NASA NTRSDate not supplied
NASA’s view of risk changed between early Apollo and the Space Shuttle. Risk was a known serious problem at the beginning of Apollo and the risk estimates were disturbingly high. To avoid public concern, risk analysis was discontinued. Risk analysis was avoided in Shuttle, leading to an unnecessarily risky design. The immediate cause of the Challenger tragedy was the mistaken decision to launch in cold weather. The fundamental cause was the high risk of the Shuttle design. Before Challenger, management thought and testified that the probability of an accident was 1 in 100,000. After Challenger, Probabilistic Risk Analysis (PRA) found a roughly 1 in 100 chance of a Shuttle failure. The recent Orion design uses the safer Apollo approach, with a hardened capsule, launch abort escape, and the crew placed above the rocket tanks and engines. During Apollo it was estimated that, “assuming all elements from propulsion to rendezvous and life support were done as well or better than ever before, that 30 astronauts would be lost before 3 were returned safely to the Earth.” The chance of astronaut survival was only 10%. After the Apollo 1 tragedy, the awareness of risk led to an intense focus on achieving safety. “The only possible explanation for the astonishing success – no losses in space and on time – was that every participant at every level in every area far exceeded the norm of human capabilities.” During Apollo, a NASA PRA found that the chance of success was “less than 5 percent.” The NASA Administrator felt that “the numbers could do irreparable harm,” and discontinued numerical risk assessment. This led to decreasing understanding of risk. The head of Apollo reliability and safety decided, “Statistics don’t count for anything,” and that risk is reduced by “attention taken in design.” The great and initially unexpected success of Apollo appeared to validate the neglect of PRA. Continuing to neglect the mathematical estimation of risk led Shuttle into a high risk design that produced tragic results. The initial design of the Shuttle emphasized increasing capability and reducing cost without analysis or even mention of risk. A retired NASA official stated, “some NASA people began to confuse desire with reality. … One result was to assess risk in terms of what was thought acceptable without regard for verifying the assessment. … Note that under such circumstances real risk management is shut out.” Not computing risk led to removing launch abort, removing crew escape, selecting less reliable Solid Rocket Boosters, placing the crew compartment next to the rocket boosters, and accepting more stressed shielding tile designs. Accepting these specific risks directly caused the shuttle disasters. The Challenger tragedy is frequently taught as a case of management failure. The focus is on the Challenger launch decision hours before, which is a dramatic example of bad management. However, the true cause of the Challenger disaster occurred decades earlier in the Apollo era. When the easily predictable failures occurred, failure investigations focused on how they might have been avoided. The Shuttle was cancelled after the space station was completed because of its high risk. The ultimate cause of the Shuttle tragedies was the choice by the Apollo-era NASA administrator to avoid a negative public reaction to realistic risk analysis.