The Curious Use of Combination Locks By NASA During Space Shuttle Missions

Updated and expanded 26 February 2007

Given the recent problems Lisa Nowak experienced – problems that emerged only months after she flew on a Space Shuttle mission – questions have arisen as to how NASA might deal with an individual who exhibited problems during a mission – as well as how to catch such problems on the ground ahead of time.

The following interview was conducted with NASA’s Chief Safety and Mission Assurance Officer, astronaut Bryan O’Connor in April 2006 – a few months before Lisa Nowak’s space shuttle mission to the International Space Station. As such, his thoughts certainly represent his recent thinking about safety.

As such, it is somewhat disconcerting to read a recollection wherein O’Connor talks about adding a combination lock to Space Shuttle Columbia’s middeck hatch on STS-40 in 1991 due to concerns over the competency of several payload specialists. Moreover, he repeats several times that he thought this whole story was “humorous” and “funny”.

Read it for yourself.

Excerpt from: “NASA Johnson Space Center Oral History Project Transcript: Bryan D. O’Connor, 20 April 2006” (full document)

JOHNSON: I read on that flight [STS-40], also–there was an article that talked about the fact that one of the hatches was padlocked. Do you want to just talk about that for a second? Was that something that was normally done?

O’CONNOR: Well, for me it was. We had done that on my first flight [STS-61B] –Brewster [H.] Shaw [Jr.] being the commander and me the pilot–padlock on the hatch, the rationale being that you’ve got a couple of people on this flight that you don’t know that well. They’re the “payload specialists.” They’re not career aviators. They haven’t been through all the training we have. We try to make sure they don’t hurt themselves or anybody else. It was a due diligence thing, because, in theory, although it would be tough to do it inadvertently, there was a button and a turn of a knob that could actually open up that hatch, and the hatch was very dangerous, because it was an out-opening hatch.

There were probably a lot of good reasons why they did that, one of which might be room in the cabin or whatever, but one of the bad things about that is that the pressure in the cabin will blow that hatch off if the latches aren’t latched. You would like to have a system where the pressure will keep the hatch closed, not open it. But that’s not the way that one was structured. So that was a risk area. Some of the other commanders before had had concerns about that hatch, and so when it came time for my second flight, I ordered up the lock when we were down in quarantine at the Cape and said, “Okay, get that lock and be sure you put that on the hatch, or put it in the vehicle so that when we get up on orbit, we can put it on the hatch.”

I could tell from the response when I made that request that this might be a little unusual, but it didn’t hit me too hard, because I didn’t really check to see how often this was done or anything. I pretty much thought that was standard. But the guy did say, “Ooh, are you sure you need that?”

I said, “Oh yeah.”

“Okay.”

So, I got that kind of response, and it put a little question mark in my mind. But we did that. And I remember the two payload specialists, each of them, one at a time, coming in to ask me about that. “Hey, I heard we put a padlock in there. What’s that for?”

And I told them, “It’s because we don’t know you guys all that well. It’s due diligence, and I did it last time, and don’t worry about it.” [Laughs] I told each one of them. So they may not have liked that. They probably thought, “Well, this is a fine how-do- you-do. We train for two years together, and they don’t trust us.”

Maybe it was a bad judgment. It might have been one of those things if I’d thought more about it, maybe I would have said, “I don’t really need to do this. There’s a potential downside in that it creates concern among the crew about trust and all that.” But I [erred] on the side of due diligence and kept it on there. And I was honest with the two payload specialists. I didn’t try to hide anything or whatever. I just told them, “Yeah, and the NASA members get the combination, but you guys don’t. That’s the way this works.”

So I could tell they were a little bit concerned about it. I have to say, though, that in each case, it was kind of funny–this is human nature. Remember I told you they didn’t get along too well with one another? I didn’t say that it was “because of both of you.” I just said, “This is a thing about payload specialists.” I didn’t say, “It’s because of you personally.” I genericized it.

And I could tell that each one of them was thinking, and the wheels were turning, “Oh, it must be for that other one.” I didn’t try to dissuade them of that. So if that’s the way they felt good about it, that was fine with me. [Laughter]

JOHNSON: And knowing those personality types.

O’CONNOR: Yes. That was one of the humorous things about it, I guess.

I have known both of the payload specialists O’Connor references here – Drew Gaffney and Millie Hughes-Fulford – for a long time and know them both to be outstanding, competent, professional individuals. In reading O’Connor’s recollection, it is clear (at least to me) that he provides a one-sided, somewhat contradictory, and self-serving description of training for the STS-40 mission in 1991.

The question I have for Bryan O’Connor is simple: if you truly felt that these individuals were not capable of the same level of performance as other members of the crew, why did you bend the rules like this? Indeed, if you really thought that one or both of these two individuals posed a threat such that an additional level of security was needed on the Shuttle Columbia’s hatch, shouldn’t the recommendation have been not to fly these individuals – or train them until such time as they met acceptable performance standards?

But this is not what happened.

The rationale O’Connor cites for putting a combination lock on the middeck hatch seems to be in complete conflict with other references O’Connor makes to mission training wherein he states that Gaffney and Hughes-Fulford “trained like two professionals”. Since they were performing the way they were supposed to, was this use of locks more of a psychological management tool than one focused on alleviating a potential safety risk?

Having been personally involved with NASA life sciences activities before, during, and after this mission, I can recall hearing nothing but glowing reports about the crew’s on orbit professionalism and productivity.

O’Connor makes it clear that he was playing one individual off against another. Indeed, he admits that he thought it was “kinda funny”. Is this really a professional way to manage people?

In addition to expressing his amusement over the combination lock issue, O’Connor also decides to reveal the medical reason why a SLS-1 payload specialist was removed from the mission during training. Who gave O’Connor permission to violate that person’s right to medical privacy?

What really puzzles me is this line: “I just told them, “Yeah, and the NASA members get the combination, but you guys don’t. That’s the way this works.” Well, if it was prudent for other crew members – all flying in the same spacecraft – to have the combination, is it not possible that a situation might arise where one (or both) of the two payload specialists might need to perform that task as well? What if crewmembers with the combination were occupied or incapacitated?

Indeed, based on O’Connor’s repeated concerns about hatch design and how easy it is to open it shouldn’t the issue of fixing that hatch design have been handled as a way of reducing risk – on all shuttle missions?

This act of adding a combination lock strikes me as potentially adding risk to a mission – not reducing it. And it is curious that NASA’s current Chief Safety and Mission Assurance Officer would still think that such a practice was acceptable – and funny. Moreover, if O’Connor felt that this lock made his mission safer, does this mean that other shuttle flights that flew without that lock were less safe?

Bryan O’Connor mentions that this was done on his first shuttle flight (STS 61B) for similar concerns. How often did this happen – and on which missions other than STS-61B and STS-40? Is the use of such combination locks on Space Shuttle missions still the case today? Are (or were) there officially baselined flight procedures, which specified when the hatch would get an extra lock – and why? If such documents exist, will NASA release them? If they do not exist, then what does this say about the veracity of NASA’s safety process – something Bryan O’Connor currently oversees?

In the aftermath of the recent sad circumstances surrounding Lisa Nowak’s actions, NASA is now organizing an internal review of all of its psychological testing procedures for the astronaut corps.

As this review is being done, one would think that additional reviews are being done with regard to the hardware and procedures used to deal with possible crew problems in space so as to be certain that they are not being used as a substitute for identifying – and dealing with – potential problems on Earth – before they become problems in space.

Reader note: “When I read your recent comments on NASA’s use of padlocks on the shuttle, I was reminded of Brewster Shaw’s comments that he was the first to do so on 61-B, as you’ve mentioned. You may wish to look up his comments to that effect in his NASA JSC Oral History Project interview (same site as O’Connor’s). They’re on pages 22-23 of his transcript. He’s relatively blasé about the whole incident.”

Excerpt from Brewster Shaw’s Oral History Session, 19 April 2002.

“Anyhow, that was a fun flight. We also had Rodolfo Neri Vela on that flight. This was really the first–I don’t remember if it was the first time we flew somebody like that or not, to tell you the truth. The first time I had flown with somebody that we didn’t know very well. You know, Ulf Merbold was a German, but he’d been training with those guys a long time. They knew him well. We didn’t know Rodolfo very well. He kind of showed up late in the process and wasn’t here all the time and stuff, and so you didn’t really get to know him well. So I wasn’t too sure about his human reliability. I’m probably a paranoid kind of guy, but I didn’t know what he was going to do on orbit.

So I remember I got this padlock, and when we got on orbit, I went down to the hatch on the side of the Orbiter, and I padlocked the hatch control so that you could not open the hatch. I mean, on the Orbiter on orbit you can go down there and you just flip this little thing and you crank that handle once [demonstrates], the hatch opens and all the air goes out and everybody goes out with it, just like that. And I thought to myself, “Jeez, I don’t know this guy very well. He might flip out or something.” So I padlocked the hatch shut right after we got on orbit, and I didn’t take the padlock off until we were in de-orbit prep. I don’t know if I was supposed to do that or not, but that’s a decision I made as being responsible for my crew and I just did it.

RUSNAK: Did any of the rest of the crew notice it?

SHAW: Yes. I don’t think Rodolfo noticed it, but some of the other crew noticed it. But everything went just fine. He turned out to be a great guy, and we had a lot of fun on that mission. That was a very successful mission, as were all three of the times I got to fly. In fact, we have not really had an unsuccessful Space Shuttle mission except for Challenger.”

Editor’s note: again, if the commander of a space shuttle mission is unsure of someone’s ability to perform their tasks during a mission, shouldn’t their presence on that mission at least be questioned? If doubts about their capabilities leads the commander to want to put an extra level of security on the shuttle’s hatch, what other critical systems have to be protected from possible misuse or tampering as well?