties to achieve flight worthiness certification and a successful mission.
 Page 76       PREV PAGE       TOP OF DOC

    The third question was: ''How do you ensure that the existence of Aerospace's mission assurance program and independent launch verification process does not allow the larger organization that it serves to feel that it is absolved of its responsibility for safety?''

    Final flight worthiness certification is the responsibility of the SMC Commander. At the final flight readiness review, the Commander receives input from several organizations prior to giving the GO to proceed with launch processing. The Commander receives inputs from the Air Force Mission Director, the launch vehicle program managers, the launch ranges, the SMC Chief Engineer, prime contractors, the spacecraft program managers, The Aerospace Corporation, and also his Independent Readiness Review Team.

    Aerospace is directly accountable to SMC for the verification of launch readiness. The ultimate GO/NO-GO launch decision rests with the SMC Commander, not Aerospace. However, the Air Force relies heavily on our readiness assessment in building confidence in the final decision.

    And the final question is: ''How do you ensure that dissenting opinions are offered without creating a process that can never reach closure?''

    The verification process includes all stakeholders at major decision points and milestones. Individuals with dissenting opinion are heard and we make every effort to assure our positions are based on sound engineering practices backed up by factual data. Management encourages the sharing of all points of view and has the responsibility for ultimately deciding on a final recommendation. When a pure technical solution is not possible, the Air Force is provided with a risk assessment that outlines the degree of risk associated with each course of action.
 Page 77       PREV PAGE       TOP OF DOC

    In closing, our success depends largely on the close, intimate relationship we have with our government customers. We are physically integrated and programmatically aligned with our customers. It is this totally integrated approach that allows Aerospace to use its technical and scientific skills in support of the National Security Space Program.

    Thank you for the opportunity to describe The Aerospace Corporation, its launch verification program, and contributions to mission success.

    I stand ready to provide any further data or discussions that the Committee may require.

    Thank you.

    [The prepared statement of Mr. Johnson follows:]

PREPARED STATEMENT OF RAY F. JOHNSON

Mr. Chairman, distinguished Committee Members and Staff:

    I am pleased to have the opportunity to describe the capabilities of The Aerospace Corporation as they relate to organizational and management ''best practices'' of successful safety and mission assurance programs. Aerospace is truly a unique organization. Our capabilities, core competencies and practices are the result of 43 years of operating a Federally Funded Research and Development Center (FFRDC) for the National Security Space program.
 Page 78       PREV PAGE       TOP OF DOC

    I will discuss the committee's questions as outlined in the invitation letter, but first I would like to present an overview of Aerospace and specifically what we do for the Air Force in the area of launch readiness verification.

The nature and value of The Aerospace Corporation

    The Aerospace Corporation is a private, nonprofit corporation, headquartered in El Segundo, California. It was created in 1960 at the recommendation of Congress and the Secretary of the Air Force to provide research, development and advisory services to the U.S. government in the planning and acquisition of space, launch and ground systems and their related technologies. The key features of Aerospace are that we provide a stable, objective, expert source of engineering analysis and advice to the government, free from organizational conflict of interest. We are focused on the government's best interests, with no profit motive or predilection for any particular design or technical solution.

    As its primary activity, Aerospace operates an FFRDC sponsored by the Under Secretary of the Air Force, and managed by the Space and Missile Systems Center (SMC) in El Segundo, California. Our principal tasks are systems planning, systems engineering, integration, flight readiness verification, operations support and anomaly resolution for the DOD, Air Force, and National Security Space systems. Through our comprehensive knowledge of space systems and our sponsor's needs, our breadth of staff expertise, and our long term, stable relationship with the DOD, we are able to integrate technical lessons learned across all military space programs and develop systems-of-systems architectures that integrate the functions of many separate space and ground systems.
 Page 79       PREV PAGE       TOP OF DOC

    Aerospace does not compete with industry for government contracts, and we do not manufacture products. The government relies on Aerospace for objective development of pre-competitive system specifications, and impartial evaluation of competing concepts and engineering hardware developments, to ensure that government procurements can meet the military user's needs in a cost-and-performance-effective manner.

    Aerospace employs about 3,450 people, of whom 2,400 are scientists and engineers with expertise in all aspects of space systems engineering and technology. The professional staff includes a large majority, 74 percent, with advanced degrees, with 29 percent holding Ph.D.s. The average experience of Members of the Technical Staff (MTS) is more than 25 years. We recruit more than two-thirds of our technical staff from experienced industry sources and the rest from new graduates, university staff, other nonprofit organizations, government agencies, and internal degree programs.

    Aerospace has maintained a 43-year strategic partnership with the DOD and the National Security Space community, developing a data and experience base that covers virtually every military space program since 1960. We have evolved an unparalleled set of engineering design, analysis and systems simulation tools, along with computational, diagnostic test, and research facilities in critical space-specific disciplines that are used in day-to-day support of government space system programs.

    Aerospace is the government's integral engineering arm for National Security Space systems architecture and engineering. As such, Aerospace has broad access to intelligence information, government requirements development, all programs and contractors' proprietary data and processes, and the full scope of government program planning information. We translate the requirements dictated by Congress and the military and national security management into engineering specifications that form the basis for competitive Request for Proposals (RFPs) to industry. We evaluate contractor technical designs and performance, and provide continuing technical insight and progress assessment for the government program manager throughout the engineering development, test and initial operation phases of space systems. In order to do this, Aerospace must have technical experience and breadth at least equal to the industrial firms we evaluate. I am extremely proud of the quality and performance record of our staff, as evidenced by the outstanding success record of the space launches and satellite systems Aerospace has technically supported on behalf of its government sponsors.
 Page 80       PREV PAGE       TOP OF DOC

    The Aerospace technical program office MTS are supported by a matrix of 1,000 engineering and scientific specialists in every discipline relevant to space systems, with extensive laboratory and diagnostic facilities. Typically, an expert in a particular field—propulsion, microelectronics, or infrared sensors, for example—will work on several programs during the course of a year, as each program has a need for a particular skill depending on its program phase. This approach permits Aerospace to develop and maintain state-of-the-art analytical and simulation models and test facilities that could not be afforded by a single program or contractor, but are efficiently used as needed by all programs.

    Aerospace systems engineering currently supports 29 satellite programs, 8 launch vehicle boosters, and 13 ground station elements for the DOD and National Security customers. Our functions can be summarized as follows, covering the entire system acquisition process:

 planning and systems studies—pre-competitive systems definition

 trade-offs and simulations of system requirements to help prioritize user needs

 technical RFPs and technical evaluation of proposals

 early detection of development problems and timely identification of alternative solutions, to preserve schedule, cost and performance

 independent analysis, verification, and validation of data and performance to assure mission success
 Page 81       PREV PAGE       TOP OF DOC

 launch verification and readiness assessments (boosters, satellites and ground systems)

 launch and on-orbit operations and work-arounds

Aerospace's launch readiness verification process

    Independent launch readiness verification is a core competency of Aerospace as defined in our charter as an FFRDC supporting the Air Force. As such, Aerospace is directly accountable to SMC for verification of launch readiness. This responsibility is vested within the Space Launch Operations program offices and executed using our launch readiness verification process.

    Prior to any launch, Aerospace provides a letter to SMC documenting the results of the launch verification process, confirming flight readiness of the launch vehicle. This letter is not just a formality, but represents the culmination of a long and rigorous assessment that draws upon the collective expertise of scientists and engineers within the program office and the engineering staff. The launch readiness verification letter provided by the Aerospace Vice President of Space Launch Operations to the Air Force was first introduced in the late 1970s to document our corporate commitment to mission success. This formal launch readiness verification provides assurance that all known technical issues have been assessed and resolved, residual launch risks have been satisfactorily assessed, and establishes confidence in launch mission success. The ultimate GO/NO–GO launch decision and flight worthiness certification rests with SMC, not Aerospace, however, the Air Force relies heavily on our readiness assessment in building confidence in its final decision.
 Page 82       PREV PAGE       TOP OF DOC

    The process used to independently determine launch system flight readiness is a capability that has evolved over 40 years. Aerospace's role in independent launch readiness verification began with the Mercury-Atlas program in 1960, shortly after the corporation was founded. The Project Mercury launch vehicle had suffered two failures and a turnaround in reliability was required before human space flight could be attempted. The risk reduction techniques that Aerospace developed were instrumental in achieving mission success. Since then, we have applied this process to the design, development, and operation of more than 600 launches including all Atlas, Delta, Inertial Upper Stage, and Titan launch vehicle variants resulting in a proven track record of reducing launch risk.

    The fundamental features of our launch readiness verification have been the same since first employed. Verification begins as early as the concept and requirements definition phase of most programs and continues through flight operations. Launch verification certification and readiness assessments include design, qualification, fabrication, acceptance, software, mission analysis, integration and test. Thorough launch readiness verification requires a detailed review by Aerospace staff of thousands of components, procedures, and test reports to verify flight readiness. Independent models are developed and maintained by Aerospace domain experts and exercised to validate and verify the contractors' results. Resident Aerospace engineers are involved in all aspects of the launch campaign from manufacture through launch site operations. Launch readiness verification is a closed loop process via post flight analyses that use the independent analytical tools and independently acquired and processed flight telemetry data to provide feedback into the engineering design process, capture lessons learned, monitor trends, and establish a basis for proceeding into the next launch cycle.

 Page 83       PREV PAGE       TOP OF DOC
    To accomplish the entire spectrum of launch readiness verification requires that Aerospace retain a diverse cadre of skilled engineers with expertise in a wide variety of disciplines including systems engineering, mission integration, structures and mechanics, structural dynamics, guidance and control, power and electrical, avionics, telemetry, safety, flight mechanics, environmental testing, computers, software, product assurance, propulsion, fluid mechanics, aerodynamics, thermal, ground systems, facilities and operations. Our major objective is to retain the necessary skills and expertise needed to support planned as well as unexpected events.

    The launch readiness verification process was reinvigorated in the late 1990s following a series of launch failures. Among the observations of the Space Launch Broad Area Review were that the root cause was the lack of disciplined system engineering in the design and processing of launch vehicles exacerbated by a premature dismantling of government oversight capability, particularly the engineering support capabilities; that space launch needed to re-establish clear lines of authority and accountability; that space launch is inherently more engineering intensive than other operational systems; and that properly conducted independent review is an essential element of mission success.

    Now, I will address the committee's specific questions:

1. What does it mean for a safety program to be ''independent?'' How is your organization structured to ensure its independence?

    The government's requirement for the Aerospace FFRDC mission requires complete objectivity and freedom from conflict of interest; a highly expert staff; full access to all space programs and contractor data sources; special simulation, computational, laboratory and diagnostic facilities; and continuity of effort that involves detailed familiarity with the sponsor's programs, past experience, and future needs. We are focused on the government's best interests, with no profit motive or predilection for any particular design or technical solution.
 Page 84       PREV PAGE       TOP OF DOC

    Although the Aerospace program offices are co-located with the Air Force programs, they are separate organizations with their own management structure. Technical recommendations are worked up through Aerospace management and are then presented to the Air Force. In addition to the launch verification letter, a formal launch readiness briefing is given to the Aerospace president. At this review, our president confirms that our technical analyses are thorough and objective, and our recommendations are based on sound engineering principles. Although the Aerospace launch readiness verification products are produced independently from those of the prime contractor, we also employ another independent review organization that reports to the SMC Commander. This independent review team also briefs our president on its findings to ensure that our process has yielded acceptable risks. This review is conducted just prior to the SMC Commander's Flight Readiness Review (FRR). The Aerospace president is polled during the Commander's FRR for his concurrence to proceed with final launch processing.

2. Given that more can always be done to improve safety, how do you ensure that your safety program is independent and vigilant, but that it won't prevent the larger organization from carrying out its duties?

    The key elements here are teamwork, technical rigor, and a goal for 100 percent mission success. Aerospace program offices are co-located with the Air Force programs and Aerospace engineers are in daily contact with their Air Force counterparts. Aerospace recognizes our obligation to identify issues in a timely manner and to keep the Air Force aware of any technical issues that may impact the overall program. The launch readiness verification process is involved with all phases of the program and is not merely a final assessment that is performed just prior to launch. The failures of 1998 and 1999 were in part due to ineffective teamwork. All successes since then can be attributed to a complete team effort among Aerospace, the Air Force, and the contractors. All team members understand and respect the value of the individual responsibilities and contributions. While vigilance and independence can identify otherwise unobserved risks, the entire team must work together to allow the larger organization to carry out its duties to achieve flight worthiness certification and a successful mission.
 Page 85       PREV PAGE       TOP OF DOC

    Just as important as teamwork is the technical rigor employed in the process to reach certification. We employ a well-defined launch readiness verification process with individual responsibilities and accountability. The burden of proof requires a positive demonstration that a system is flight-worthy, rather than proving that an anomalous condition will cause a flight failure. The launch readiness verification process is part of an overarching flight readiness process. Many unforeseen events occur during each launch campaign that must be acted upon. The process rigor that we employ assures that no single event or issue is overlooked or prematurely closed. With 100% focus on mission success, the technical rigor and commitment by each team member enhances the larger organization decision process.

3. How do you ensure that the existence of Aerospace's mission assurance program and independent launch verification process does not allow the larger organization that it serves to feel that it is absolved of responsibility for safety?

    Final flight worthiness certification is the responsibility of the SMC Commander. At the final FRR, the Commander receives input from several organizations prior to giving the GO to proceed with launch processing. The Commander receives input from the Air Force Mission Director, launch vehicle program managers, launch ranges, SMC Chief Engineer, prime contractors, spacecraft program managers, Aerospace, and the Independent Readiness Review Team (IRRT).

    Aerospace is directly accountable to SMC for the verification of launch readiness. Our task is to independently confirm readiness of the launch vehicle, assess mission risks, and assure that all risks are acceptably low to enter into launch. The ultimate GO/NO–GO launch decision rests with the SMC Commander, not Aerospace; however, the Air Force relies heavily on our readiness assessment in building confidence in the final decision.
 Page 86       PREV PAGE       TOP OF DOC

4. How do you ensure that dissenting opinions are offered without creating a process that can never reach closure?

    The verification process includes all stakeholders at major decision points and milestones. Dissenting opinions are heard and data is required to resolve engineering issues. Aerospace makes every effort to ensure that our positions are based on sound engineering practices backed up by factual data. Aerospace's engineering staff objectively develops their technical recommendations and supporting analyses that are then coordinated with the Aerospace program offices and management. Management encourages the sharing of all points of view and is responsible for ultimately deciding on a final recommendation. When an issue is well founded in science and engineering, the path forward is usually identifiable, e.g., additional inspections, tests, analyses, etc. For issues that do not have concrete solutions, risks are assessed by senior review teams based on technical data. When a ''pure'' technical solution is not possible, the Air Force is provided with a risk assessment that outlines the degree of risk associated with each course of action.

    As I mentioned previously, the independent launch readiness verification end-to-end system review process culminates in a launch readiness assessment for each mission. A formal flight readiness certification provides assurance that all known technical issues have been assessed and resolved, residual launch risks have been satisfactorily assessed and confidence in launch mission success has been established as acceptable. It is this process, as outlined in the following figure, that ensures acceptable closure of every issue.

90160m5.eps
 Page 87       PREV PAGE       TOP OF DOC

    I would like to leave you with some concluding summary thoughts:

 Aerospace is focused on the success of its sponsor's mission

 Aerospace is the integral space systems engineering arm of the Air Force and National Security Space program

 The key to Aerospace's value and effectiveness is our process of systems engineering:

— stable, objective, expert advice backed by analysis and experiment

— a trusted partner with our sponsors and industry

— breadth and depth of staff in all space disciplines

— access to sensitive planning and proprietary data

— continuity across all space programs and technologies

— co-location with the government customer

    In closing, our success depends largely on the close, intimate relationship we have with our government customers. We are physically integrated and programmatically aligned with our customers. It is this totally integrated approach that allows Aerospace to use its technical and scientific skills in support of the National Security Space program.
 Page 88       PREV PAGE       TOP OF DOC

    Thank you for the opportunity to describe The Aerospace Corporation, its Launch Readiness Verification program, and contribution to mission success.

    I stand ready to provide any further data or discussions that the Committee may require.

BIOGRAPHY FOR RAY F. JOHNSON

    Ray F. Johnson is Vice President of Space Launch Operations, Space Systems Group. He assumed this position on April 1, 2001.

    Johnson is responsible for Aerospace support to all Air Force launch programs including Titan II, Titan IV, Delta II, Atlas II, upper stages and the Evolved Expendable Launch Vehicle (EELV), as well as the Air Force Space Test Program. He has responsibility for the company's launch operations at Cape Canaveral, Florida, and Vandenberg Air Force Base, California, and operations in support of the Space Test Program at Kirtland Air Force Base, New Mexico.

    Johnson joined Aerospace in 1987 as a project engineer in the Titan program office. He was promoted to manager of the Liquid Propulsion section in 1988. He was director of the Centaur Directorate within the Titan program office from 1990 to 1993 and was responsible for Aerospace's support in developing the Centaur upper stage for use on the Titan IV launch vehicle.

    In November 1993 Johnson was appointed principal director of the Vehicle Performance Subdivision, Engineering and Technology Group, with responsibility for engineering support in the areas of propulsion, flight mechanics, fluid mechanics, and launch vehicle and spacecraft thermal analysis.
 Page 89       PREV PAGE       TOP OF DOC

    Before being named vice president, Johnson was general manager of the Launch Programs Division with responsibility for managing Aerospace's technical support to the Air Force for the Titan, Atlas and Delta launch programs.

    Prior to joining Aerospace, Johnson held a number of engineering positions with Martin Marietta Aerospace as part of Titan launch operations at Vandenberg AFB.

    Johnson holds a B.S. degree in mechanical engineering from the University of California at Berkeley and an MBA from the University of Chicago. He is a registered professional engineer in the state of California and a senior member of the American Institute of Aeronautics and Astronautics.

    The Aerospace Corporation, based in El Segundo, California, is an independent, nonprofit company that provides objective technical analyses and assessments for national security space programs and selected civil and commercial space programs in the national interest.

    Chairman BOEHLERT. Thank you very much, Mr. Johnson.

    Ms. Grubbe.

STATEMENT BY MS. DEBORAH L. GRUBBE, P.E., CORPORATE DIRECTOR, SAFETY AND HEALTH, DuPONT

 Page 90       PREV PAGE       TOP OF DOC
    Ms. GRUBBE. Good morning, Mr. Chairman, Members of the Committee. I would like to thank you for the opportunity to testify today on the most important issue of safety.

    In my work with the DuPont Company, I am a chemical engineer by training. I also have 25 years of experience with DuPont in engineering design, leading multi-million dollar construction projects and running multi-million dollar manufacturing organizations.

    Today, I would like to focus my remarks on how we manage safety in the DuPont Company. My overarching message is that good safety practice takes committed leadership, educated personnel, integrated safety systems, and a continuous attention to doing the details of the work.

    While DuPont has one of the best safety records in the world, we are far from perfect. Good safety is an elusive dynamic. When we think we are getting good, that is the time we need to start to worry. The key is never to become complacent.

    From our experience, we think there are several organizational attributes common to successive—successful safety organizations: number one, safety comes first, and all organizational leadership is actively engaged in safety; number two, standards are high, these standards are well communicated and everyone knows what their role is; number three, our line management is accountable for safety, every person; number four, if the work can not be done safely, it is not done until it can be done safely; number five, safety systems, tools, and process are in place to support high standards and to support implementation and people are trained.
 Page 91       PREV PAGE       TOP OF DOC

    DuPont's safety culture starts at the top of our organization. Our Chief Executive Officer is actively engaged in leading safety. He starts his key meetings with safety. He insists that safety come first on every manager's and employee's list of tasks. He expects to be notified by his direct reports of each employee and contractor fatality or lost-time injury within 24 hours of the event.

    Any person can stop any job at any time if there is a perceived danger. Managers and employees are expected to work together to figure out how to do a job safely. If they need more resources, the team obtains them and resolves the problem. Management's role is to support the team and to help find the safest, best solution. Safety is, and must be, a fundamental, line management responsibility all through the organization. Independent bodies can help and assist line managers execute their responsibilities and monitor that execution.

    Our corporate safety organization is accountable for being the watchdog on corporate safety policy and for examining how well DuPont executes against its own procedures. This organization, in conjunction with business safety leaders, also develop safety improvements. All improvements, however, are owned and implemented by the line management structure. There are multiple audits to ensure compliance to standards. DuPont never stops looking for weaknesses in its safety systems.

    The corporate safety organization reports to a separate executive leader. This person does not have a specific business or manufacturing role and is accountable for integrating safety health and environmental excellence as a core business strategy. His organization works with every DuPont business and functional leader to ensure safe, injury-free operation.
 Page 92       PREV PAGE       TOP OF DOC

    Just as our CEO considers himself the ''chief safety officer'' for DuPont, each of our managers and supervisors are the chief safety officers of their respective organizations. They are never relieved of their safety duties. Our collective goal is to have every employee and every contractor that works at our facilities leave everyday just as they arrived. We believe that all injuries and incidents are preventable. Complacency and arrogance are our enemies.

    In summary, we believe that any organization can create a safe work environment if it embraces and implements a core set of organizational attributes and values, beginning with the fundamental belief that good safety is achievable and is a core management responsibility.

    Thank you for the opportunity to share our experiences with the Committee, and I would be happy to answer any questions.

    [The prepared statement of Ms. Grubbe follows:]

PREPARED STATEMENT OF DEBORAH L. GRUBBE

    I am a chemical engineer by training and have 25 years of experience with DuPont in engineering design, construction and operations. My current role is Corporate Director—Safety and Health.

    Today I would like to focus my remarks on ''Safety at DuPont.'' In summary, good safety practice takes committed leadership, educated personnel, integrated safety systems, and a continuous attention to detail.
 Page 93       PREV PAGE       TOP OF DOC

    DuPont has been in business for over 200 years. We started as a manufacturer of black powder for the U.S. Government in 1802. DuPont first kept injury statistics in 1912, installed an off the job safety process in the 1950's, and worked with the U.S. Government to establish OSHA 1910.119 in the 1980's. Even today, DuPont continues to improve its own safety systems. In 1994, DuPont established a Goal of Zero for injuries and incidents, and in the year 2000, decided to adopt a Goal of Zero for soft tissue injuries like, and not limited to, carpal tunnel syndrome and back injuries.

    DuPont always strives to improve its safety performance. In fact, safety is a precarious subject; just when you think you are good, that is the time you should start to worry. The key is to never become complacent. DuPont does have a leadership commitment to put safety first and we are committed to continuous improvement throughout our whole organization.

    Safety conscious organizations hold similar organizational attributes:

1. Safety comes first, and all organizational leadership is actively engaged.

2. Standards are high, are well communicated, and everyone knows their role.

3. Line management is accountable for safety.

4. If the work cannot be done safely, it is not done until it can be done safely.

5. Safety systems, tools and processes are in place and training is constant.
 Page 94       PREV PAGE       TOP OF DOC

    DuPont is a large organization, diverse in products, in technologies, and in global locations. However, in spite of this diversity, we have a single safety culture. We have an integrated, disciplined set of beliefs, behaviors, safety systems and procedures. The safety culture is held together by committed and visible leadership. We ensure that our contractors also have similar management processes in place to manage their own safety to high standards.

    DuPont safety culture starts at the top of the organization. Our CEO is actively engaged in leading safety. He starts his key meetings with safety, and he insists that safety come first on every employee's list. He expects to be notified by his direct reports, of each employee lost time injury or fatality, employee or contractor, within 24 hours of the event.

Safety at DuPont

    Safety management is the unique balance of the carrot and the stick. There must be recognition and reward, as well as serious implications for blatant disregard of safety procedures and standards. If a DuPont employee continuously disregards procedures, he/she endangers his/her life, the lives of his/her colleagues, the shareholders' investment, and the health and welfare of the communities where we do business. We usually prefer that these kinds of people find work somewhere else.

    Any person can stop any job at anytime if there is a perceived safety danger. Employees are trained to look out for each other and to ensure that they and their colleagues work safely.

 Page 95       PREV PAGE       TOP OF DOC
    The corporate safety organization is accountable for being the watchdog on corporate policy and for examining how well DuPont executes against its own procedures. This organization, in conjunction with business safety leaders, also develops safety improvements. All improvements are owned and implemented by the line organization. There are multiple audits to ensure compliance to standards. These audits can range from a sales manager observing the driving habits of his/her sales representatives, to an external consultant evaluating how well we conduct our audits. The point is that DuPont never stops looking for weaknesses in its safety systems.

    The corporate safety organization reports to a separate leader. This person does not have a specific business or manufacturing role and is accountable for integrating safety, health and environmental excellence as a core business strategy. His organization works with each DuPont leader to ensure there is clear knowledge of the risks present in his/her area, and to ensure safe, injury-free operation.

    Just as our CEO considers himself the ''chief safety officer'' for DuPont, each of our managers and supervisors are the chief safety officers for their respective organizations. They are never relieved of their safety duties. The safety organization in DuPont is sometimes a consultant, sometimes a conscience, and sometimes a leader. Our collective goal is to have every employee and every contractor that works at our facilities leave every day just as they arrived.

    In 2002, over 80 percent of our 367 global sites completed the year with zero lost time injuries. While we are proud of the thousands of employees and their achievements; we are not satisfied with this performance. We believe that all injuries and incidents are preventable. Complacency and arrogance are our enemies.
 Page 96       PREV PAGE       TOP OF DOC

BIOGRAPHY FOR DEBORAH L. GRUBBE

    Deborah Grubbe is Corporate Director—Safety and Health for DuPont. She is accountable for leading new initiatives in global safety and occupational health for the $27 billion corporation. Deb was formerly the Operations Director in two of DuPont's global businesses, where she was accountable for manufacturing, engineering, safety, environmental and information systems. Deborah is also a past director of DuPont Engineering's 700 person engineering technology organization. Her 15 different assignments in 24 years range from capital project implementation through manufacturing management and human resources.

    Deborah currently serves on the National Institute of Standards and Technology Visiting Committee for Advanced Technology. She also serves the National Academy of Sciences as a member of the oversight committee for the Demilitarization of U.S. Chemical Weapons Stockpile. Deborah sits on the Board of Directors of the Engineering and Construction Committee of the American Institute of Chemical Engineers, and is on the Business Management Advisory Committee of Wilmington College. She is the former co-chair of the Benchmarking and Metrics Committee of the Construction Industry Institute, and currently serves as a member of the Purdue University School of Chemical Engineering New Directions Executive Committee. Deborah was the first woman and youngest elected member on the State of Delaware Registration Board for Professional Engineers (1985–1989). During her tenure on the State Board, she was the Chair of the Law Enforcement and Ethics Committee. She is active with the Society of Women Engineers, and is a former board member of the Women in Engineering Program Advocates Network (WEPAN). Deborah has been featured in the books ''Engineering Your Way to Success'' and ''Journeys of Women in Science and Engineering—No Universal Constants.''
 Page 97       PREV PAGE       TOP OF DOC

    She has been active in the Delaware community; as former president and board member of the Chesapeake Bay Girl Scout Council, and currently sits on their Northern President's Advisory Council. Deborah is also a board member of the Delaware Zoological Society. Deborah is a past board member of the YWCA of New Castle County. She has served as a Province President of her sorority, Zeta Tau Alpha, and is a recipient of their Alumnae Certificate of Merit. In 1994, Deborah was named an outstanding Chemical Engineering Alumna by the Purdue University School of Chemical Engineering, and is a recipient of the 1986 Trailblazer Award from the Delaware Alliance of Professional Women. This year, she is a recipient of the Purdue Distinguished Engineering Alumni Award, and has been named ''Delaware Engineer of the Year,'' by the Delaware Engineering Society.

    Deborah was born in suburban Chicago and graduated with a Bachelor of Science in Chemical Engineering with Highest Distinction from Purdue University. She received a Winston Churchill Fellowship to attend Cambridge University in England, where she received a Certificate of Post Graduate Study in Chemical Engineering. She is a registered professional engineer in Delaware. She is married to James B. Porter, Jr., and resides in Chadds Ford, Pennsylvania.

Discussion, Panel I

    Chairman BOEHLERT. Thank you very much, Ms. Grubbe, and thank all of you.

ITEA Budget Independence
 Page 98       PREV PAGE       TOP OF DOC

    Can you explain—you know, Admiral Gehman, the CAIB Commission, if they have said it once, they have said it a thousand times: safety has to be independent of operational budget considerations. Can you tell me how your organizations, particularly the Admirals', have safety truly independent of the operational segment budgets and schedules? Ms. Grubbe and Mr. Johnson specifically addressed those, and I would like the Admirals to do so.

    Admiral BOWMAN. Mr. Chairman, as I listened to Ms. Grubbe, I heard her describing the Naval Reactors organization, also. Many of the elements of her safety program and her operation are identical to what I described as the Naval Reactors organization. I specifically jotted down committed leadership, ingrained safety culture throughout the organization, an integrated safety system, attention to detail, safety owned by line management, a very key point, and that the CEO feels that he is the ''chief safety officer.'' I could just say ditto for the Naval Reactors Program.

    And this is a difference in the way I think some are interpreting or perhaps the way the CAIB report is written. Standby for heavy rolls here. I don't believe an organization should have—should rely on an independent organization off to the side to oversee safety. I believe that safety has to be endemic to the organization. It has to be ingrained in every person. I used the word ''mainstream.'' Our line management, likewise, is responsible for safety in our organization. We can not have a separate group that comes in at the end and throws the flag on safety. Safety is a part of the day-to-day design, the day-to-day operation, the day-to-day development of procedures. It is who we are. It is what we are. Every person who is responsible and reports directly to me for components for systems for the entire reactor plant feels the responsibility for safety.
 Page 99       PREV PAGE       TOP OF DOC

    We don't create, therefore, a tension between safety and resources. Safety is a part of the technical line management organization. If one were to arrange a separate safety committee or safety group totally responsible for safety within an organization, I believe that it would be near impossible to avoid this tension between the schedule and the budget, the resources that are necessary. The line management will—would look upon that safety group as Piranhas, not invite them into the campfire at night. They would be pulling in the opposite direction, and I think that the correct way is to ensure that every person within the organization understands that safety is a part of his or her responsibility from the very beginning, from the design and the operation.

    Chairman BOEHLERT. You can't emphasize that enough.

    Admiral BOWMAN. Yes, sir.

    Chairman BOEHLERT. Like you know the old saw where if something is everybody's business, it is nobody's business.

    Admiral BOWMAN. Yes, sir.

    Chairman BOEHLERT. I mean, it has to be someone. And I think what Admiral Gehman is saying, at least in my interpretation, is that you need people—everybody has to be devoted to safety, but you need an operation separate from the pressures of scheduling and looking at the calendar. ''Can we go on the 14th?'' Or, ''Do we have to wait until the 15th?'' Or, ''Do we have enough money to go?'' Some—safety has to be totally separate from that, according to my interpretation of the Gehman report and then be able to enter into the equation and say, ''Regardless of schedule, regardless of money, here is what we think in terms of safety.''
 Page 100       PREV PAGE       TOP OF DOC

    Admiral Sullivan, do you have any thoughts on that?

    Rear Admiral SULLIVAN. Yes, sir. I would like to start by echoing Admiral Bowman's remarks about a culture of safety. You can not enforce from above or from beside and catch everything. You will always need to have everyone from the designers to the builders to the operators raised in a culture of safety. That is the best way to get started.

    In our submarine safety program, we, in fact, have two checks and balances on the program office, if you will. And I have been on both sides of this. I was the Sea Wolf program manager and the Virginia class program manager, so I have looked at this issue from both sides. The program managers are, in fact, driven by cost and schedule, but the technician authority in NAVSEA is outside of the Program Manager's organization. And the technical authority is, in fact, independent of the Program Manager, and they are funded separately.

    The safety—submarine safety organization is also independent of the Program Manager, so, in fact, we have two checks and balances. And both of those organizations can put a stop to a certification process or getting—allowing a ship to get underway, for instance, if there is an issue. And we stop until we get it resolved.

Waivers

    Chairman BOEHLERT. I am going to interrupt you for a minute, because my—the red light is on and we are trying to stick to the five-minute rule, but I gave you a little flexibility, so I will take a little flexibility here.
 Page 101       PREV PAGE       TOP OF DOC

    But I assume that each of you have a system for waivers, and I would like to know, you know, at NASA they got almost 4,000 waivers, some of them—a third of them are over 10 years old. Do you have a waiver system, Admiral Bowman and Admiral Sullivan? I will ask you to respond to that. How many waivers are in place, and how do you deal with the waivers?

    Admiral BOWMAN. There are very few waivers in place in the unforgiving technology that I deal with, the Naval Nuclear Reactors Program. When deviations from specifications occur in manufacturer—in production, they are brought through the system with recommendations and analysis of the overall impact of that deviation on the product, on the system, and on the integrated operation of the plant. Before the decision is made to agree to any deviation, departure from existing written specification and manufacturer production, it is brought to me for final approval. And we, at the table, then, go through that process that I described earlier asking what is the impact, what might be the impact, what is the worst that could happen if we accept this deviation, and what are the minority opinions. Are there people out there in the organization who say, ''No, don't accept this product; send it back, start over.''? We have very, very few of those. It is the—very much the exception and not the rule.

    Chairman BOEHLERT. So you would say maybe a handful?

    Admiral BOWMAN. Yeah, it would be difficult for me to put a number, sir, but——

    Chairman BOEHLERT. Certainly not thousands?

 Page 102       PREV PAGE       TOP OF DOC
    Admiral BOWMAN. Not thousands.

    Chairman BOEHLERT. And are you aware of any waivers that might be in existence in your Program that are 10 years old?

    Admiral BOWMAN. Deviations from manufacturing tolerances where a manufacturing tolerance might call for something to be between five and 10 mils and it is—in fact, it came in at four mils, we may have those kinds of deviations in existence, but they have been very thoroughly analyzed and determined not to impact the——

    Chairman BOEHLERT. Thank you.

    Admiral Sullivan, would you care to comment?

    Rear Admiral SULLIVAN. We have a similar process outside the propulsion plant where waivers are formally submitted and evaluated. We, too, have few waivers, and I couldn't give you the numbers off the top of my head, but it is a disciplined, rigorous process, and yes, the age of our submarines can be up to—they have about a 30-year service life, but the only waivers that are allowed to stay on a submarine permanently are those of a similar nature to what the Admiral just described.

    Chairman BOEHLERT. Ms. Grubbe and Mr. Johnson, I mean you both addressed this directly in your testimony. Do you have anything you would like to add before I go to Mr. Hall?

 Page 103       PREV PAGE       TOP OF DOC
    Mr. JOHNSON. Well, I was just going to add that we do have a process of working waivers. And to give you an idea of the typical number on a Titan 4, which is our—a fairly complex vehicle, we have on the order of about 130 to 150 waivers that we would be working. That has actually been driven down, because there has been a real effort to try and reduce the number of waivers on the vehicle. Probably about four or five years ago, the number was more like around 400 waivers. But we have a process that we review each one of those, provide an engineering assessment and opinion back to the Air Force on those.

    Chairman BOEHLERT. Ms. Grubbe.

    Ms. GRUBBE. Nothing to add.

    Chairman BOEHLERT. All right. Thank you very much.

    Mr. Hall.

Managing Safety

    Mr. HALL. Mr. Chairman, thank you for leading in to the—your questions with the word safety. And I think when we think about safety, I guess it is fair to assume that no one at NASA or any of your organizations would deliberately seek to follow unsafe practices. That is outrageous and ridiculous to even think about.

    However, back when we were working in the early '80's on the Clean Air Act and worked—I think it took 12 or 13 years to do it, there was a poll that came out that—from one of the Members of the Congress that had sought that poll to try to pass a stronger Clean Air Act. He had a poll that showed that 82 percent of the people wanted clean air. And I wondered about that other 18 percent what—just what their choice was. But we are 100 percent on safety and seeking it and wanting it and demanding it. And I think that is what you have to do. The problem, though, arises when the pressures to achieve these organizational goals that you men and lady set out, I think, reach the point where the managers and workers find themselves making compromises to follow that schedule or to try to escape the use of a waiver or to have to seek something other than the 100 percent perfection that you have to have when you are going to have safety.
 Page 104       PREV PAGE       TOP OF DOC

    So—well, for example, Admiral Gehman's Investigation Board found that the pressures exerted by NASA's top management to—made an arbitrary date for Space Station Core Complete led to actions being taken that wound up reducing the safety margins of the Shuttle Program, we are told, and I believe that is probably right, because I don't hear anybody that negates that. So I guess I would like to ask each of you, how do you prevent this kind of a thing from happening in your organizations? How have—you been successful in your thrust there or you wouldn't be here. The Chairman selected you to come and give us the best testimony that is obtainable anywhere in the country, and you are here, so apparently you have found a way to prevent that from happening in your organizations. How do you ensure that safety margins can be protected in the thrust that we are on right now? I guess I ask any of you, and if that type of situation does arise, how would you deal with it?

    Admiral Bowman.

    Admiral BOWMAN. Yes, sir, Mr. Hall——

    Mr. HALL. Skip? They call you ''Skip,'' Admiral Bowman?

    Admiral BOWMAN. Yes, sir, they do.

    Mr. HALL. Do just the normal, ordinary, J.G. like I was 60 years ago, call—come up and said, ''Hey, Skip.'' Would that be okay?

    Admiral BOWMAN. No, sir. Maybe I should have said once.
 Page 105       PREV PAGE       TOP OF DOC

    Your question strikes at the very heart of what we are talking about today. And again, I would just have to fall back on the answer that within the Naval Reactors organization, my line management, who are all direct reports to me, we probably have one of the flattest organizations in this country, and certainly within the United States Government, in that all of my direct reports are the first line reports. There is nobody between me and the 21 direct reports at headquarters. They all feel responsible for safety from the beginning. So we don't allow this competition, this competition between schedule, costs, and safety to exist, because we built it into the system from the design, from the redundancy, from the system oversight, the component oversight as it is being developed.

    And so we don't allow that to be a topic of conversation that we are supposed to go on sea trials on Monday the 15th of March and if we don't make that, it is going to be a black eye and now we have this safety issue that has reared its ugly head. And the answer is very simple: fix it. Fix it. We build redundancy and safety into our systems for the Commanding Officer of these ships to exercise at sea in battle or in untoward situations. And it is not within my purview. I don't even consider it to be a question that I can remove that redundancy and that safety from him by making a decision here in Washington, DC that makes the ship less safe before it goes to sea.

    I might add, by the way, that I ride all of the initial sea trials on all of these ships and take the ships through all of their evolutions the—for the very first time. So my staff is there with me, and we are there watching the results of the fruits of our labor. So it just doesn't come up. We don't allow safety to be in competition with schedule and budget.
 Page 106       PREV PAGE       TOP OF DOC

SUBSAFE

    Mr. HALL. Admiral Sullivan, your experience on your SUBSAFE thrust, give us the benefit of that.

    Rear Admiral SULLIVAN. Yes, sir. First off, as far as waivers coming up and getting pushed aside by the Program Manager, the Program Manager does not have unilateral authority to grant a waiver. He must get technical disposition and that—and he must take a technically acceptable path to disposition of that way. And we do not waive fundamental SUBSAFE requirements, period. And like the Admiral said, when we have an initial sea trial, the toughest certification is the ship going to sea for the first time and the Program Manager also rides.

    Mr. HALL. My time is up. Briefly, Mr. Johnson or Ms.—I called you Ms. Grubbe. Is it Ms. Grubbe?

    Ms. GRUBBE. Yes, sir, Grubbe.

    Mr. HALL. Ms. Grubbe.

    Ms. GRUBBE. I would just like to add, very similarly to the other gentlemen, that safety comes first and that anyone at any time can stop anything. And safety does come before budget. I find it interesting that in the collective, when over the years as many people have dealt with safety, we find that we rarely have money up front to do it right, but we always have lots of money at the end to fix it once something goes wrong.
 Page 107       PREV PAGE       TOP OF DOC

    Mr. HALL. Mr. Johnson.

Crew Escape

    Mr. JOHNSON. Just very briefly, well, first of all, our whole purpose is a mission assurance or safety organization. We are separate from the Air Force in that respect. We also do have a separate management chain so we are held accountable up—beyond the people that report directly to the Air Force program managers that verify that—and maintain that our mission success focus is something that we never deviate from and never give in to the pressures of schedule and cost.

    Mr. HALL. I have one more quick answer—question to ask. I won't require anything but a yes or a no. Do you know of any way that the parents of a person that is going to be launched in one of our Shuttles can feel completely confident without having an escape, modular escape vehicle?

    Admiral BOWMAN. Sir, for my purposes, that is outside my realm of expertise. It certainly sounds——

    Mr. HALL. You are going to skip that, huh?

    Admiral BOWMAN. It sounds like something that should be evaluated. Absolutely.

 Page 108       PREV PAGE       TOP OF DOC
    Mr. HALL. Admiral.

    Rear Admiral SULLIVAN. I don't have anything to add to that, sir.

    Mr. HALL. You are consistent. Go ahead, Mr. Johnson.

    Rear Admiral SULLIVAN. It is—again, it is outside our——

    Mr. HALL. Yeah.

    Rear Admiral SULLIVAN. Outside our purview.

    Mr. HALL. But it is not above your pay scale, is it?

    Mr. Johnson, your answer is probably no and Ms. Grubbe, yours is probably no. We have got to have an escape if we are going to feel completely safe, right?

    Mr. JOHNSON. That is correct.

    Mr. HALL. That is three to two. So we are pretty—no, thank you for your answers. We have to have our fun up here.

    Chairman BOEHLERT. Thank you very much, Mr. Hall.
 Page 109       PREV PAGE       TOP OF DOC

    Mr. Burgess.

Handling Anomolies

    Mr. BURGESS. Well, Mr. Chairman, I want to thank you for convening this panel today. It has truly been very instructive and necessary for us as we make our evaluations about the Columbia Accident Investigation Board report.

    The—when Admiral Gehman was here before, he talked about applying the template to NASA where there is a strict adherence to safety and how to treat an anomaly and continue flying. And yet I read in the Washington Post yesterday an editorial about apparently accepting an anomaly with the on-board environment on the Space Station and continuing—continue with the mission to put some additional astronauts up there. So the question comes up are we really serious about that and, Admiral Bowman, would that be an acceptable anomaly in your experience to continue flying?

    Admiral BOWMAN. I fly underwater. If we were faced with a similar situation of—or if we were faced with a situation of not being able to monitor the ship's environment, that would be cause for not allowing the ship to sail.

    Mr. BURGESS. All right. Thank you.

    On the—just following on the same line that the Chairman and Mr. Hall have been pursuing, do you have—could you share with us, any of you, a real-world example of how your organization has handled a particular safety problem, particularly one where an ongoing mission of your larger organization had to be interfered with?
 Page 110       PREV PAGE       TOP OF DOC

    Rear Admiral SULLIVAN. I can give you an example of it some years ago when we were trying to deliver the Sea Wolf, which was a program with not a great reputation on the Hill. We were about six months from final sea—first sea trials and a working level engineer at one of our ship builders, who was working on the design, came up with a concern about the Titanium alloy we were using on the doors to the torpedo tubes, which are the largest holes on the ship. He pulled the thread on that and eventually got it pulled up through the organization, which is also flat. Our organization is not as flat as Naval Reactors, but it is flat enough that minority opinions, such as this, are voiced. And it came into—this was in about 1994. It came to full attention of the program management and technical and safety staff. And we had to come to a grinding halt, do a bunch of testing, and replace that material on those doors, and it delayed the ship delivery a year, and it cost in excess of $50 million by the time we were done. And it is because we couldn't compromise the safety.

    Mr. BURGESS. Admiral Bowman, would you have an example from the Nuclear Reactor Program?

    Admiral BOWMAN. Questions of safety are—with the nuclear reactors for the Naval Reactors Program are not quite so dramatic that we get to the end of the trail and suddenly have to make a decision like Admiral Sullivan just described, because we begin with safety in mind all of the way at the beginning of the design and the manufacturing process, and we will watch it and monitor it. And then as we test the completed components in a non—not—in a critical reactor environment, we then may run across things that require safety adjudications. So we fix it then. And then we go on to the next level of test program. And so as the test program moves along, safety items that might exist, that very seldom do exist, but that might exist, come to the floor earlier than as Admiral Sullivan just described. So I am racking my brain right now to think of an equivalent, and I can't think of one.
 Page 111       PREV PAGE       TOP OF DOC

    Mr. BURGESS. Well, the yellow light is on, so just for a minute more, if we had a similar situation or we had the situation with, of course, the Columbia with the foam, but in your experience in your organization, it would have never gotten to the—to that point. That anomaly would have been selected out much earlier in the process? In the design and manufacturing?

    Admiral BOWMAN. Well, it is difficult to say conclusively, but I would dare say yes.

    Mr. BURGESS. Thank you very much. I will yield back the balance of my time, Mr. Chairman.

    Chairman BOEHLERT. Thank you very much, Mr. Burgess.

    Ms. Johnson.

    Ms. JOHNSON. Thank you, Mr. Chairman, and thank you for having this hearing. I have an opening statement of which I will put into the record.

    Chairman BOEHLERT. Without objection, so ordered.

    All Members will have their opening statements in the record immediately following the opening statements from the distinguished Ranking Member.

 Page 112       PREV PAGE       TOP OF DOC
Safety Accountability

    Ms. JOHNSON. Thank you. There was comment, I think by the Admiral, that indicated he thought the CEO should be the one in charge without a separate organization. I don't think NASA had a separate organization, but the CEO, the person who occupies that, did not get the information. How do you think that could be improved?

    Admiral BOWMAN. Again, an excellent question. I think what Ms. Grubbe said and I agree with was that her CEO at DuPont felt himself to be the ''chief safety officer.'' And certainly, within my organization, I feel myself to be the ''chief safety officer.'' Let me—if I could for just one minute, I do have, at Naval Reactors, a safety group, but that safety group is not responsible on a day-to-day basis for ensuring the safe design and manufacture and production and operation of the components. That is the line management's responsibility to me directly. So the way we do it, as the design is moving along, as the system is operating, as we go day to day with these 103 reactors that I spoke of earlier that I am responsible for, I hear in real time these difficulties that we are encountering. And the line management know that they are responsible for safety as well as for delivering the product.

    So again, the tension isn't there. What my safety group does for me is integrate the overall efforts of the organization. They keep the safety codes. They are responsible for the computer codes that evaluate the overall safety of the reactor plant. And they do the liaison with the Nuclear Regulatory Commission for Naval Reactors for me. But they are not—and I found this out dramatically early on in my tour when I asked a safety question about a reactor coolant pump. And I asked it of the safety group head, and you would have thought the world was coming to an end. Within minutes, the owner of that reactor coolant pump, the line manager who designs and oversees the reactor coolant pump, was in pounding my desk saying, ''What are you doing asking the safety group head about my stuff?'' And I think it is that sense of ownership and that sense of responsibility that leads to this mainstreaming that I am talking about. And that is the way that we do it at Naval Reactors. I would hear about it within minutes of something happening.
 Page 113       PREV PAGE       TOP OF DOC

    Ms. JOHNSON. So though you have persons that have expertise generally in particular areas, the communication loop always includes you for the final decisions?

    Admiral BOWMAN. Yes, ma'am, it does.

    Ms. JOHNSON. Thank you.

    Mr. Johnson, is that the way you function at DuPont?

    Mr. JOHNSON. I am The Aerospace Corporation. And actually, in our case, in the case of the Air Force launch organization, the CEO, the appropriate person in that same position would actually be Lieutenant General Arnold, who is the Space and Missile System Commander. The program managers that manage the overall launch programs actually work for him. And the information always flows up to General Arnold, to answer your question. The program managers do a very good job of doing that, and the final flight readiness review is actually chaired by General Arnold, and he is the one that gives the final GO decision based on the inputs of all of the various agencies, The Aerospace Corporation being one of them, but also his Program Manager and several others.

    Ms. JOHNSON. Ms. Grubbe.

    Ms. GRUBBE. Congresswoman, at the DuPont company, everyone has the same accountability for safety: from the CEO to the operator in the control room on the night shift. And it is our intent to make sure that everyone would behave and make the decisions with regard to safety in the same way.
 Page 114       PREV PAGE       TOP OF DOC

    Ms. JOHNSON. Thank you very much.

    Does anyone on the panel have a comment of what—your opinion of what might have broken down at NASA?

    Admiral BOWMAN. As I said, Congresswoman, in my opening testimony, I just don't consider myself to be expert enough in this area and have not studied it well enough to offer an opinion.

    Ms. JOHNSON. Thank you very much.

    Is that a signal that my time is up?

    Chairman BOEHLERT. Yeah, that is it. All right.

    Ms. JOHNSON. Thank you.

Decision-making in the Naval Reactors Program

    Chairman BOEHLERT. Thank you very much.

    Admiral Bowman, let me ask you, does Naval Reactors make a decision on when and whether to launch, or does it go topside at Navy?

 Page 115       PREV PAGE       TOP OF DOC
    Admiral BOWMAN. I—this gets difficult. I have—both wear a hat within the Navy as the Director of Naval Reactors as a four-star admiral, and I am also an Assistant Secretary of Energy overseeing the safe operation, the oversight regulation of the safe operation of Naval Reactors. In that job, I have the final say over whether a Reactor is safe to operate. And so there is no over my head in that regard. And certainly, I report to the Secretary of Energy in that regard, in that role, and to the Secretary of the Navy in the Navy role.

    Chairman BOEHLERT. Well, then you would say you are comparable to the Administrator of NASA in that regard? In other words, you have the final say on when and whether to launch?

    Admiral BOWMAN. When and whether to allow operation of the Reactor plant. The ship's operation is a different matter. The Reactor plant is the propulsion system that drives the ship through the water. Without it, the ship couldn't get underway. So I do have a veto vote that the ship couldn't leave if I felt there was something unsafe that—to preclude safe operation of the Reactor plant. But the contrary is not true. There may be things that are beyond my purview having to do with the submarine safety areas that Admiral Sullivan oversees that I could say my Reactor plant is perfectly ready to go and safe to operate, but the ship doesn't leave because now it does leave my hands and go——

    Chairman BOEHLERT. Yeah, I——

    Admiral BOWMAN [continuing]. Above my head. Yes, sir.

 Page 116       PREV PAGE       TOP OF DOC
    Chairman BOEHLERT. Thank you very much for that clarification.

    Mr. Gutknecht.

Culture and Attitude

    Mr. GUTKNECHT. Thank you, Mr. Chairman.

    And I apologize to our distinguished guests for the attendance here, because you need to understand, we understand—sometimes people in the audience don't understand we have a number of other Committee meetings going on at the same time. And I want to thank the Chairman for calling this hearing, and I want to thank you for coming. I have never had the courage to go out on one of these weekend submarine missions, which some of my colleagues have done. I have spent a few hours on one, and I must tell you, I am in admiration of those brave Americans who go out sometimes for months at a time and serve this country. So please pass that along to the people that work under you.

    Let me—the issue here is about safety, and I want to come back to something, because I believe the single most important word in the English vocabulary is the word ''attitude.'' And I think if anything happened that I have learned so far and in what we have learned in terms of the Shuttle catastrophe is that the attitudes at NASA had become a little bit sloppy. And you went through—the Navy went through a similar process, I think, after Thresher. I guess the question that this committee really wants to get at, after the Thresher, and I think this is for Admiral Sullivan, did you start, essentially, with a blank sheet of paper and start over, or did you tend to—did you try to modify the current structure that was there? And I think that is a fundamental question we need to get at relative to NASA. And perhaps you could offer some observations on that.
 Page 117       PREV PAGE       TOP OF DOC

    Rear Admiral SULLIVAN. I would say in response to the Thresher disaster, we basically went all the way to our roost and rebuilt the culture. The first thing we did was restrict the operating depth of all operational submarines at the time. Then they revised the operating procedures. And of course, this was many years ago. Submarine operating procedures were revised. We went through a review of the design of our submarines and made a number of changes that fundamentally changed the way we had our safety systems in our submarines design including redundancy, putting in a special emergency blow system, and having redundant backups for closing major openings into the ship if the primary system failed. We also worked hard on our diving plane hydraulic systems so that we would have increased reliability. We started the whole audit process. We formalized—we changed the way we joined our pipes. Before Thresher, many of the pipes that carried water inside the ship where they were—water coming in from the sea were used silver-braise joints. We went from silver-braise joints to welded joints, which are much more reliable and can be inspected more easily and with more reliability. So we really changed the whole operating design and manufacturing culture of the program. It took a long time.

    Mr. GUTKNECHT. But Admiral, did you change your organizational structure?

    Rear Admiral SULLIVAN. I wasn't there then. I was a kid. I—there was no SUBSAFE group, that is for sure.

SUBSAFE's Use of the Challenger Case Study

 Page 118       PREV PAGE       TOP OF DOC
    Mr. GUTKNECHT. The—and let us come back to that SUBSAFE group. Now apparently, I am told, that you used the Challenger accident as part of your training program. Can you tell us a little bit about that?

    Rear Admiral SULLIVAN. Yeah, I am glad you mentioned that, because I wanted to talk about how you combat complacency in a culture of safety. Basically, whenever any complex system fails, including Challenger and including all of the Soviet Navy's submarine losses, we try to fold that into our training. We hold annual training on everyone who works on the submarine program who works at SUBSAFE. And the training consists of two parts. One is a kind of review of all of the procedures and instructions, and the second part is a formal—I will call it a lecture, but we actually watch a video every year that describes the whole lead up and loss of Thresher, including a tape of the audio of the submarine pressure hold breaking up. And that is pretty sobering to go through every single year. And you know, I have heard it an untold number of times, and it sends a chill through my bones every time I listen to that tape.

    So I—again, what you have to do is combat complacency.

    Mr. GUTKNECHT. But do you use the Challenger incident?

    Admiral BOWMAN. My organization uses the Challenger incident as formal training. In fact, just yesterday I was at one of my two Department of Energy laboratories speaking to a fairly large crowd outside. And I spoke then about the Columbia Accident Investigation Board and its report and how we needed to do exactly the same thing with Columbia as we have done with Challenger. One of the first books I read upon taking this job over seven years ago was Diane Vaughn's book on the loss of the Challenger. And we have ingrained that training as a formal routine part of our training at Naval Reactors.
 Page 119       PREV PAGE       TOP OF DOC

    We use a phrase called ''constructive dissatisfaction'' to attack what Admiral Sullivan was just speaking of, complacency within an already pretty safe organization. I argue that if we are not constructively dissatisfied with where we are and with the status quo, we are going to find ourselves on the right road but standing still, and we are going to get caught some day. So the Challenger training is a big part of that training.

    Mr. GUTKNECHT. Well, thank you very much.

NASA/Navy Benchmarking

    Chairman BOEHLERT. Thank you.

    Just let me ask you, how long, Admiral Bowman, have you been in your current job? Eight years?

    Admiral BOWMAN. Seven years and 28 days.

    Chairman BOEHLERT. And Admiral Sullivan, how long?

    Rear Admiral SULLIVAN. I have been at my job just over two years.

    Chairman BOEHLERT. I am just wondering, between—in the last half a dozen years or so prior to the tragic February 1 accident of Columbia, was there interaction between NASA and your organization?
 Page 120       PREV PAGE       TOP OF DOC

    Admiral BOWMAN. Yes, sir, there was. Early on in Mr. O'Keefe's tenure, he socialized with me the possibility of benchmarking the Naval Reactor's culture against what he had found at NASA. He subsequently formally asked the Secretary of the Navy for permission to do that discussion, benchmarking with my organization as well as with Paul Sullivan's organization. The Secretary of the Navy, of course, obliged happily, and we began that benchmarking operation months before the tragedy.

    Chairman BOEHLERT. Of course, Mr. O'Keefe has prior experience with the Navy, so he was fully aware of your outstanding program.

    Admiral BOWMAN. Yes, sir.

    Chairman BOEHLERT. But I am comforted to hear that. But you guys, in the Navy, learn from the Challenger, and that is a case study.

    Admiral BOWMAN. Sure.

    Chairman BOEHLERT. I sometimes wonder if NASA learned from Challenger. They ought to study it as seriously as you did.

    Mr. Miller.

    Mr. MATHESON. How about Mr. Matheson? Thanks.

 Page 121       PREV PAGE       TOP OF DOC
    Chairman BOEHLERT. This paper, who says what? Mr. Matheson. Yes, sir.

CAIB Recommendations

    Mr. MATHESON. Thanks. Thanks, Mr. Chairman.

    I want to thank you for your testimony on safety practices in your own organizations. What I would like each of you to tell us is what specific benchmarks you think ought to be established to evaluate whether or not NASA is complying with the Board's organizational recommendations. And as part of your response, I would like you to give a thought about how long you think it should take for an organization like NASA to implement those recommendations.

    Admiral BOWMAN. Boy, that is a good question. And I have given very little honest thought to it, because it is not my responsibility. If I could possibly back off for just a couple of days and provide that answer for the record, I will devote——

    Mr. MATHESON. That would be great.

    Admiral BOWMAN [continuing]. A lot of resources to thinking about it. But I just haven't given it adequate thought to answer.

    Rear Admiral SULLIVAN. I would just add that probably the best forum for that is to just continue the benchmarking effort that is going on between NASA and NAVSEA right now.
 Page 122       PREV PAGE       TOP OF DOC

    Mr. MATHESON. If you—go ahead.

    Mr. JOHNSON. I was just going to add that I think probably the best benchmarks are the items that are contained in the recommendations in the report itself. And it could take a considerable amount of time to set up an organization like that. Of course, we don't know exactly what it is that NASA is going to set up, but that could be easily a year-long effort to set up an organization like that.

    Mr. MATHESON. Sure. Sure.

    Ms. GRUBBE. Congressman, I can not speak to the benchmark question, but in DuPont's work with other clients with regards to changing their own safety culture, it takes—if management is committed, if the management of the company is committed, it takes roughly 18 to 24 months to see substantive changes.

Communicating Risk

    Mr. MATHESON. You know, one issue that we deal with that, you know, as Congressmen, we are dealing with the public all of the time in town meetings or what not. And I am wondering how do your organizations address public—the public's concern about risk? How do you try to communicate how you are dealing with risk? How do you try to build up that knowledge within the public that your organization is addressing risk issues? And how do you think that would apply to NASA? You can just go in the same order. Yeah.

 Page 123       PREV PAGE       TOP OF DOC
    Admiral BOWMAN. I am going to reverse the seating next time.

    Within Naval Reactors, there has been a consorted effort over the past five or six years to do more of what you are suggesting. We are little bit hamstrung, because a great deal of what I deal with is classified——

    Mr. MATHESON. Right.

    Admiral BOWMAN [continuing]. And it is protected by the Atomic Energy Act of 1954. And so I have to be cautious. I honestly believe that I am dealing with the country's crown jewels, or at least some portion of them, in our nuclear submarines and nuclear aircraft carriers. I know, without question, that my organization is targeted by other nations for this technology, so we have been careful.

    Mr. MATHESON. Sure.

    Admiral BOWMAN. That said, we recognize that—the point of your question, that it was very important to begin developing more trust with the public than perhaps we had before. So we asked ourselves what could be discussed, and we began a program that I—from my Tennessee background, if Mr. Gordon were here, called hobnobbing. And I began encouraging my field representatives who oversee the operations in the various ports where our submarines and aircraft carriers are located or where my Department of Energy laboratories are to begin discussions with the public officials, the State officials, and the Federal officials who co-regulate some of our activities to bring them in and, at the table over a cup of coffee in a non-extreme kind of situation, tell them who we are and what we are trying to do and begin working even on security clearances for some of these people so that we can bring them into the inner sanctum and let them know better what we are doing to protect the environment and to protect the—their public.
 Page 124       PREV PAGE       TOP OF DOC

    We are highly reliant on these State and local officials to take care of their people in our ports. So we felt very strongly that it was important to do that. So I would say that we have had now a number of these discussions with State officials in all of the states that we operate in as well as beginning now to do what I call table-top drills, training scenarios that would walk us through the what-ifs and the highly improbable event of an incident that would require the town or the state to mobilize, what would be required. And so we have been doing a great deal of that, most recently with the State of Washington and their Adjutant General attended that with us.

    Mr. MATHESON. Thank you, sir.

    Chairman BOEHLERT. Thank you very much. The gentleman's time has expired. Did anyone else need to respond to that? Thank you very much.

    Mr. Smith.

Turnover in the Safety Workforce

    Mr. SMITH. Mr. Chairman, thank you.

    Congress tries to fulfill its role of policy, and sometimes that policy sort of interferes with some of the goals of the Administration or the Navy. I served in the Nixon Administration for about five years. And pretty much what we were told when we came on the Hill is, you know, try not to rile any of the Congressmen. Be nice. Be polite. I am a little concerned with NASA that has been somewhat immune from political control even—from Congress, but also even from the White House over the last several years. And so I am trying to—I guess my question relates partially to the balance of that policy coming from Congress to—at what point it—is it disruptive to the mission as determined by the Administration versus as the responsibility for policy oversight by Congress. But I don't know how you answer a question that is sort of vague like that, except let me specifically talk about the difference between the Navy and the NASA in terms of complacency, how complacency starts to evolve from employees that have been doing the same thing for too long a period. And as I understand it, Admiral Bowman, the Navy has an 8-year transition in some of the more technical aspects. And NASA has now told us that they are looking at a rotation of two to three years, so a new broom will sweep clean, if you will, but—so it is a balance of the energy and attentiveness of new people coming on the job versus the potential of complacency. What is the right length of time for rotation and transition?
 Page 125       PREV PAGE       TOP OF DOC

    Admiral BOWMAN. Well, that is another very good question and I think one that should be addressed by this committee in dealing with this NASA situation. You are right. My particular position is, by law, eight years. On the day Admiral Rickover retired, President Reagan wrote an Executive Order that made that so, and that Executive Order has subsequently been written into law twice now, making my tenure eight years.

    I think longevity in this kind of oversight position that I find myself in is extremely important to the safe operation of an organization that deals with an unforgiving technology, such as mine or NASA's. So I heartily endorse both that concept of extending the tenures of key technical people at NASA as well as what Secretary Rumsfeld is trying to do across the Navy for this—or across the military for——

    Mr. SMITH. You are recommending that it be done by law?

    Admiral BOWMAN. Well, that is certainly one way to ensure that it gets done. It is a way that it could happen. It is the way it has happened with my position.

    Mr. SMITH. Well, according—but you know, part of my concern with past hearings on the Columbia disaster, and I appreciate the question that was asked earlier that the Navy looks at Columbia in terms of what possible mistakes have they made in reaction—in relation to what we are doing and how do we make sure that we don't make the same mistakes. NASA, I think, is going to start being more conscious of a larger environment.

 Page 126       PREV PAGE       TOP OF DOC
Nanotechnology

    I have been concerned about the mission. I am Chairman of the Subcommittee on Research. A lot of the justification for our NASA effort is research. We have been told that the main reason that humans are in space is to—studying—scientifically, at least, is studying the physiological implications on humans in space flight. I just returned from Cal Tech and JPL and looking at some of the California science efforts. And I guess I come back with the conclusion that our new nanotechnology is going to replace a lot of the manned space flight. How about nanotechnology in communication to replace more personnel in the Navy, especially with submarines?

    Admiral BOWMAN. We are headed in that direction, without question, the entire Navy, not just submarines. Looking at automation. Nanotechnology may very well have a place in that in the sensor world, being able to better determine what is going on inside systems and inside components with nanotechnology. But reducing the manpower on board our warships is a stated goal as the Chief of Naval Operations and the Secretary of the Navy even—one which I endorse.

NASA/Navy Benchmark

    Mr. SMITH. Is there—just one last quick question.

    On your investigation and how it might apply to you and your responsibilities in terms of reviewing what happened with Columbia, do you communicate any of that analysis or evaluation to NASA?
 Page 127       PREV PAGE       TOP OF DOC

    Admiral BOWMAN. I am sure we will. I say that because of the earlier questions that indicated that Mr. O'Keefe was keen on benchmarking his organization against the Navy's organization. So I would have no doubt that he would be interested in our views on lessons learned from Columbia. I would add that we have already conducted training for NASA on Challenger, giving them our version of the lessons that we learned from the Challenger disaster——

    Mr. SMITH. Okay.

    Admiral BOWMAN [continuing]. And I think they found that very helpful.

    Chairman BOEHLERT. Thank you very much. The gentleman's time has expired.

    Mr. SMITH. Thank you.

    Chairman BOEHLERT. Ms. Jackson Lee.

Manned vs. Unmanned Space Flight

    Ms. JACKSON LEE. Thank you very much. And to the panelists, I think I associate my remarks with my colleague who has indicated that there are a number of hearings going on that may have delayed us in hearing your complete testimony, but I want to thank the Chairman and Ranking Member for a very, very vital hearing.
 Page 128       PREV PAGE       TOP OF DOC

    And I would like to probe extensively, within my time frame, on this question of safety. Realizing that Admiral Gehman and the Columbia Investigation Board set a standard of which we should try to achieve, I have noted over the years, starting halfway, probably, into my term, maybe even earlier, on this committee, which has been a sizable amount of time, that safety is the number one responsibility and requirement. And I would then add to say that we are at a crisis point as it relates to safety issues in moving NASA forward. Admiral Bowman, just a quick question. My colleague led you down the path of technology and manpower and possibly substituting technology for manpower. I assume reducing manpower does not, in your mind, equate to eliminating manpower as it relates to submarines.

    Admiral BOWMAN. In some instances——

    Ms. JACKSON LEE. In totality, I am trying to say.

    Admiral BOWMAN. No, not in totality. Absolutely not.

    Ms. JACKSON LEE. Okay. Then let me—I just wanted to make sure that I got that on the record that technology will never, in totality, replace the necessity of manpower, humanpower, womanpower, if you will, if they have reached that point of staffing on the submarines. And I don't believe that it will reach the point of eliminating the importance and vitality of human space flight. You are not here today suggesting that we should eliminate the human Space Shuttle?

    Admiral BOWMAN. The——
 Page 129       PREV PAGE       TOP OF DOC

    Chairman BOEHLERT. All right. Excuse me. That is not at all the purpose of the hearing. The purpose of the hearing is to learn from them how do we make——

    Ms. JACKSON LEE. I understand.

    Chairman BOEHLERT [continuing]. Human flight safer.

    Ms. JACKSON LEE. I appreciate. Let me allow the gentleman—would you answer my question, please, Admiral? Thank you.

    Admiral BOWMAN. It was certainly not my intent to indicate any opinion on the elimination of manned space flight in my answer.

    Ms. JACKSON LEE. Right. So you are not here suggesting that that should be eliminated or make a comment on that?

    Admiral BOWMAN. That is correct.

Safety Organization

    Ms. JACKSON LEE. Okay. The CAIB has indicated that we should divide the structure of NASA between operations and safety. Is that along the lines of what you have done with respect to the operations that you are involved in the Navy?
 Page 130       PREV PAGE       TOP OF DOC

    Admiral BOWMAN. We really have done almost the opposite.

    Ms. JACKSON LEE. All right.

    Admiral BOWMAN. We have integrated operations and safety. We have combined operations and safety from the beginning. As I have said earlier, the mainstreaming aspect of safety with the line functions does that for you and makes everybody responsible for and cognizant of safety.

    Ms. JACKSON LEE. And how have you found—has that been a structure that you have had for a number of years? Has it been a structure that you have implemented in response to actions that have occurred? Or has this been the Navy's general basis of operations?

    Admiral BOWMAN. Admiral Rickover set up his office at Oak Ridge in 1948, and this has been a part of Naval Reactors since 1948.

    Ms. JACKSON LEE. And in that integration of safety issues, how do you encourage the personnel in the Navy to be open on their concerns about safety questions, for example, and I think it was asked before but I would like to hear it again, if there is an air quality problem or a safety problem in a submarine that was about to disembark or about to leave shore, if you will, with my—with the technology to be refined better? But in any event, what would be the response to that individual or individuals?

 Page 131       PREV PAGE       TOP OF DOC
    Admiral BOWMAN. I think they would be rewarded and applauded. They certainly would be in my organization in our——

    Ms. JACKSON LEE. And how do they go up the chain of command?

    Admiral BOWMAN. Within my organization, it is quite easy. They have direct access to me, number one, through knocking on my door and coming in the office, calling me on the telephone, e-mail. They have direct access to their section heads. The direct reports that I referred to earlier, the 21 direct reports, know that we are going to be talking at the table in my office about are there minority opinions, are there dissenting opinions on the consensus view here. And so they go out and look for it.

    Ms. JACKSON LEE. So the atmosphere can be created, you are saying?

    Admiral BOWMAN. I believe it can, yes, ma'am.

    Ms. JACKSON LEE. Ms. Grubbe, would you—thank you very much, Admiral.

    Would you help me with the safety question in the private sector? We find that there are concerns of retaliation and enforcement questions on how do you enforce the atmosphere or penalize those who don't do it. What do you do in the private sector with DuPont?

    Ms. GRUBBE. We do something very similar to the Navy, Congresswoman. We reward and highlight people who bring forward not only safety events that have occurred where no one else was around, but potential events and make sure that they get broad communication across the organization and to every plant site around the world that has a similar kind of apparatus, if it involves a piece of equipment.
 Page 132       PREV PAGE       TOP OF DOC

    Ms. JACKSON LEE. We thank you very much for your reasoning on this. This will be instructive to us as to what we need to do, and I thank you for your testimony.

    Chairman BOEHLERT. Thank you very much.

    Mr. Rohrabacher.

    Mr. ROHRABACHER. Well, I am just going to say that I missed the testimony, and I am sorry, and I apologize. We have got our Governor-elect Arnold in town, and I was introducing him to various people, and that is part of my job, and I am sorry. But I will be reading your testimony. And I appreciate the fact that you have shared your expertise with us. We have to put NASA's house in order, and all of us on the outside and the inside have to work together. And I appreciate your contribution and appreciate Sherry Boehlert's leadership. Thank you very much.

    Chairman BOEHLERT. Thank you very much.

    And now I would like to thank the panel for participating, for serving as resources. We value highly your testimony in its entirety. And all of your complete testimony will be part of the permanent record and any added material you care to submit. And stay tuned, we may be back by phone or by written communication to ask for some amplification of certain segments of your testimony, but we really appreciate what you have done. Thank you very much.

Panel II
 Page 133       PREV PAGE       TOP OF DOC

    Our next panel will be a panel of one, the very distinguished Chairman of the Columbia Accident Investigation Board, Admiral Harold Gehman. Admiral Gehman has had a busy day. He has been over to the JV's this morning. He is coming to the Varsity right now in the Science Committee of the House of Representatives. As we all know, Admiral Gehman has been just outstanding in his service to the Nation in a very important capacity as Chairman of the Columbia Accident Investigation Board. Let me add, he has also been outstanding in many other respects, including his availability to all of the Members of this committee and to the staff of the Committee. We are working hand-in-glove with the Admiral to ensure that we have the best possible response to a very tragic situation.

    And with that, now that the name tag is properly in place and the Admiral is prepared, Admiral Gehman, welcome back.

    Admiral GEHMAN. Thank you very much.

    Chairman BOEHLERT. The Floor is yours, sir.

STATEMENT OF ADMIRAL HAROLD W. GEHMAN, JR. (RET.), CHAIRMAN, COLUMBIA ACCIDENT INVESTIGATION BOARD

    Admiral GEHMAN. Thank you very much, Mr. Chairman.

    I will just make a very, very short opening statement here, and we will get right to the questions.
 Page 134       PREV PAGE       TOP OF DOC

    The panel that you just had, I didn't get to listen to all of it, but I got to listen to part of it, a very illustrious panel. I consulted their organizations in the course of our investigation, and I congratulate this committee for getting them here and letting them talk about safety and reliability.

    Let me just say that the Columbia Accident Investigation Board was careful to—we tried to be careful to separate safety from reliability. By safety, we referred to—we refer to things like untoward incidents in the workplace or hazardous conditions or hazardous materials or the failure to inspect or to catch something. Reliability refers to completing the mission, that is launching safely and returning safely with all of the humans intact. And we—they are related to each other, but at the same time, the Board came to the conclusion that the organization and structure needed to accomplish these two goals with slightly—a slightly different approach. And therefore, we made these three organizational and structural organizations the—that you are conducting this hearing on. And it is the opinion of the Board that there is almost nothing in our report, which is more important than getting this right. We really feel that if the Board—if the Columbia Accident Investigation Board is going to be viewed as having been successful, then making these changes in NASA will be the measure of whether or not we were successful.

    In the area of reliability, we feel very strongly that separating technical and engineering authority from the operation of the Shuttle is the key to increasing the reliability and accomplishing the mission. Right now, we are successfully launching and recovering the crew and the Shuttle 55 out of 56 times. And that is not what I would call a high reliability record. There are a lot of activities in the United States which are very dangerous, very hazardous, and which have success rates far in excess of 55 out of 56. Certainly you had Naval Reactors here and the Navy Submarine Program as well as DuPont and The Aerospace Corporation. And they—their goal is zero failures to accomplish their mission. And they don't consider 55 out of 56 to be anything to brag about. So the separation of the technical and engineering authority, we believe, is one of the keys—is the key to doing that.
 Page 135       PREV PAGE       TOP OF DOC

    The second area is safety. As NASA is organized right now, the Headquarters safety organization is independent and that is not the issue. The problem that we have is that the Headquarters safety organization, Code Q, Mr. Brian O'Connor, with—in whom we have the highest confidence, does not have any line authority. He is the policy setter. And it is—it isn't that the Headquarters safety organization is not independent. That is not the issue. The problem that we have is that the Headquarters organization doesn't have any authority. And then the program and center safety organizations are subordinate and are dependent upon the programs and centers, that is the very organizations that they are supposed to check up on, are the ones that are funding their activities. And we have—it is the—so it is the program and the center safety programs that we think are not independent, not the Headquarters safety program.

    The last thing I would say before I respond to your questions is that the Board carefully studied these institutions whose representatives you just had here, plus some others, and we also availed ourselves of more than a dozen academic experts in the area of high-reliability operations and safety. And we will admit to you—we will admit, unashamedly, that we selectively picked and chose the attributes and characteristics of these organizations, which we thought added to reliability. We did not copy lock, stock, and barrel either the Naval Reactor's model, the SUBSAFE model, the Aerospace model, or any other model. We picked the attributes that we liked the best and put our formula in the report. And the longer that this report stands out here, the more scrutiny it has gotten, the stronger we feel that we got it right.

    So with that, Mr. Chairman, I will be glad to answer your questions.
 Page 136       PREV PAGE       TOP OF DOC

    [The prepared statement of Admiral Gehman follows:]

PREPARED STATEMENT OF HAROLD W. GEHMAN, JR.

    Good afternoon Mr. Chairman, Representative Hall, distinguished Members of the Committee, ladies and gentlemen.

    It is a pleasure to appear today before the House Science Committee. I thank you for inviting me and for the opportunity to provide answers to questions you may have as you endeavor to implement the recommendations of our report on the investigation into the tragic loss of the Space Shuttle Columbia and her courageous crew of seven.

    My intent during my testimony today is to provide the Committee with information on any of the topics explored by the Columbia Accident Investigation Board in the final report. I am prepared to explore any area in which you or the Committee are interested; however, I would like to remind you that now that the Board has disbanded, my ability to speak on its behalf is limited. I cannot comment on the progress of the NASA's return to flight, as I have not been involved in an oversight role. I do wish to make myself available to explain any facets of the report that may be unclear or require further clarification.

    That said, I would like to turn my attention to the questions provided in the charter of this hearing.

    The first question asks what it means for a safety program to be independent. I believe we must clarify which independent safety program we are discussing. The Board found that the NASA Headquarters Code Q safety organization is completely independent. Our finding referred to the Center and Program Safety Offices. We do not think the current process by which the Center and Program Managers ''buy'' as much safety as they can afford or think they need is the best organizational construct. When safety competes against all other budget items such as schedule, maintenance, upgrades, pay raises, etc., safety sometimes is compromised. In regards to the NASA Headquarters Safety Office addressed in Recommendation 7–2.5, the Board's concern was not lack of independence, but rather the lack of a direct line of authority over a safety organization whose jurisdiction runs all the way down to the shop floor.
 Page 137       PREV PAGE       TOP OF DOC

    The second question concerns how to balance the organization of safety programs to give them sufficient robustness and efficiency, but without preventing the larger organization from carrying out its duties. Safety organizations should not have veto authority over operations, but they do need the expertise and depth to understand the systems completely, the ability to initiate and resource at least a minimal study or inquiry on their own without having to ask project management, sufficient personnel to be present at critical tests and inspections, proper test equipment, and sufficient resources to fund studies that help reveal what trends mean and what the safety organization should be looking for.

    Thirdly, the Committee asks how to ensure that the existence of an independent safety program does not allow the larger organization to absolve itself of responsibility for safety. The safety organization should not supplant the operations organization for operational decisions. The safety organization just needs to be robust enough and independent enough to study an issue, understand multiple sides and all the implications of the actions contemplated, come to a conclusion that is supported by analysis, testing and research, and then have a chance at the proper forum to voice their independent position.

    The Committee's last question concerns ensuring that dissenting opinions are heard, but avoiding the possible impasse resulting from a safety review process that can never reach closure. The Board has reached the conclusion that holding and voicing dissenting opinions is not the problem. The problem comes when dissenting opinions are not supported by data. What the CAM recommended are procedures that ensure that reliability and safety matters can be thoroughly examined by knowledgeable people with sufficient resources. This process does not guarantee that errors won't be made, but the current NASA process doesn't even give the system the chance to catch mistakes.
 Page 138       PREV PAGE       TOP OF DOC

    Thank you, Mr. Chairman. This concludes my prepared remarks and I look forward to your questions.

Discussion, Panel II

ISS Safety and CAIB Recommendations

    Chairman BOEHLERT. Thank you very much, Admiral.

    You are aware, and so are all of us, of the issue of the Space Station and what has transpired over the last several days and the extensive coverage given to the issue and how it was handled. If your recommendations had been in place, how do you think it would have been handled differently?

    Admiral GEHMAN. Mr. Chairman, I do not—I only know about this case of the air and water quality on the International Space Station from what I read about in the newspapers. I do not have any knowledge of the actual details of who said what to whom and who went to what meeting and all of that sort of thing. But I can speak to that incident in the context of the mosaic presented by our report. First of all, if there are technical standards for air, water quality, and if there are monitoring instruments up there, the operation of those instruments and the enforcement of the air—of the environmental quality and the safety of the people in the International Space Station would be the purview of this engineering technical authority. And the Program Manager could not waive those standards. He could not say, ''No, I am going to go anyway.'' That is—that would not be one of his functions. He would have to go to the independent technical and engineering authority and say, ''Well, I have looked at this, and I have decided that we should go ahead and replace this crew. Even though these instruments aren't working the way they are supposed to, we have no reason to believe that there is''—anyway, he would make his argument, and it would be up to this independent technical authority to determine whether or not it wanted to waive its own standards. If it chose not to waive—and to get to your question specifically, the—whoever these people were who decided not to sign off on the flight readiness review, they would be operating in an environment in which they would be on the inside. That is, they are in an engineering environment in which actions like this are rewarded and are encouraged rather than having to prove that something was wrong.
 Page 139       PREV PAGE       TOP OF DOC

    Sooner or later, it would have to come to some person, probably the head of human space flight, or something like that, who would have to decide which way to go. That is okay. And if they decided to go ahead anyway, that would be fine. But I—but the big difference would—the big difference in my view would be that, as I understand it, and Mr. O'Keefe sat beside me a couple of hours ago and he just explained his action here, as I understand it, these dissenting opinions were encouraged. They were fired up on. They were taken seriously, but they were all taken seriously because of the good graces and the cooperative attitude of management. And I—the history of the Space Shuttle Program and NASA, going all of the way back to Apollo, indicates that over a period of 18 to 24 months, those good graces and that cooperative attitude will atrophy and the old pressures of schedule and manifest and cost will come back again.

    Chairman BOEHLERT. And it never got topside until the last 72 hours. I mean——

    Admiral GEHMAN. Yeah, that—I don't know any of those details, but the big difference would be, in my opinion, that these dissenting opinions, these concerns would be voiced in an organization that was not concerned about schedule, not concerned about cost, and it would be in a friendly environment. These people would not be, kind of, on the outside trying to get their way in.

Safety Program Independence

    Chairman BOEHLERT. Well, what—how do you consider the Naval Reactors Program independent, because we just heard from Admiral Bowman that there is nothing separate? I mean, safety is everybody's business. It is the culture that he is talking about. Everybody is totally immersed in safety first and foremost. And it—there doesn't seem to be the independence that you outlined, the Board outlined in its recommendations.
 Page 140       PREV PAGE       TOP OF DOC

    Admiral GEHMAN. Mr. Chairman, I listened to part of that, and I think that there was a misunderstanding, even though Admiral Bowman tried to clear it up at the end. Admiral Bowman and his organization are responsible for the Reactor and all of the requirements of the Reactor, all waivers to the Reactor, and all operations of the Reactor, but they are not responsible for the ship, the submarine. There is a—the Fleet is responsible for the operations of the submarine. And that is our model with—the Program Manager who is responsible for the operations of the manifest of the Shuttle and then a technical authority that is responsible for the technical specs and requirements of the Shuttle.

    Admiral Bowman and his organization can say, ''That Reactor is not ready to operate,'' in which case the Fleet Commander can't operate the submarine. But Admiral Bowman doesn't operate the submarine. Once he says it is okay, then someone else decides where the submarine goes, how fast it goes, what date it goes out——

    Chairman BOEHLERT. Got it.

    Admiral GEHMAN [continuing]. When it comes back, and so when he says that the whole line organization is responsible for safety, he was referring to his line organization. He was referring to his pump guys and his——

    Chairman BOEHLERT. Thank you for that clarification.

    Admiral GEHMAN. Yeah.

 Page 141       PREV PAGE       TOP OF DOC
    Chairman BOEHLERT. Ms. Jackson Lee.

ISS Safety

    Ms. JACKSON LEE. Thank you very much, Mr. Chairman, again. And thank you, Admiral Gehman——

    Admiral GEHMAN. Thank you.

    Ms. JACKSON LEE [continuing]. For having the willingness to be at bat more than once today.

    Since you have been here, your work is continuing, and our challenges are continuing. And so rather than dance around the question, let me go right to it. You had been answering the question, but might I say that I think we were engaged earlier, as you well know, when I say we, myself in questioning, raised the issue of safety on the International Space Station. And I think now we are in dialogue through written communications to try and expand on that understanding. I believe that maybe it was good for us to have this happen sooner rather than later with respect to the issue of exposing the difficulties.

    There are two prongs that I would like to probe with you. One, we found, again, if you will, and you have not done an extensive review of the Space Station but use your background and experience with your view of Columbia 7, the tragedy that occurred there. The first prong, of course, is that there were, in this instance, two very vocal scientists who offered their opinion and, I believe, refused to sanction and/or prove the sending of two additional astronauts to that—to the Station. What should have happened or what went wrong, maybe that would be the better approach, that they were either overrun, superseded? Was that healthy? Was there—and you may be gleaning this from newspaper articles, but what went wrong from that perspective?
 Page 142       PREV PAGE       TOP OF DOC

    The other perspective is that is it viable and important at this time now to do a comprehensive safety assessment on the Space Station? Again, I remain committed to the value of humans in space and certainly human Space Shuttle. But for it to be a successful experiment, which I think Space Station is, there is no doubt that we are still experimenting with what goes on in space, but do we need that right now without one moment's rest or stop in beginning to assess the safety issues on that—on Space Station?

    Admiral GEHMAN. Thank you very much, Ms. Jackson Lee.

    From what I understand of the incident over—the incident having to do with the approval of the Crew 8 mission, I believe that it is—if you take the matrix or the test of the Columbia Accident Investigation Board report and apply it to that event, I believe it looks like this. In the first case, there is some good news. For example, one of the issues that we raised in our report was it—that it seemed to us that over the years that engineers and scientists had to prove that a situation was unsafe before the Shuttle Program would take any action, whereas in the original days, you had to prove it was safe in order to go forward. And the fact that the test now seems to be ''prove to me that it is unsafe'' is the wrong question. For example, in the case of the engineers in the case of Columbia who wanted photography, wanted imagery on-orbit, they were told to prove that there was a problem before management would go ahead and get the photography. That is a case of ''prove that it is unsafe before I take any action,'' whereas the original Apollo philosophy was ''you have to prove to me that it is safe or I am not going to go forward.''

    Okay. In the case of the atmosphere and the water situation, the human conditions on board the International Space Station, it does appear to me that NASA management asked the question, ''All right, you are going to have to prove to me that it is safe.'' That is the correct question. So it looks to me like they have learned that—in this case, they have learned their lesson. The—so that is the good news in this particular incident.
 Page 143       PREV PAGE       TOP OF DOC

    The bad news, or the thing that I am concerned about is the same issue that I brought up with the Chairman and that is it appears to me that it took the intervention, the act of intervention of management to resolve this issue. In other words, the system didn't take care of this problem by itself. And a year from now, or 18 months from now, when cost and schedule pressures have resumed, I am—I don't think we want to rely upon the intervention of management to snatch victory from the jaws of defeat. I think we want to institutionalize a process by which these issues can be raised and sorted out without having top-level management intervene.

    Chairman BOEHLERT. Thank you very much, Admiral.

    Admiral GEHMAN. And the second question, to get to your second question, we kind of have a cookbook here. We only looked at the Shuttle Program. I think that probably the International Space Station Program ought to be looked at, also, but I—but not with the same urgency, of course.

    Ms. JACKSON LEE. Thank you.

    Chairman BOEHLERT. Thank you, Ms. Jackson Lee.

    Mr. Rohrabacher.

Leadership Confidence

 Page 144       PREV PAGE       TOP OF DOC
    Mr. ROHRABACHER. Yes. Admiral Gehman, Mr. O'Keefe, Director O'Keefe, has my full faith in his decision-making. Does he have your faith?

    Admiral GEHMAN. Yes, sir. I—of course, I only have seven months of experience, I mean, since the 1st of February, and——

    Mr. ROHRABACHER. Almost as much as his.

    Admiral GEHMAN. Well, that is right. He is—that is right. He has only been there slightly longer than that, but in the course of this investigation, he has provided us all support, everything we have asked for. He has taken all of the right moves, as far as I can tell, so yes. The answer is yes.

ISS Safety

    Mr. ROHRABACHER. Okay. And the episode with this Space Station decision that had to be made, you were satisfied with the way that that has been handled?

    Admiral GEHMAN. Well, once again, I don't know the details of who said what to whom. And—but it did appear to me, just based on the limited knowledge that I have, including listening to Mr. O'Keefe explain it to the CST this morning, that it took the active intervention of management to bring this issue up to the proper level. And I would rather see a system at work in which it didn't take the active intervention of senior managers to bring something up. It ought to come up automatically.

 Page 145       PREV PAGE       TOP OF DOC
    Mr. ROHRABACHER. And since the issuance of your report, your—you would give NASA an ''A''? A ''B''? A ''C''? An ''F''?

    Admiral GEHMAN. Since the issuance of our report, myself and other members of the Board have continued to dialogue not only with NASA on a regular basis, we have been asked—invited by Mr. O'Keefe to come over and address his senior management, and we continue to hammer, and hammer, and hammer. But also, we have an active dialogue going on with the Stafford Covey Return To Flight Task Group so that they understand exactly what we mean by every recommendation. So we are—you know, it is early yet, and we are still in the thinking stage. We are not in the doing stage yet, but so far, so good.

Vision

    Mr. ROHRABACHER. One of the things that I believe we discussed when you were sitting there before was the lack of—the importance of a lack of vision statement and the importance of lack of an overall goal that people would—could unify behind and those type of goals actually energize the system. I haven't seen anything come forward from the Administration yet along those terms. Is it necessary? Do you still believe that it is necessary to have this vision and unified concept for NASA to work at its peak efficiency?

    Admiral GEHMAN. Yes, sir. The Board was quite straightforward and firm in that finding. It wasn't a recommendation, but we felt very strongly that the lack of an agreed, and by agreed I mean both ends of Pennsylvania Avenue as well as the American public, an agreed vision for what we want to do in space gets in the way of a lot of very practical day-to-day things. For example, NASA doesn't know, nor do you know, how much money to put into infrastructure upgrades if you don't know where you are going. You don't know how much money and how high a priority Shuttle upgrades and Shuttle safety upgrades should be accorded, because you don't know how long the Shuttle is going to last. You don't know—NASA doesn't know how to justify to you major investments. And indeed, in the case of the orbital space plane, it is not clear exactly what this thing is supposed to do because we don't have an agreed vision as to what we want to do.
 Page 146       PREV PAGE       TOP OF DOC

    So it gets in the way of doing business on a daily basis, not only at the national level, not only at your level, but at the practical level down at the Cape and down at Marshall, because they——

    Mr. ROHRABACHER. And in terms of the individual level, you might correct me if you disagree, but I imagine you do, that individuals who are working within a system are energized and there is a new dynamic created in their—in the way they work and the care that they take if they feel that they are part of something that is much larger than just the task of the day. And without a consensus or a concept that is going to—a unifying concept, we are not going to be able to do our job, are we?

    Admiral GEHMAN. Well, I think that the—all of the workers and all of the scientists and engineers as well as the contractors that we came in contact with, which was quite extensive, as you know, because we did interviews on the shop floor, we did interviews in the back room, they all appeared to be motivated and serious and quite dedicated to their project. I think I mentioned to you and to other Members of this committee that early in our investigation, we were—when we were doing view graph 101, when we were getting hundreds and hundreds of view graphs, we actually had presenters choke up and break down while they were briefing us, just to show how dedicated they are.

    But I believe that—in the—that where your question really hits the mark, Mr. Rohrabacher, is in the area of problem solving. Now if we don't really have a good vision, a good, exciting vision that people can buy into, we don't really address some of the problems as aggressively and imaginatively as they would if they knew where they were going.
 Page 147       PREV PAGE       TOP OF DOC

    Mr. ROHRABACHER. Thank you very much. Thank you, Mr. Chairman.

    Chairman BOEHLERT. Thank you very much.

    Mr. Wu.

Expedition 8 Launch Decision-making Process

    Mr. Wu. Thank you, Mr. Chairman.

    Thank you for coming again, Admiral.

    I want to ask one question and then one follow-up. And the question is—somewhat follows up on the Chairman's earlier question and Ms. Jackson Lee's earlier question about the decision to launch this latest group of people to the International Space Station and the fact that there were, in fact, in essence, two dissenting opinions. And there was a process. There was dissent. There was discussion, and apparently that occurred over a period of time, and now there are two astronauts in the International Space Station. We have a solar flare that occurred yesterday and it is arriving just about at this time: an unpredicted event, difficult to predict, and in this case, unpredicted. Was this decision-making process and the fact that now these two astronauts have to get into the thickest part of the International Space Station and move water around, perhaps, and so on, is that a sign that the process is working because two people were able to consent, or is that a sign that this process is not improving because we are where we are with the solar flare and two astronauts up and the radiation monitors not working?
 Page 148       PREV PAGE       TOP OF DOC

    Admiral GEHMAN. Right. Well, my understanding—and certainly we studied this in the case of the Shuttle Program in great detail. My understanding is that in the process of certifying a vehicle for a launch or a mission to go, I would consider dissent to be a good thing. There are so many variables and so many pieces and so many subsystems that—there are so many risks and so many assumptions that have to be made that if everybody said, ''Yes, yes, we are ready to go. No problems. Everything is good to go,'' I would be suspicious that somebody is hiding something from me, because it is so complex and so dangerous. There is so much energy involved. There are so many systems involved. There has got to be some—out there, there has got to be somebody who is having a little problem with his system or he has some doubts about something. And if that person doesn't speak up, that is what I would be concerned about.

    So the fact that there were some environmental scientists, or medical doctors in this particular case, who were concerned about some aspect of it, to me is not a sign of a failure or a sign that anything is going wrong or anything like that. The lack of any dissent would cause my suspicions to go up. And once again, I do not know in detail of how this dissent was handled or who did what to whom and who held what meeting, only what I have heard Mr. O'Keefe testify to this morning and what I have read in the newspapers. And I had already said that it looked to me like it took active management intervention to get that sorted out. And that is not a long-term formula for success.

    Mr. Wu. Thank you, Admiral.

    The follow-up question I have is that, according to what I have heard, Administrator O'Keefe learned of this problem only days before the launch even though the dissents occurred a significant time prior to that. And as a Member of this committee, I don't know if the Chairman had better access to the information, but I learned about the dissents through the newspaper. Is this—the panel we had earlier said, ''You know, one of the things about safety is you build it in so that it goes to the top and everyone has responsibility and the loop loops in the person who is ultimately responsible.'' And the fact that, perhaps Administrator O'Keefe did not know until, maybe, soon before the launch and that members of this oversight committee didn't know until it was published in the newspaper post-launch, is that a sign of a challenge or a problem to be faced?
 Page 149       PREV PAGE       TOP OF DOC

    Admiral GEHMAN. I think we should not comment on that here, because in his testimony this morning before the Senate, Mr. O'Keefe said that that was not true. And we ought to let him sort this out. As I say, I do not know who said what to whom on what day, but in his testimony this morning, Mr. O'Keefe said that that press report of when he was told and how he was told was inaccurate. And so we ought to let him sort that out.

    Mr. Wu. Thank you, Admiral.

    Chairman BOEHLERT. Thank you.

    Mr. Wu. Thank you, Mr. Chairman.

ITEA and Safety Staff Turnover

    Chairman BOEHLERT. A quick one before I go to Mr. Smith for the final question for you. How important do you think it is, Admiral, to have longevity in the staff of the independent technical and safety organizations?

    Admiral GEHMAN. Well, I think that longevity is one of the attributes that would aid in the efficiency and effectiveness of that organization. It is also the opinion of the Board, by the way, that this independent technical and engineering authority or whatever it eventually gets called, would also aid in some of NASA's career progression and retaining issues, because right now there are very troublesome career moves of into contractors and out of contractors and back and forth. And I would really like to see a more healthy progression of, you know, into the—into a true engineering organization than back into the program and back into engineering. So we think it is very important.
 Page 150       PREV PAGE       TOP OF DOC

    Chairman BOEHLERT. That is a view we share. It is—we are working with NASA to give them the ability to restructure in how they do things and to treat their workforce a little bit differently because of the proven need.

    All right. Mr. Smith, for the final——

ISS Review

    Mr. SMITH. Mr. Chairman, I am—very briefly. And Mr. Chairman, I agree with you that Administrator O'Keefe was correct when he decided that the reorganization of NASA should occur before the return to flight, really setting a more ambitious schedule than that called for by the CAIB.

    Admiral, let me ask you exactly what you meant when you said there should be a further evaluation of the Space Station. Are you talking about policy, goals, objectives, what it is accomplishing, or are you talking about safety?

    Admiral GEHMAN. Any kind of a review whatsoever. I am speaking—that was a private opinion. So I have got no evidence to go on to indicate that there were—there are any problems in International Space Station.

    Mr. SMITH. Well, there is hope——

    Admiral GEHMAN. But my private opinion is, though, that the kind of look we looked at their management schemes here and how safety is handled probably would be a good idea for the International Space Station to get the same kind of examination.
 Page 151       PREV PAGE       TOP OF DOC

    Mr. SMITH. But even more than that, I would think, last weekend, I am sure you are aware that a report by NASA scientists was, for lack of a better word, leaked that described the human physiological research at the Station as voodoo science. And NASA science, I think, has identified that the physiological research on humans is essentially all of the justification why humans would be in space. And of course, I am an advocate of dramatic reductions at this time of real financial problems with the Federal Government and the debt that we are facing to review all programs. And so I think when we look at the Space Station, we also need to look at what it has accomplished. And I think that we should consider, in some kind of investigation, whether it is—and I suspect maybe you would like to visit with your family some more as far as you taking the responsibility of it, but should we drastically reduce manned space flight and should we maybe abandon the Space Station?

    Admiral GEHMAN. I am sorry. I am going to have to defer on that——

    Mr. SMITH. I knew you—all right.

    Admiral GEHMAN [continuing]. Mr. Smith. We did not look—we did a lot of ancillary research to make sure that the report that we wrote was—is in much context as we possibly could. We put it in budget context, history context, everything else like—but the one context that we did not look at was the argument between how much human space flight is enough. And so I just am not a——

    Mr. SMITH. And again, thank you for your great work and service to the country.
 Page 152       PREV PAGE       TOP OF DOC

    Admiral GEHMAN. Thank you.

    Mr. SMITH. And Mr. Chairman, I yield back. Thank you.

    Chairman BOEHLERT. Thank you very much. And what you said, very eloquently, and you have said it many times, we need a national debate, a good thorough vetting of the issues. And we have got to reach some sort of a consensus that gives us a vision.

    Admiral GEHMAN. Yeah.

    Chairman BOEHLERT. And we have got to work toward it. Thank you very much, Admiral Gehman.

    Admiral GEHMAN. May I make one 30-second last closing statement here——

    Chairman BOEHLERT. By all means.

    Admiral GEHMAN [continuing]. And that is that the fundamental—the three fundamental organizational recommendations that we made that is there should be an independent technical engineering authority. That is the most important one. That the Headquarters safety organization should have line authority. Now that doesn't mean that the Program can't have a safety organization and the center can't have a safety organization. They certainly can. But for the—for your head of safety to be only a policy-setter doesn't seem to be——
 Page 153       PREV PAGE       TOP OF DOC

    Chairman BOEHLERT. Right.

    Admiral GEHMAN [continuing]. Reason for us. And the last one, that the Shuttle Program should have a true integration—a systems integration office, which it does right now. In reflection over time and listening to all of the experts, we are more convinced than ever that those are good, solid recommendations, and we stand by them. And I didn't hear anything from this panel this morning which changed my opinion.

    Thank you very much, Mr. Chairman.

    Chairman BOEHLERT. Well, thank you. And you have not disappointed us. We have always come to recognize that we get good, solid recommendations from you.

    Thank you very much. This hearing is adjourned.

    [Whereupon, at 12:19 p.m., the Committee was adjourned.]

Appendix 1:

Answers to Post-Hearing Questions

ANSWERS TO POST-HEARING QUESTIONS

 Page 154       PREV PAGE       TOP OF DOC
Responses by Admiral F.L. ''Skip'' Bowman, Director, Naval Nuclear Propulsion Program, U.S. Navy

Questions submitted by Representative Ralph M. Hall

Columbia Accident Investigation Board Recommendations

Q1. How will we know that NASA has implemented the Columbia Accident Investigation Board (CAIB) recommendations? What measures do you use in your organization to determine that your safety mechanisms are working?

A1. I do not have firsthand knowledge of the pertinent details of NASA's technology and organization. However, I do note that in many ways they are different from that of the Naval Nuclear Propulsion Program (NNPP). Therefore, I cannot provide useful guidance on how to best determine if the CAIB's recommendations are implemented.

    As to how I determine if safety mechanisms are working in my own Program, I have several methods using many inputs. My staff and I are personally informed of or briefed on every significant naval nuclear propulsion plant problem; from this, we determine if additional causes need to be identified or if additional corrective actions (technical or administrative) need to be taken. In addition to performing site inspections, Reactor Safeguards Examinations (RSE), and personal site or ship visits, my staff and I receive reports from my many field representatives, from contractor and other Program organizations, and from commanding officers of nuclear-powered ships. I expect them to find problems—if they don't, my instincts based on a more than 30-year career as a nuclear-trained operator tell me that they probably aren't looking hard enough. Issues identified in those reports are evaluated to see whether corrective actions (again, either technical or administrative) are required. Similarly, I expect dissenting opinions on difficult decisions and if there are no dissenting opinions, my experience tells me that they haven't asked all the right people for input. In addition, I frequently insert my own ''dissenting opinions'' (''devil's advocate'') into the discussion and have those carefully examined. As Admiral Rickover said, ''One must create the ability in his staff to generate clear, forceful arguments for opposing viewpoints as well as for their own. Open discussions and disagreements must be encouraged, so that all sides of an issue will be fully explored.''
 Page 155       PREV PAGE       TOP OF DOC

    My safety inspection process is extensive. Headquarters personnel at the most senior level personally evaluate performance and compliance in the field. Headquarters staff conducts regular inspections of work, safety, and environmental and radiological controls. Headquarters evaluation teams are made up of the technical-requirements owners (who are responsible to me for all safety aspects of their areas) for the particular areas being assessed. This ensures that the evaluation team has an indepth understanding of not only the requirement, but also its significance, letting the evaluation team identify issues and trends that might not be discerned if auditing were done solely by checklist. Additionally, field office personnel routinely conduct audits and inspections as part of their responsibility to monitor the work of Program laboratories, prototypes, the Fleet, shipyards, and prime contractors. The DOE laboratories, the nuclear-capable shipyards, and the Fleet also must conduct self-audits, assessments, and inspections. My Headquarters staff, field office personnel, senior Fleet personnel, and I then critique these self-reviews, as appropriate.

    Of course, the bottom-line measure of the success of the safety mechanisms is prevention of any event that could affect the health and safety of the public and Navy personnel or the environment. Therefore, we don't let near misses or even initiating events pass unchallenged. The hallmark of a strong safety culture is to look continually and actively address the minor problems in order to prevent the major problems.

Q2. The CAIB recommends a separation between the operational aspects of the Shuttle program and the organizations providing engineering and safety support. Based on your experience:

 Page 156       PREV PAGE       TOP OF DOC
Q2a. Do you agree with this as a principle for managing your program?

A2a. In the Naval Nuclear Propulsion Program (NNPP), my Headquarters and Field Office staff that provides engineering and safety support also provides operational oversight (as opposed to operational control, which is assigned to the Fleet for ships and to the Prime Contractors for their laboratories and prototype reactors). I do not agree with the principle of completely divorcing all operational aspects of a technical program from engineering and safety support for that program. The technical expertise from engineering and safety is necessary in the proper oversight of operations. Most importantly, I consider it vital for the technical authority to be one and the same as the safety oversight to ensure indepth and continuing understanding, awareness, and ownership of all aspects of design and operation.

    For Fleet operations, Headquarters and Field Offices are responsible for the engineering and safety aspects relating to nuclear power. The Fleet operates the nuclear-powered warships in accordance with the safe operating procedures my organization provides them. The Prime Contractors operate prototype propulsion plants, following similar procedures. Changes to technical standards or operational procedures require my Headquarters' approval.

Q2b. Where do you place the boundaries between these three program elements in your program and how do they interact?

A2b. Within my organization, safety is the responsibility of everyone at every level: equipment suppliers, contractors, laboratories, shipyards, training facilities, the Fleet, field offices, and Headquarters. It is not a responsibility unique to a segregated safety department that then attempts to impose its oversight on the rest of the organization. Put another way, safety is mainstreamed. I expect to be able to ask any of my direct reports about the safety significance of any action in which they are involved and have them be able to explain the issues and why the action is satisfactory.
 Page 157       PREV PAGE       TOP OF DOC

    Because of the mainstreaming philosophy, some elements of the Program (such as shipyards and the Fleet) do not even have a separate reactor safety department. However, I do have a small group of people responsible for reactor plant safety analysis, who provide policy oversight as well as most of the liaison with other safety organizations (such as the NRC) to help ensure that we are using best practices. They also maintain the documentation of procedures and responsibility for the modeling codes used in our safety analyses. They are full-time safety experts who provide our corporate memory of what the past problems were, what we have to do to maintain a consistent safety approach across all projects, and what we need to know about civilian reactor safety practices. In addition, this group is part of our technical reviews to ensure that our mainstreamed safety practices are in fact working the way they should by providing an independent verification that we are not ''normalizing'' threats to safety.

    While safety is mainstreamed throughout the Program, technical authority is vested in my Headquarters. Any other Program organization must get my Headquarters' agreement for any changes in technical standards and operational procedures. Sometimes this requires decisions that affect ship operations, which is one reason the Director of the NNPP needs to have a technical engineering background, with career-long experience in naval nuclear propulsion, and the seniority of a four-star admiral. Congress recognized this need and enacted it as a requirement in law.

Q2c. What training and experience do, you require, in your senior managers, and what incentives do you provide such managers?

A2c. Nearly all of my technical staff at Headquarters came to the NNPP right out of college and with science or engineering degrees. They receive NNPP-specific engineering training during their early years with the Program and continue to receive specialized training throughout their careers with us. At the end of their initial obligation, we offer permanent positions to those individuals who in our judgment have the requisite technical capabilities that best embrace our cultural values, such as mainstreaming safety. These are the people that go on to become my senior managers—a great many spending their entire adult lives and careers in the Program.
 Page 158       PREV PAGE       TOP OF DOC

    My section heads, the senior managers who report directly to me, have an average of more than 25 years of Program experience. However, mere longevity is not a requirement: a suitably capable individual with less time in service could become a section head. I select the best-qualified personnel as my senior managers.

    As a performance measure, safety is not tied to incentives. Rather, it is a shared value among all engineers within the NNPP. My engineers won't be promoted to senior positions unless they demonstrate that they have embraced the importance of safety in their work and have ingrained this attitude in their subordinates, including fairly and completely vetting dissenting opinions.

Threats From Minor Problems

Q3. In both Shuttle accidents, NASA failed to appreciate the threat to the vehicle from what seemed a minor problem—O-ring seals that did not seem to work well in cold weather and foam that sometimes struck the Orbiter's thermal protection system.

Q3a. How does your organization deal with similar ''weak signals''?

A3a. In a high-risk environment, there are no guarantees of success, but our record demonstrates the value of hard work in addressing the ''weak signals.'' As an organization, we do not allow weak signals to go unanswered. An important part of our technical effort is working on small problems to prevent bigger problems from occurring. We measure and track minor deficiencies to identify trends. Then we ask the hard questions on even apparently minor issues: What are the facts? How do you know? Who is responsible? Who else knows about the issue and what are they doing about it? What other ships or activities (e.g., the labs or prototypes) could be affected? What is the plan? When will it be completed? Is this within our design, test, and operational experience? What are the expected outcomes? What is the worst that could happen? What are the dissenting opinions? These and other questions like them help us to solve the problem at hand before it gets worse. As an example, I personally read letters (required at least quarterly) from each of the commanding officers of our 82 nuclear-powered warships. I look for these ''weak signals'' in their reports and flag them to cognizant headquarters personnel for resolution through this process. Additionally, my Headquarters and field organizations conduct periodic inspections in the field to determine the effectiveness of the individual activities in identifying, assessing, and resolving such deficiencies.
 Page 159       PREV PAGE       TOP OF DOC

Q3b. How does your organization evaluate problems to determine if they represent recurring failures that require changes in design or processes if they are to be dealt with? Who conducts those evaluations?

A3b. Even minor problems under Headquarters' consideration require formal and disciplined review, together with official action and resolution correspondence signed by the cognizant Headquarters engineers. Any issue that, in our view, could recur and have undesirable consequences is assessed for the need for corrective action by my Headquarters staff. Where my staff concludes that action is warranted, I task the prime contractor laboratories with further assessment and with recommending corrective action. If the issue is time-sensitive, the Naval Nuclear Propulsion Program (NNPP) will immediately issue guidance by naval message to any ships or in writing to any training reactors that may be affected.

Q3c. For recurring problems, does your organization have the capability to analyze the trend to determine if it could contribute to a low-probability, high-consequence accident?

A3c. The Naval Nuclear Propulsion Program (NNPP) conducts extensive self-audits and performs various analyses of trends. Multiple organizations (my Headquarters organization, Nuclear Propulsion Examining Boards, Fleet headquarters, type commanders, naval squadrons, shipyards, and laboratories) are notified when problems arise and can call for further evaluation and correction based on recognition of a trend or precursor event requiring correction. Put simply, recurring problems aren't ''normalized.'' We do everything we can to engineer them out of our system before they become major issues.

 Page 160       PREV PAGE       TOP OF DOC
Q3d. How much certainty would your organization require to take action in a case where your relevant technical expert strongly believed a catastrophe could occur but did not have the engineering evaluations to confirm that judgment—and little or no time to conduct such evaluations?

A3d. To determine the relative importance of individual discrepancies, I rely on my engineering judgment and that of my experienced managers and engineers throughout the Program. If there were a strong belief, even if only by a single individual, those unacceptable consequences are a possibility, the issue would be attacked at: the technical level by my DOE labs and Headquarters experts and then discussed with me. All relevant technical facts would be presented, and an appropriately conservative course, balanced by military necessity, would then be chosen. This would not always mean that the reactor, and therefore the ship, must stand down from operation, but it might require additional operational precautions that suitably offset the situation under consideration. The Director, as a four-star admiral with a career of nuclear experience and a long tenure (the law stipulates eight years), is essential to making this come out right. Engineering is not an exact process—there is no single absolutely correct answer to every problem. The NNPP, as instituted by Admiral Rickover and as it continues to this day, embraces the philosophy that airing dissenting opinions helps invigorate the technical evaluation process and minimize the chance that a technically significant issue is overlooked.

Question submitted by Representative Bart Gordon

Operational and Developmental Safety Structures

Q1. Does it matter in your organization whether a vehicle or product is deemed ''operational'' versus ''experimental/developmental''? Do you have a different safety structure for operational activities versus those that are developmental in nature?
 Page 161       PREV PAGE       TOP OF DOC

A1. Our safety structure and processes are independent of the operational designation of the product. However, the margin of conservatism will be even greater when we are dealing with a developmental system. We test components, subsystems, and then systems (often to the point of failure in tests prior to ships' use), to ensure that unexpected results are minimized in operational warships. We then thoroughly test the ships and crew pier side to confirm the acceptability of the systems and the training of the crew. When I take a ship to sea for the first time, on sea trials in which I directly participate, I confirm that both the propulsion plant and crew are fully capable and ready to join the Fleet. Once a ship is in commission, it is deemed ''operational''—regardless of whether it is the first or the last of a class.

Questions submitted by Representative Nick Lampson

Safety at Every Level

Q1. Admiral Bowman testified that, ''Safety is the responsibility of everyone at every level in the organization,'' a sentiment echoed by Ms. Grubbe in her statement—but in day-to-day program activities, safety is not a primary metric for measuring performance. Safety usually becomes an issue only after it is clearly seen to be absent. What specific actions does your organization take to maintain the focus on safety when the pressures to achieve organizational goals inevitably build?

A1. Safety is an overarching organizational goal. We recognize that the ability of the Navy to operate nuclear-powered warships in over 150 ports of call in more than 50 countries around the world is based on the trust we have earned and maintained by safely steaming over 129 million miles. If we do not deliver and maintain safe naval nuclear propulsion plants, we have failed our crews, our Navy, and our country. Everyone in the Naval Nuclear Propulsion Program (NNPP) understands this. We all understand (and are trained in this from our first day in the NNPP) that the only acceptable answer is the technically correct solution. We also recognize that no technology is risk-free. We benchmark actions against requirements and past practices, require that a design or change be proven technically correct, and identify any alternatives. If the only technically safe acceptable action is one that affects cost and schedule to an extent that cannot be accommodated within available resources or schedule, we slow the schedule and/or add the additional resources.
 Page 162       PREV PAGE       TOP OF DOC

    Additionally, the very fabric of my Headquarters organization ensures that safety is mainstreamed for the long haul. Headquarters personnel are handpicked and have a common broad heritage of technical Program training and experience that permit the necessary esprit de corps and shared values. These factors (together with the independence of our technical authority from others in the Navy who are primarily charged with ''cost, schedule, and mission'') permit us to provide effective direction and oversight. Safety is not just a way to measure performance: it's the result of a process that must be followed from start to finish if we are to achieve the desired result.

Technical Authority and Safety Assurance

Q2. In your organization, do you have units performing the functions of an independent technical authority and office of safety assurance? How do they interact within your organization? If you don't, why not?

A2. In my DOE ''hat,'' my Headquarters is the absolute technical authority for all naval reactor plants. Therefore, any other organization must get my Headquarters' agreement for any changes in technical standards and operational procedures. Sometimes this requires decisions that affect ship operations, which is one reason the director of the Naval Nuclear Propulsion Program (NNPP) needs the seniority of a four-star admiral. Congress recognized this need and enacted it as a requirement in law.

    I don't separate technical authority and safety assurance. They are part and parcel of the same process. For the Navy, my organization is responsible for the engineering and safety aspects relating to nuclear power. The Fleet operates the nuclear-powered warships in accordance with safe operating procedures my organization provides them. In the NNPP, the same staff that provides engineering and safety support also provides operational oversight (as opposed to the Fleet's operational control). Safety is the responsibility of everyone at every level of the Program. In other words, safety is mainstreamed. It is not a responsibility unique to a segregated safety department that then attempts to impose its oversight on the rest of the organization. This is the only way safety can be ensured effectively, since no separate office of safety can have the depth of technical knowledge and personnel resources to cover an entire, complex technical program in the detail necessary to fulfill a safety responsibility.
 Page 163       PREV PAGE       TOP OF DOC

    Although the various elements of the Program (such as shipyards and the Fleet) do not have a separate reactor safety department, I do have a small group of people responsible for reactor plant safety analysis. They provide policy oversight as well as most of the liaison with other safety organizations (such as the Nuclear Regulatory Commission) to help ensure that we are using best practices. They also maintain the documentation of procedures and upkeep of the modeling codes used in our safety analyses. As full-time safety experts, they provide our corporate memory of what the past problems were, what we have to do to maintain a consistent safety approach across all projects, and what we need to follow in civilian reactor safety practices. By providing an independent verification that we are not ''normalizing'' threats to safety, each additional group involved in a technical review also ensures that our mainstreamed safety practices are in fact working the way they should.

Questions submitted by Representative Sheila Jackson Lee

Safety Training and Awareness

Q1. How is safety training done in your organization? How is safety awareness maintained in your organization? Please describe the kinds of training materials you use.

A1. Allow me to break my answer into elements dealing with my Headquarters and the U.S. Navy Fleet.

    Safety awareness is built into every part of our work, including our extensive training programs. Thorough training minimizes problems, results in quick and efficient responses to issues, and helps ensure safety. At my Headquarters, I select the best graduate engineers I can find, with the highest integrity and the willingness to accept complete responsibility for every aspect of nuclear-power operations. After I hire them, the training they need to be successful begins immediately. All members of my technical staff undergo a technical indoctrination course during their first several months at Headquarters. Next, they spend two weeks at one of our training reactors (prototypes), learning about the operation of the reactor and observing and participating in the training our Fleet sailors are undergoing. This involves an actual, operating reactor plant, not a simulation or a PowerPoint presentation—and it is an important experience. It gives them an understanding that the work they do affects the lives of the sailors directly, while they perform the Navy's vital national defense role. This direct experience helps reinforce the tenet that the components and systems we provide must perform when needed.
 Page 164       PREV PAGE       TOP OF DOC

    Shortly after our new people return from the training reactor, they spend 6 months in residence at one of our DOE laboratories, completing an intensive, graduate-level course in nuclear engineering. Once that course is complete, they spend three weeks at a nuclear-capable shipyard, observing production work and work controls. Finally, they return to Headquarters and are assigned to work in one of our various technical jobs. They then attend a six-month series of seminars on a wide range of technical and regulatory matters, led by the most experienced members of my staff. Each of these training experiences is saturated with the principles of reactor safety through high quality assurance of plant material, conservative design, and verbatim adherence to procedures.

    At Headquarters, there is a continual emphasis on professional development. We typically provide training courses that are open to the entire staff each month on various topics, technical and non-technical. In particular, we have many interactive training sessions on lessons we've learned—mistakes that we, or others, have made—in order to prevent similar mistakes in the future. These sessions teach both the specific issues and the right questions to ask.

    Throughout their careers, the members of my staff are continually exposed to the end product, spending time on the waterfront, at the shipyards, in the laboratories, at the vendor sites, or interacting directly with the Fleet. In addition, the constant interaction among Headquarters personnel provides me with an arsenal of individuals who, though charged with responsibilities in specific areas, are capable and knowledgeable of overarching Program interests and are expected to act accordingly. Every one of these activities and perspectives emphasizes the vital role of safety.
 Page 165       PREV PAGE       TOP OF DOC

    My responsibilities also include training the operators of nuclear-powered warships. I require both officer and enlisted operators to undergo 6 months of formal academic instruction in nuclear propulsion theory and technology, followed by 24 weeks of hands-on operational and casualty training at an operating prototype or moored training ship (MTS). Even after completing this training and qualification as an operator at a prototype or MTS, personnel must completely requalify (including familiarization steps and watch standing under instruction) on the ship to which they are assigned before they are permitted to man a propulsion plant watch station on that ship. For both officer and enlisted nuclear-trained personnel, there is continuing training and required periodic requalification in the Fleet throughout their careers. My prime contractor personnel who operate the prototype reactors get equivalent training.

    For the officers, a significant milestone in their career path is qualification as an engineer officer. This signifies an officer has obtained sufficient knowledge to supervise safe, effective maintenance and operation of the ship's propulsion plant. When the commanding officer (CO) is satisfied with a junior officer's knowledge level, he recommends him or her to take the Engineer's Examination. The Engineer's Examination is administered at my Headquarters and consists of a written examination (about five hours long) and at least two detailed technical interviews. I personally approve qualification of each engineer officer. The best of these junior officers are subsequently assigned to submarines as the engineer officer or to aircraft carriers as a principal assistant to the reactor officer.

    The commanding officer (CO) is charged with the absolute responsibility for all aspects of ship operation, including safe and effective operation of the reactors. Personnel who become COs of nuclear-powered submarines are all Engineering Officer of the Watch qualified with about 17 years of experience in the Navy. They have qualified as an engineer officer on a nuclear-powered submarine, have served as an executive officer and have successfully completed an intense, technical/safety course during a three-month Prospective Commanding Officer School at Naval Nuclear Propulsion Program Headquarters.
 Page 166       PREV PAGE       TOP OF DOC

    The path for becoming a CO of a nuclear-powered aircraft carrier is similar. Personnel who become COs of a nuclear-powered aircraft carriers are Engineering Officer of the Watch qualified officers with over 20 years of experience in the Navy. They have completed a three-month Prospective Commanding Officer School at Naval Nuclear Propulsion Program Headquarters and have served as an executive officer on a nuclear-powered aircraft carrier.

    Every segment of every training experience for both Headquarters and Fleet personnel emphasizes the absolute need for ''safety first.'' Lessons learned from historical problems are discussed in detail. The conservative design of our plants and the need for strict adherence to written, formal procedure is taught and tested. There is no confusion regarding our philosophy that safety comes first.

Safety Audit Process

Q2. Please describe your safety audit process. What is its scope? How often is it done? Who does it? To whom, are the results reported? What is done with the results?

A2. My safety inspection process is extensive. Inspection and corrective action follow-up are essential aspects of being the technical authority for the Program and its current 103 reactor plants. Headquarters personnel at the most senior level personally evaluate performance and compliance in the field. Headquarters staff conducts regular inspections of work, safety, environmental and radiological controls. Additionally, field office personnel routinely conduct audits and inspections as part of their responsibility to monitor the work of Program laboratories, prototypes, the Fleet, shipyards, and prime contractors. The DOE laboratories, the nuclear-capable shipyards, and the Fleet also conduct self-audits, assessments, and inspections at almost every organizational level. These reviews are then critiqued by Headquarters, field office, and senior Fleet personnel (as appropriate) and then reported to me. An important part of these reviews is evaluating the activity's ability to look critically at itself—in keeping with the principle that each activity must identify, diagnose, and resolve its own problems when outside inspectors are not present to do so. This effort, along with other requirements, makes clear that day-to-day excellent performance must be the goal (and the norm), not merely ''peaking'' for an annual audit or inspection. In fact, my evaluation teams make ''inadequate self-assessment'' a finding of its own, when appropriate. My teams will then closely follow the efforts of activity management to improve this crucial ability.
 Page 167       PREV PAGE       TOP OF DOC

    Headquarters evaluation teams always include the technical-requirements owners for the particular areas being assessed. This ensures that the team has an indepth understanding of not only the requirement, but also its significance, letting the evaluation team identify issues and trends that might not be discerned if auditing were done solely by checklist. My field offices, largely composed of qualified personnel drawn from the Fleet and from Headquarters, are located at all major Program sites and at each Navy Fleet concentration area.

    The Naval Nuclear Propulsion Program (NNPP) continually evaluates operational information for trends and lessons learned. For example, my staff annually assesses—and I personally review plant-aging concerns to ensure that trends in equipment corrosion, wear, and maintenance performance are acceptable.

    To meet regulatory responsibilities for oversight of nuclear-powered warship operations, the NNPP relies in part on the Nuclear Propulsion Examining Board (NPEB). The NPEB, comprising nuclear-trained officers who have served as commanding officers or engineer officers of nuclear-powered warships, performs annual Operational Reactor Safeguards Examinations (ORSE) and inspects the material condition of each plant in the Fleet. During an ORSE, the NPEB reviews documentation of normal operation (including operational, maintenance, and crew training records); observes and assesses current plant operations (both normal and in response to casualty drills); and reviews any off-normal events that may have occurred during the preceding year. The NPEB reports directly to me in parallel with the command authority for that ship (the Fleet Commander). As discussed above, the ship's day-to-day performance and ability to self-assess are emphasized through evaluation of records, training, evolutions, lessons learned, and overall plant conditions. If ships do not meet standards, they would have their authorization to operate removed until they are upgraded, reexamined, and deemed satisfactory.
 Page 168       PREV PAGE       TOP OF DOC

Dissenting Opinions

Q3. In your organization, is there a channel specifically for dissenting opinions?

Q3a. How do you generate a dissenting opinion in a case where a strong technical consensus exists? What prevents that from becoming an empty exercise?

Q3b. How would a dissenting technical opinion be evaluated?

A3a,b. There are several channels through which individuals can air dissenting opinions. At my prime contractor laboratories, any dissenting opinion must be documented, along with a discussion of the reason why the majority opinion is being recommended. (In some cases the process results in the formerly ''dissenting'' opinion becoming the recommended approach.) In the case of a dissenting opinion that could affect safety, further analysis and discussion are required to attempt to reach a satisfactory resolution. If the dissenter is not satisfied, the recommended action must be agreed to by the laboratory general manager, and the dissenting opinion is documented in the recommendation to me with an explanation as to why it was not accepted. This allows my staff and me to see that dissenting opinion firsthand as we evaluate the recommendation.

    Similarly, within Headquarters, if a dissenting opinion is not resolved, the issue must be cleared with me. When I discuss a complex issue, I frequently ask if there were any dissenting opinions to ensure that personnel have the opportunity to air any remaining concerns. If I am satisfied that I have enough data to make an informed decision, I will do so. In any other case, I will request additional information or the involvement of additional personnel to help me reach the correct technical decision.
 Page 169       PREV PAGE       TOP OF DOC

Q3c. In cases where dissenting opinions question the safety of reactor operations for a ship (or class of ships) deployed and operating, are reactors immediately shut down or is a risk assessment performed to determine whether operations can continue?

A3c. Nuclear-powered warships are designed to survive under battle conditions. The inherent conservatism and redundancy built into these ships, along with the extensive training provided every operator, make it highly unlikely that any unexpected problem will pose an immediate threat to public or environmental safety. If such an unlikely problem ever were to occur, we would balance the multiple safety responsibilities of reactor, crew, ship, and public safety. Where there is a reactor safety concern, we immediately determine whether the problem is likely to occur, the potential consequences, its potential impact on ship operations and safety, and any alternatives that may mitigate the problem. Since our designs include significant redundancy, shutting down all or part of the reactor plant system of concern might still allow safe operation of the reactor. If necessary, the reactor would be shut down and the problem repaired, even at sea.

Q3d. While dissenting opinion may be welcomed in the Naval Reactors program, how do you demonstrate to new junior officers that expressing such opinions will not create problems for their careers in the Navy outside the program—particularly if that opinion is left unsupported by later analysis?

A3d. In the Fleet, dissenting opinions are raised through the chain of command. Dissenting opinions are not just welcomed, they are highly valued. For the Fleet, asking questions and raising concerns is highlighted during training for junior officers and enlisted personnel from their first day in the Program. In fact, we teach and require forceful backup. If expected indications and conditions are not observed during an evaluation, other members of the watch team are required to point that out. There cannot be any fear of reprisal for raising concerns or issues. The best proof of this is our record. I can't think of a single example when a junior officer brought up a safety issue and it created a problem for that officer's career. On the contrary, if an officer of any rank is aware of a safety issue and doesn't bring it up, that officer would be held accountable.
 Page 170       PREV PAGE       TOP OF DOC

ANSWERS TO POST-HEARING QUESTIONS

Responses by Rear Admiral Paul E. Sullivan, Deputy Commander, Ship Design, Integration and Engineering, Naval Sea Systems Command, U.S. Navy

Questions submitted by Representative Ralph M. Hall

NASA Implementation of Investigation Board Recommendations; SUBSAFE Program Measures

Q1. How will we know that NASA has implemented the Columbia Accident Investigation Board (CAIB) recommendations?

A1. Respectfully, this question may be best posed to the CAIB, or similar independent board. As a practical matter, it is beyond the purview of the Naval Sea Systems Command (NAVSEA) to monitor NASA's implementation of the CAIB recommendations, and therefore, we are unable to offer a substantive response in this area. However, as noted in my testimony, NAVSEA is a continuing participant in the NASA/Navy Benchmarking Exchange. To that extent, we are engaged in the process of sharing information with NASA on all aspects of the Submarine Safety (SUBSAFE) Program, so that NASA itself can evaluate the potential adaptability of any part of the SUBSAFE Program to the NASA Safety Program.

Q1a. What measures do you use in your organization to determine that your safety mechanisms are working?

 Page 171       PREV PAGE       TOP OF DOC
A1a. The Navy uses a tiered approach to ensure Submarine Safety (SUBSAFE) Program safety mechanisms are working. The Naval Sea Systems Command Submarine Safety and Quality Assurance Office (NAVSEA 07Q) has overall responsibility for overseeing the SUBSAFE Program and verifying compliance with its requirements.

 The purpose of the SUBSAFE Program is to provide maximum reasonable assurance of a submarine's watertight integrity and its ability to recover from a flooding casualty. It is important to note that the SUBSAFE Program does not spread or dilute its focus beyond this purpose. The technical and administrative requirements of the SUBSAFE Program are applied specifically to a carefully defined set of ship systems and components that are critical to the safety of the submarine. The tenets of the SUBSAFE Program are invoked in a submarine's initial design, through construction and initial SUBSAFE Certification, and throughout its service life.

 The first tier of the SUBSAFE Program is a Quality Program at each activity that performs SUBSAFE work. Each facility is required to have a quality system such as that defined by MIL–Q–9858 (Quality Program Requirements) or ISO 9000, etc. The quality assurance organization at each facility plays a key role in validating compliance with SUBSAFE Program requirements and in compiling the objective quality evidence necessary to support SUBSAFE certification. A local SUBSAFE Program Director (SSPD) provides oversight for work at each facility and is responsible for independently verifying compliance with the SUBSAFE Manual requirements. At private contractor shipbuilding facilities, a U.S. Navy Supervisor of Shipbuilding, Conversion and Repair (SUPSHIP) organization is also assigned to monitor compliance with SUBSAFE work and process requirements.

 The second tier is the SUBSAFE audit program. NAVSEA 07Q audits the policies, procedures and practices at each facility as well as the effectiveness of the oversight provided by the local SSPD and SUPSHIP. There are two types of audits: (1) the Functional Audit, which evaluates the organization's programs and processes for compliance with SUBSAFE requirements; and (2) the Ship Certification Audit, which evaluates the work and processes used to overhaul or construct each individual submarine for compliance with SUBSAFE requirements prior to SUBSAFE certification.
 Page 172       PREV PAGE       TOP OF DOC

 The final tier is program oversight. Several organizations provide forums for program evaluation, process improvement, and senior level oversight. The SUBSAFE Working Group, chaired by the Director of the Submarine Safety and Quality Assurance Office (NAVSEA 07Q), is comprised of NAVSEA, field activity and contractor SSPDs and meets semi-annually to review program status and discuss recommendations for improvement. The SUBSAFE Steering Task Group, chaired by the NAVSEA Deputy Commander for Undersea Warfare (NAVSEA 07), reviews program progress and provides policy guidance for the SUBSAFE Program. The SUBSAFE Oversight Committee, chaired by the NAVSEA Vice Commander (NAVSEA 09), provides independent command-level oversight of the SUBSAFE Program to ensure the purpose and intent of the SUBSAFE Program are being met.

Separation Between Operational Aspects of Program and Organizations Providing Engineering and Safety Support

Q2. The CAIB recommends a separation between the operational aspects of the Shuttle program and the organizations providing engineering and safety support. Based on your experience:

Q2a. Do you agree with this as a principle for managing your program?

A2a. Yes. The separation of Program Management, the Technical Authority, and the Safety Organization has proven an effective approach for the Navy's Submarine Safety (SUBSAFE) Program during the last 40 years.

 Page 173       PREV PAGE       TOP OF DOC
Q2b. Where do you place the boundaries between these three program elements in your program and how do they interact?

A2b. The three groups—Program Management, Technical Authority, and Safety Organization—work together to discuss issues and reach agreement on final decisions. However, each has its own authority and responsibility:

 The Program Manager has overall authority and responsibility for the success of his program (Quality, Cost, Schedule). However, the Program Manager is not a technical authority and may not make technical decisions unilaterally. The Program Manager has the authority to choose among the technically acceptable solutions provided by the Technical Authority.

 The Technical Authority bears ultimate responsibility for the adequacy of the technical solutions provided to the Program Manager.

 The Safety Organization has the authority and responsibility to ensure that compliance with SUBSAFE Program requirements is achieved. The Safety Organization is staffed with engineers giving it the acumen to understand the technical issues and providing it with the credentials to challenge the Technical Authority and the Program Manager when appropriate.

Q2c. What training and experience do you require in your senior managers, and what incentives do you provide such managers?

A2c. Senior managers are hand picked based on detailed submarine experience. Senior managers receive continuous training on safety and participate in the audit process. Our senior managers, military and civilian, are required to achieve a broad scope of experience and formal training as they progress in their career. Both the Navy and the Office of Personnel Management establish supervisory and management training programs to enhance career paths and assist in developing the knowledge, skills and abilities necessary to achieve success in the senior management levels of the Naval Sea Systems Command (NAVSEA) and the Navy.
 Page 174       PREV PAGE       TOP OF DOC

Recognition and Analysis of Safety Threats

Q3. In both Shuttle accidents, NASA failed to appreciate the threat to the vehicle from what seemed a minor problem—O-ring seals that did not seem to work well in cold weather and foam that sometimes struck the Orbiter's thermal protection system.

Q3a. How does your organization deal with similar ''weak signals''?

A3a. Dealing with and resolving ''weak signals'' before they become major problems, or even disasters, is very difficult for a large organization. It requires constant vigilance. These signals get missed when people become complacent and accept seemingly minor unsatisfactory conditions. As I noted in my testimony, our review of the Submarine Safety (SUBSAFE) Program during the 1985–86 timeframe noted an increasing number of incidents and breakdowns that raised concerns about the quality of SUBSAFE work and thus, the level of discipline with which that work was being performed. As a result, we established additional program requirements and actions to improve the understanding of SUBSAFE Program requirements, to provide increased emphasis on oversight, and to find problems and fix them. They are still in place today, but personal vigilance is still required as the potential exists for complacency to creep into any organization. For example, less than two years ago, we nearly lost the USS DOLPHIN (AGSS 555) to a flooding casualty. While it was not a SUBSAFE issue, the casualty was due, in part, to allowing a less than acceptable condition to exist that made it easier for water to enter the submarine when transiting on the surface. Only the skills and exceptional action on the part of the well-trained crew prevented disaster. Although crew selection and training aren't part of SUBSAFE, the Navy gives them the appropriate level of attention to ensure the crews are highly trained, competent and motivated. Corrective and other follow-up actions are still in progress from the incident.
 Page 175       PREV PAGE       TOP OF DOC

Q3b. How does your organization evaluate problems to determine if they represent recurring failures that require changes in design or processes if they are to be dealt with? Who conducts those evaluations?

A3b. We have several formal programs for evaluating failures and conditions that may require program or design changes. Periodic inspections and tests are required to be performed to validate that the condition of the submarine and its critical components support continued unrestricted operation. The results of these inspections and tests are tracked over time and across submarines to ensure conditions are not degrading. During component major maintenance or overhaul, the conditions found must be documented and reported for technical evaluation, again, to determine if any unexpected degradation may be occurring and to maintain a history, that is used to evaluate the need for maintenance program or design changes. Audits of facilities and submarines are conducted to evaluate performance and acceptability of a submarine for SUBSAFE certification. During the service life of a submarine and facility, problems or failures may occur that are outside the scope of the formal inspection and audit programs. These are required to be formally investigated and reported to Naval Sea Systems Command (NAVSEA) as Trouble Reports. The results of audits and Trouble Reports are tracked, maintained and trended over time, and are used to evaluate the health of program and determine if changes are required or appropriate to consider. Responsibility for these programs, including implementation of changes, is assigned to specific offices or organizations within NAVSEA. However, recommendations for significant changes in technical requirements or program procedures are reviewed and concurred with by members of the Technical Authority, Program Manager and Safety Offices.

Q3c. For recurring problems, does your organization have the capability to analyze the trend to determine if it could contribute to a low-probability, high-consequence accident?
 Page 176       PREV PAGE       TOP OF DOC

A3c. Trending and analysis are an integral part of the Submarine Safety (SUBSAFE) Program and are used to guide future actions. In addition, an annual SUBSAFE Program assessment is prepared with input from SUBSAFE Working Group members, and is briefed to the SUBSAFE Steering Task Group and the SUBSAFE Oversight Committee. Hazard analyses of specific conditions or component or system operations are conducted when warranted to assess risk and potential consequence, and to determine what actions must be taken to mitigate risk if the condition is to be allowed to exist.

Q3d. How much certainty would your organization require to take action in a case where your relevant technical expert strongly believed a catastrophe could occur but did not have the engineering evaluations to confirm that judgment—and little or no time to conduct such evaluations?

A3d. When we identify a significant technical/safety concern, the normal approach is to suspend work, testing, or ship deployment until the relevant engineering evaluations are obtained. For a significant and imminent wartime condition or situation, a risk assessment would be presented to the Fleet Type Commander for decision.

Questions submitted by Representative Bart Gordon

Operational vs. Developmental Safety Structure

Q1. Does it matter in your organization whether a vehicle or product is deemed ''operational'' versus ''experimental/developmental''? Do you have a different safety structure for operational activities versus those that are developmental in nature?
 Page 177       PREV PAGE       TOP OF DOC

A1. No, Submarine Safety (SUBSAFE) Program requirements are invoked in design contracts and construction contracts, including those for experimental or developmental items placed on our submarines. The SUBSAFE Program structure is the same whether an item is operational or developmental.

Dealing with Downsizing and Aging Workforce Challenges

Q2. You mentioned in your written testimony the challenge you faced in 1998 with downsizing and an aging workforce. Please describe the magnitude of the problem and the steps you took to maintain the integrity of the SUBSAFE Program in the face of this challenge? How are you dealing with these problems?

A2. Over the past decade, the Naval Sea Systems Command (NAVSEA) has undergone a significant loss of experience and depth of knowledge due to downsizing and an aging workforce. The size of the independent technical authority staff at NAVSEA headquarters has been reduced from 1300–1400 people in 1988 to approximately 300 today. Beginning in 1995, NAVSEA undertook an approach to provide continued support of critical defense technologies with a smaller Headquarters workforce. This was accomplished through the development of a war-fighting system engineering hierarchy that defined the necessary engineering capability requirements. NAVSEA began to refocus our workforce on core equities or competencies:

 Setting technical standards and policies,

 Certifying and validating delivered products, and
 Page 178       PREV PAGE       TOP OF DOC

 Providing a vision for the future, i.e., technology infusion and evolution.

    NAVSEA also initiated a recruitment program to hire engineering professionals, primarily in our field activities, but headquarters engineering staff continued to decrease.

    As a result of the noted reduction in NAVSEA headquarters independent technical authority staff over the past 15 years, we have remained continuously engaged in balancing the need to maintain our culture of safety while becoming more efficient.

    NAVSEA currently is contemplating modest increases in staffing in the independent technical authority and SUBSAFE and quality assurance organizations to manage the increasing SUBSAFE workload in design, construction and maintenance, and to bolster and renew the workforce as our older experts retire.

Questions submitted by Representative Nick Lampson

Specific Actions to Maintain Focus on Safety

Q1. Admiral Bowman testified that, ''Safety is the responsibility of everyone at every level in the organization,'' a sentiment echoed by Ms. Grubbe in her statement—but in day-to-day program activities, safety is not a primary metric for measuring performance. Safety usually becomes an issue only after it is clearly seen to be absent. What specific actions does your organization take to maintain the focus on safety when the pressures to achieve organizational goals inevitably build?
 Page 179       PREV PAGE       TOP OF DOC

A1. First, Admiral Bowman and Ms. Grubbe are correct. The culture of safety must be instinctive. Training, instructions and written performance requirements are not enough to ensure safety. In the final analysis, each person who operates, designs, constructs, maintains or tests submarines must have the culture of safety as part of his or her basic work ethic. This culture is instilled in our sailors from the first day of submarine basic training, and in the civilian workforce by continuous grooming from their leaders. It is reinforced for all by periodic mandatory Submarine Safety (SUBSAFE) training.

    Second, we cannot afford for safety to become ''absent'' and we work constantly to ensure that does not happen. We do that by keeping the requirements of our Submarine Safety (SUBSAFE) Program visible at all levels. Critical safety requirements and implementation methods are clearly defined. These safety requirements are protected regardless of pressures. Program Managers cannot tailor them or trade them against other technical or programmatic variables. The Technical Authority and the Safety Office do not compromise the technical or safety requirements to relieve a Program Manager's schedule or cost pressures. This separation of Program Management, the Technical Authority and the Safety Office has proven to be an effective organizational structure in support of Submarine Safety. Our routine SUBSAFE training includes lessons learned with strong emotional ties. Our SUBSAFE audit programs focus on technical and safety compliance and provide additional visibility to the importance of safety.

    Finally, for the U.S. Navy Submarine Force, safety IS an organizational goal. It is tracked carefully and reviewed frequently by senior management, and corrective action is rapid.

 Page 180       PREV PAGE       TOP OF DOC
Lessons from the Challenger Accident

Q2. What lessons does the Navy take away from its review of the Challenger accident?

A2. As noted in my testimony, the Challenger accident occurred at the same time the Naval Sea Systems Command (NAVSEA) was conducting an in-depth review of the Submarine Safety (SUBSAFE) Program. The Challenger accident gave added impetus to, and helped focus our effort in, several critical areas: disciplined compliance with requirements, thoroughness and openness of technical evaluations, and formality of our readiness for sea certification process.

    As a result of our review, we have: maintained increased visibility on mandatory and disciplined compliance with requirements and standards; upgraded our engineering review system (technical authority) to ensure responsibilities and expectations for thorough engineering reviews with discipline and integrity are clear; and established a safety and quality assurance organization with the authority and organizational freedom to function without external pressure. We use annual training with strong, emotional lessons from past failures to ensure that all members of the Navy's Submarine community fully understand the need for constant vigilance in all SUBSAFE matters.

NASA/Navy Benchmarking Exchange

Q3. Please provide your impression of the NASA/Navy Benchmarking Exchange (NNBE) undertaken in August of 2002. What specific plans, if any, are there for continuing this interaction? What changes in this interaction do you anticipate because of the Columbia accident?
 Page 181       PREV PAGE       TOP OF DOC

A3. The NNBE has been a valuable process for both NASA and the submarine Navy. Two reports outlining the results of the NNBE to date have been issued, the first in December 2002 and the second in July 2003. After the loss of Columbia, NNBE activity was temporarily placed on hold to allow NASA to focus on the accident investigation. Specific exchanges under the NNBE process since the Columbia accident have included Navy presentations to the NASA Engineering and Safety Center Management Team and to the SUBSAFE Colloquium held at NASA headquarters in November 2003. On December 2, 2003, both parties signed a Memorandum of Agreement for participation in engineering investigations and analyses. A Memorandum of Agreement for participation in Functional Audits is currently being developed and is scheduled to be signed in early 2004. In the NNBE forum, we have initiated exchanges regarding processes for specification control, waivers to requirements, life cycle extension, software safety and human systems integration. More detailed discussions on these common processes are planned in 2004. We also expect benefits from planned collaboration of technical experts in welding, materials, life support and other areas of special interest.

Questions submitted by Representative Sheila Jackson Lee

Safety Training

Q1. How is safety training done in your organization? How is safety awareness maintained in your organization? Please describe the kinds of training materials you use.

A1. The Submarine Safety (SUBSAFE) Manual requires that organizations performing SUBSAFE work establish and maintain procedures for identifying training needs and provide for the training of all personnel performing activities affecting SUBSAFE quality. This requirement includes periodic SUBSAFE Awareness training. During Functional Audits of these organizations we evaluate the adequacy of training programs and the level of knowledge of personnel performing SUBSAFE work. Our SUBSAFE requirements are generally integrated into specific technical process or work-skill training. This training and its periodicity are established and provided by each organization to meet its needs for the work it performs.
 Page 182       PREV PAGE       TOP OF DOC

    One of the keys to SUBSAFE Program awareness is the fact that many of the senior Navy and civilian managers and personnel have either served aboard or temporarily embarked on submarines during their careers. This ''underway'' experience, in addition to regular visits to submarines undergoing construction, repair or maintenance, fosters a heightened level of understanding in program management that is important to maintaining the requisite level of vigilance and visibility for SUBSAFE matters.

    SUBSAFE Program Awareness Training is usually given on an annual basis. It consists of a review of requirements, a brief history of the SUBSAFE Program and a discussion of recent relevant program events, e.g., changes, problems, and failures (and their causes). SUBSAFE training beyond the annual awareness training takes a variety of forms. Web-based training is becoming the most common. This is supported by classroom lecture and discussion. Skills-training takes the same form and is supplemented by practical exercises and on-the-job training. By combining personal experience, training and our requirements in this way, we keep the SUBSAFE Program and its requirements visible to and fresh in the minds of the Navy's Submarine community personnel, ashore and afloat.

Safety Audit Process

Q2. Please describe your safety audit process. What is its scope? How often is it done? Who does it? To whom are the results reported? What is done with the results?

A2. There are two primary types of audits in the Submarine Safety (SUBSAFE) Program: Certification Audits and Functional Audits.
 Page 183       PREV PAGE       TOP OF DOC

    In a SUBSAFE Certification Audit, we look at the Objective Quality Evidence associated with an individual submarine to ensure that the material condition of that particular submarine is satisfactory for sea trials and unrestricted operations. These audits are performed at the completion of new construction and at the end of major depot maintenance periods. They cover a planned sample of specific aspects of all SUBSAFE work performed, including inspection of a sample of installed equipment. The results and resolution of deficiencies identified during such audits become one element of final Naval Sea Systems Command (NAVSEA) approval for sea trials and subsequent unrestricted operations.

    In a SUBSAFE Functional Audit, we periodically—either annually or bi-annually depending on the scope of work performed—review the policies, procedures, and practices used by each organization, including contractors, that performs SUBSAFE work. The purpose is to ensure that those policies, procedures and practices comply with SUBSAFE requirements, are healthy, and are capable of producing certifiable hardware or design products. This audit also includes surveillance of actual work in progress. Organizations audited include public and private shipyards, engineering offices, the Fleet, and NAVSEA headquarters.

    Audits are performed by a team of 12 to 25 auditors, led by the NAVSEA Submarine Safety and Quality Assurance Office (NAVSEA 07Q). Auditors are experienced subject matter experts drawn from NAVSEA and our field organizations that perform SUBSAFE work, e.g., shipyards, engineering offices, etc. To ensure consistent and thorough coverage of the areas of concern, audits are conducted using formal audit plans or guides. In functional audits, guides are supplemented with pre-audit analysis reports,

 Page 184       PREV PAGE       TOP OF DOC
    that assess the prior health of the organization and point out past problems so that the effectiveness of corrective actions can be evaluated. The results of audits are formally documented and reported to the organization and to senior NAVSEA management. They are also provided to other SUBSAFE organizations for lessons learned purposes. Each deficiency must be corrected and the root cause of the deficiency identified. The corrective action and root cause is formally reported back to NAVSEA along with applicable objective quality evidence for evaluation and approval. Further, each deficiency is tracked by NAVSEA 07Q to maintain its visibility and to ensure it is satisfactorily resolved. Annually, an analysis report of all audit results, and other reported problems, is prepared to support a senior management assessment of the health of the SUBSAFE Program.

    Functional Audits are also used to identify areas in which an organization can initiate process improvements. Although a process or practice may be in compliance with SUBSAFE requirements, auditors may make recommendations, which offer the opportunity for significant improvement in the effectiveness of the process or practice. These recommendations, categorized as Operational Improvements, are documented in the report and tracked until the organization provides its evaluation and any planned actions.

    In addition to the audits performed by NAVSEA, our shipyards, field organizations and the Fleet are required to conduct internal (or self) audits of their policies, procedures, and practices and of the work they perform.

ANSWERS TO POST-HEARING QUESTIONS

Responses by Ray F. Johnson, Vice President, Space Launch Operations, The Aerospace Corporation
 Page 185       PREV PAGE       TOP OF DOC

    Note of Clarification: Throughout the discussions of CAIB investigations, the term ''safety'' is used relative to establishing NASA flight readiness. Since our DOD launches are not human rated, we use the term ''mission assurance'' in essentially an equivalent meaning. For DOD launches, the term 'flight safety'' is primarily associated with the risks to the uninvolved public due to catastrophic failure rather than mission success itself.

Questions submitted by Representative Ralph M. Hall

Q1. How will we know that NASA has implemented the Columbia Accident Investigation Board (CAIB) recommendations? What measures do you use in your organization to determine that your safety mechanisms are working?

A1. Following the Space Launch Broad Area Review in 1999, the Air Force developed an execution plan for each of the Board's recommendations. Periodically since then the BAR has reconvened and reviewed progress against their initial recommendations. We would recommend a similar approach to track NASA's implementation of the CAIB recommendations.

    Our mission success record is the best gauge of our mission assurance processes. Since the Broad Area Review, the renewed rigor in mission assurance has yielded a 100 percent success rate. We have also measured our success rate against other launch organizations (i.e., commercial, foreign) and found that our processes have consistently resulted in a higher level of success.

Q2. The CAIB recommends a separation between the operational aspects of the Shuttle program and the organizations providing engineering and safety support. Based on your experience:
 Page 186       PREV PAGE       TOP OF DOC

Q2a. Do you agree with this as a principle for managing your program?

A2a. Our organization and the value of our contributions comes from the degree of independence we are afforded by our Air Force sponsors. Our launch programs do not employ separate organizations for safety, engineering and operations, but rather a triumvirate of program participants (Air Force, contractor, Aerospace) with individual responsibilities. Aerospace is the program participant with responsibility for the independent mission assurance assessment.

Q2b. Where do you place the boundaries between these three program elements in your program and how do they interact?

A2b. Our independent mission assurance role uses a cadre of engineering talent with skills comparable to that of the contractor who has the primary engineering and operational responsibility. Aerospace provides a final launch readiness verification to the SMC Commander that is independent from the contractor's assessment. The SMC Commander, in his role as ultimate flight worthiness certification authority, employs an additional oversight review team to ensure that the program participants properly execute their responsibilities.

    Flight safety is the responsibility of the Range Safety organization at the launch sites. Range Safety is not only completely separate from the launch system program, it is under a separate Air Force organization. Range Safety's primary role is to protect resources, personnel, and general public from the hazards of launch.

Q2c. What training and experience do you require in your senior managers, and what incentives do you provide such managers?
 Page 187       PREV PAGE       TOP OF DOC

A2c. We are essentially an engineering and scientific organization and our role in space launch does not typically require formal certification training of our personnel. Our engineering staff is made up of career professionals who typically have many years experience either in industry or academia. Many of these are the foremost specialists in their fields. Our senior managers (up to and including our president) all have strong technical backgrounds as well. Our field site personnel, who are associated with vehicle operations and exposed to hazardous conditions, are certified as required by the local safety organizations. We are incentivized by our accountability to mission success as well as formal recognition through a corporate awards program.

Q3. In both Shuttle accidents, NASA failed to appreciate the threat to the vehicle from what seemed a minor problem—O-ring seals that did not seem to work well in cold weather and foam that sometimes struck the Orbiter's thermal protection system.

Q3a. How does your organization deal with similar ''weak signals''?

A3a. We apply rigor in defining system performance specifications and a continuous oversight presence in identifying any out-of-family condition following every launch. Any out-of-family deviation is thoroughly evaluated to determine the associated risk and corrective action.

Q3b. How does your organization evaluate problems to determine if they represent recurring failures that require changes in design or processes if they are to be dealt with? Who conducts those evaluations?
 Page 188       PREV PAGE       TOP OF DOC

A3b. Each flight is thoroughly analyzed by domain experts to identify any anomalies. These anomalies are compared to other missions to evaluate trends and out-of-family performance. Each item is then assessed for mission risk and corrective action is established. Unless the risk can positively be established as low, the corrective action is made a lien against the next launch of that system. These evaluations are performed by the contractor and independently by Aerospace using separately acquired, processed, and analyzed telemetry, video and radar data. Results and findings are compared at formal Post-Flight Reviews.

Q3c. For recurring problems, does your organization have the capability to analyze the trend to determine if it could contribute to a low-probability, high-consequence accident?

A3c. Yes, we not only have the capability to independently analyze these conditions, we have the obligation to ensure they are accomplished. We maintain a separate database of launch vehicle flight data that our engineering team uses to maintain recurring flight records. We have also developed unique analytical tools for the engineers to use in analyzing and identifying trends. We recently identified a potential problem during trend analysis of actuator performance that was ultimately traced to internal contamination. Due to the consequences of failure from debris migration, all actuators of like manufacture were processed through a new cleaning procedure before another flight was allowed.

Q3d. How much certainty would your organization require to take action in a case where your relevant technical expert strongly believed a catastrophe could occur but did not have the engineering evaluations to confirm that judgment—and little or no time to conduct such evaluations?
 Page 189       PREV PAGE       TOP OF DOC

A3d. We believe that we are required to take the necessary time to validate a condition such as this and would request the launch be held if need be. Our first obligation is to validate the concern through our readiness review process, then elevate in time to effect the launch decision. A recent example illustrates our process. Our experts identified a concern for dynamic instability on an upcoming Titan launch. This was based on observations noted on other launches but could not be readily quantified for this mission. Due to the risks involved, we requested a launch slip of several weeks while additional modeling was developed and analyses performed. The Air Force was persuaded by the preliminary analysis that a more definitive answer was warranted and delayed the launch. The results of this analysis created sufficient concern that flight changes were made that successfully mitigated the risk of occurrence.

Questions submitted by Representative Bart Gordon

Q1. Does it matter in your organization whether a vehicle or product is deemed ''operational'' versus ''experimental/developmental''? Do you have a different safety structure for operational activities versus those that are developmental in nature?

A1. Space Launch is an inherently engineering intensive activity. This is partly due to the high performance, low margins, numerous hazards, and consequences of failure. But it is also due to the very low production and flight rates with equally low repeatability and assembly before flight. By any comparison to other transportation media, space launch operations would not be considered an operational system and its inherent reliability viewed as relatively low. Therefore as a space organization we have no truly operational systems and continuous engineering involvement is mandatory for mission assurance.
 Page 190       PREV PAGE       TOP OF DOC

    As mentioned in response to Mr. Hall's questions, Range Safety is responsible for flight safety of our launches. When a vehicle strays from its intended flight path, it is destroyed to protect the public from an errant vehicle. This approach would unlikely be employed in an operational transportation system. Also, a comparison of flight safety procedures for space launch and air traffic control yields many significant differences which can be attributed to the non-operational nature of launch.

Q2. In your written testimony you noted that a root cause of some launch failures in National Security Space programs was ''the lack of disciplined system engineering in the design and processing of launch vehicles exacerbated by a premature dismantling of government oversight capability.. . .''

Q2a. Could you elaborate on the circumstances of this ''premature dismantling'' and how it contributed to the launch failures studied in the Broad Area Review?

A2a. The Broad Area Review found that a combination of budget reductions and program reforms that occurred in the early-mid 1990s converged to dilute program effectiveness. Pressures to reduce costs resulted in reduction of government oversight, quality assurance, erosion of expertise, and emphasis on cost savings over mission assurance. In addition specs, standards, and policies were abandoned and the mission assurance technical focus eroded in favor of an ''operational'' orientation. This was particularly true on Titan, one of the most complex launch systems in use, where manpower reductions in the government and Aerospace staff approached 50 percent. The Broad Area Review referred to this as a ''premature going out of business mindset'' in anticipation of flying out the remaining vehicles as the new EELV families were in development, whereas, in reality, the Titan launch rate was increasing. The Broad Area Review also found that the recent failures it examined could be attributed to engineering and workmanship (i.e., human) errors that should have been avoidable.
 Page 191       PREV PAGE       TOP OF DOC

Q2b. How similar are the findings and conclusions of the Broad Area Review and the Columbia Accident Investigation Board report?

A2b. In both reviews it was found that lines of responsibility, accountability, and authority were fragmented, which resulted in an inadequate decision process. We also see similarities in findings that the government entity relied more and more on the contractor, allowed organic capabilities to erode, and became more complacent.

Q2c. With Aerospace Corporation's experience in independently assessing launch readiness, what capabilities do you expect to see in the Air Force organizations involved in the launch decision to be confident of a successful launch?

A2c. We expect our Air Force customer to hold us accountable for our mission assurance responsibilities and to demand the appropriate rigor and technical discipline in our independent assessments and recommendations.

Q2d. How do you evaluate the relationships between the Air Force and the contractors supplying the launchers when certifying readiness to launch? What represents an appropriate relationship between those two groups?

A2d. We rely on the contractors as the primary source of all data and the first line of defense in the mission assurance/readiness process. They provide assurance in their hardware, software, and procedures. It is our job to independently verify that all critical items (i.e., hardware, software, analyses, processes, and procedures) are technically acceptable. The appropriate relationship is one of cooperation and technical interchange with the independent technical party providing additional confidence through verification. The Air Force holds both the contractor and Aerospace accountable for independent mission assurance assessments.
 Page 192       PREV PAGE       TOP OF DOC

Q3. In your testimony you state, ''dissenting opinions are heard.. . .'' What specifically are the forums for these dissenting opinions? How does your organization encourage dissent?

A3. For each launch we conduct a series of technical reviews at each level of management up to the corporation president. At each stage of these reviews, all disciplines and domain experts are represented and their findings and conclusions are presented. The launch vehicle programs rely on the domain experts in the Engineering and Technology Group to provide the technical basis for all positions. Each discipline presents all findings and must be in agreement on the readiness state. If a dissenting position is presented, it will be flagged and actions assigned to resolve. The existence of these issues is also tracked and the dispositions presented throughout the process. This process is also overseen by the Independent Readiness Review Team that reports to the SMC Commander at the Flight Readiness Review in the form of a risk assessment.

Question submitted by Representative Nick Lampson

Q1. Admiral Bowman testified that, ''Safety is the responsibility of everyone at every level in the organization,'' a sentiment echoed by Ms. Grubbe in her statement—but in day-to-day program activities, safety is not a primary metric for measuring performance. Safety usually becomes an issue only after it is clearly seen to be absent. What specific actions does your organization take to maintain the focus on safety when the pressures to achieve organizational goals inevitably build?

A1. We maintain an independent chain of mission assurance responsibility within our organization that flows up to our president. Although we are also responsible to the Air Force program director for his readiness assessment, our president reports to the SMC Commander who is above the program director and who ultimately certifies flight worthiness. It is this chain of command and the accountability expected at each level that assures our mission assurance focus is maintained.
 Page 193       PREV PAGE       TOP OF DOC

Questions submitted by Representative Sheila Jackson Lee

Q1. How is safety training done in your organization? How is safety awareness maintained in your organization? Please describe the kinds of training materials you use.

A1. True safety training and certification is only required for those individuals at the launch site who support hazardous operations and are near the flight hardware. For industrial safety, our Safety and Security office is responsible for training in various procedures. They also have safety awareness circulars and other information media, such as the corporate website. For technical training we also have an educational arm of the corporation, The Aerospace Institute, that has a wide curriculum of space and national defense related courses. The Institute has classroom courses with appropriate text and other documentation for student's use. Our launch systems, systems engineering, and mission assurance functions are all contained in different modules within these courses. For those assigned specific mission assurance functions, we maintain a well-defined process and mentoring program that supports our technical staff.

ANSWERS TO POST-HEARING QUESTIONS

Responses by Deborah L. Grubbe, P.E., Corporate Director, Safety and Health, DuPont

Questions submitted by Representative Ralph M. Hall

Q1. How will we know that NASA has implemented the Columbia Accident Investigation Board (CA1B) recommendations? What measures do you use in your organization to determine that your safety mechanisms are working?
 Page 194       PREV PAGE       TOP OF DOC

A1. We will know when the CAIB recommendations are in place when we see NASA leadership and management more focused on safety than on schedule. The diagnostic is as simple and as difficult as to watch what is done. In my firm we measure outcome metrics, e.g., the number of injuries and we also measure leading indicators, which is a measure of the general safety attitudes and procedures. With NASA I would start by looking at contractor and employee injury rates. If those start to improve, the indicator is there that management and leadership are taking safety seriously. There are literally hundreds of measures within an world class safety program.

Q2. The CAIB recommends a separation between the operational aspects of the Shuttle program and the organizations providing engineering and safety support. Based on your experience:

Q2a. Do you agree with this as a principle for managing your program?

A2a. Yes, my firm has independent authorities for both safety and for engineering.

Q2b. Where do you place the boundaries between these three program elements in your program and how do they interact?

A2b. All elements in my firm: manufacturing, safety and engineering interact at the local site, where the work is being done. In NASA terms, the work comes together at the center. We try to work with no boundaries at all times. We work to ensure alignment against the highest objective, which is to safely meet our customers' needs. If there is a point of disagreement, the management of the respective organizations are called in to help resolve the best approach.
 Page 195       PREV PAGE       TOP OF DOC

Q2c. What training and experience do you require in your senior managers, and what incentives do you provide such managers?

A2c. Most managers have been ''in those chairs'' and know what it is like to see someone hurt. None of us who have been there ever want to see that again. The only true incentive for safety is, in the end, that everyone under my charge left today with all the parts they came with. There is a small monetary incentive at the corporate level, which may be as little as $500/year to someone making six figures. This money is really not much incentive, and is more recognition of job well done.

Q3. In both Shuttle accidents NASA failed to appreciate the threat to the vehicle from what seemed a minor problem—O-ring seals that did not seem to work well in cold weather and foam that sometimes struck the Orbiter's thermal protection system.

Q3a. How does your organization deal with similar ''weak signals''?

A3a. My firm investigates anything that seems ''out of the ordinary'' or unexpected. We drive the answer to root cause, and put the fix into place as soon as practical. The important aspect of this work is to fix it before it becomes more serious.

Q3b. How does your organization evaluate problems to determine if they represent recurring failures that require changes in design or processes if they are to be dealt with? Who conducts those evaluations?

 Page 196       PREV PAGE       TOP OF DOC
A3b. Our engineering and safety organizations, along with the collaboration of our manufacturing organization, looks to discern common cause and special cause variation. Both common cause and special cause variation provide data to direct the needed change.

Q3c. For recurring problems, does your organization have the capability to analyze the trend to determine if it could contribute to a low-probability, high-consequence accident?

A3c. Yes. Our organization, primarily our engineering organization, can do the analysis to quantify risk.

Q3d. How much certainty would your organization require to take action in a case where your relevant technical expert strongly believed a catastrophe could occur but did not have the engineering evaluations to confirm that judgment—and little or no time to conduct such evaluations?

A3d. My firm instructs its employees that if they do not feel safe, they are to stop their job and get someone to help them determine a better, safer way to do the work. An engineering evaluation does not have to do be done, someone just has to sense that ''something is not right.''

Questions submitted by Representative Bart Gordon

Q1. Does it matter in your organization whether a vehicle or product is deemed ''operational'' versus ''experimental/developmental''? Do you have a different safety structure for operational activities versus those that are developmental in nature?
 Page 197       PREV PAGE       TOP OF DOC

A1. The same safety standards apply whether the process or equipment is ''operational'' vs. ''experimental.''

Q2. One of the ''cultural'' issues raised in the CAIB report is the lack of respect for the safety organization demonstrated by the engineering and program offices at NASA. How does DuPont's safety organization avoid such marginalization?

A2. While there are many safety organizations in DuPont, every DuPont employee, and every DuPont contractor is accountable for safety. Safety is a line responsibility. Safety comes first. Period. No questions asked. No one in DuPont can ignore safety without consequences that could lead up to and include termination. If I discount safety, I can expect to hear about it from my boss, and he is not going to be happy! Likewise, with our corporate group. Since everyone is accountable for safety, it is never ignored. The safety organization can serve as the conscience on some occasions; however, you know safety is really working with the organization serves as its own conscience.

Question submitted by Representative Nick Lampson

Q1. Admiral Bowman testified that, ''Safety is the responsibility of everyone at every level in the organization,'' a sentiment echoed by Ms. Grubbe in her statement—but in day-to-day program activities, safety is not a primary metric for measuring performance. Safety usually becomes an issue only after it is clearly seen to be absent. What specific actions does your organization take to maintain the focus on safety when the pressures to achieve organizational goals inevitably build?
 Page 198       PREV PAGE       TOP OF DOC

A1. All major DuPont meetings start with a discussion of safety. Subjects include: statistics, what happened to me on the way home last night, weather safety, travel safety, etc. Others actions include the following: a monthly review of safety statistics at the global manufacturing meetings, reporting of lost time injuries within 24 hours to the CEO, and an aggressive off the job safety program where daily statistics are kept on lost time with off the job fatalities reported to the CEO within 24 hours. Safety statistics are shared daily with the whole organization, and we share improvement ideas frequently. We know that when we go through organizational changes, that safety can suffer, so we also redouble our efforts during difficult times.

Questions submitted by Representative Sheila Jackson Lee

Q1. How is safety training done in your organization? How is safety awareness maintained in your organization? Please describe the kinds of training materials you use.

A1. Safety training starts the first day of employment and continues monthly until one retires. Safety meeting attendance is mandatory. Safety awareness is maintained through items like: a global safety message that is sent out every working day at 2 a.m. EST, tool box meetings at the start of every shift, supervisor walk-through to support learning good safety techniques, etc. Training materials are items like: standards, videos, computer assisted tools, demonstrations, safety fairs, classes, safety meetings, written job procedures, pictures on how to best do the task, etc.

Q2. You mentioned in your written testimony that ''any person can stop any job at any time if there is a perceived safety danger.'' What incentives do you use to encourage such action?
 Page 199       PREV PAGE       TOP OF DOC

A2. 
People who stop a job, and people who offer an alert to an unsafe situation are highlighted at a safety meeting, or verbally recognized at a tool box meeting, or are sometimes even offered monetary recognition. The positive reinforcement is very affirming, and we continue to see more folks step forward and report unusual events. It is the driving home of the fixes on these unusual events that helps to keep people from getting hurt in the first place.

Appendix 2:

Additional Material for the Record