Statement of Mr. Ray F. Johnson, Vice President, Space Launch Operations, The Aerospace Corporation before the House Science Committee

Testimony of Mr. Ray F. Johnson, Vice President, Space Launch Operations, The Aerospace Corporation

Before the House Science Committee, Honorable Sherwood L. Boehlert , Chairman

October 29, 2003

Mr. Chairman, distinguished committee members and staff:

I am pleased to have the opportunity to describe the capabilities of The Aerospace Corporation as they relate to organizational and management ìbest practicesî of successful safety and mission assurance programs. The Aerospace is truly a unique organization. Our capabilities, core competencies and practices are the result of 43 years of operating a Federally Funded Research and Development Center (FFRDC) for the National Security Space program.

I will discuss the committee’s questions as outlined in the invitation letter, but first I would like to present an overview of Aerospace and specifically what we do for the Air Force in the area of launch readiness verification.

The nature and value of The Aerospace Corporation

The Aerospace Corporation is a private, nonprofit corporation, headquartered in El Segundo, California. It was created in 1960 at the recommendation of Congress and the Secretary of the Air Force to provide research, development and advisory services to the U.S. government in the planning and acquisition of space, launch and ground systems and their related technologies. The key features of Aerospace are that we provide a stable, objective, expert source of engineering analysis and advice to the government, free from organizational conflict of interest. We are focused on the government’s best interests, with no profit motive or predilection for any particular design or technical solution.

As its primary activity, Aerospace operates an FFRDC sponsored by the Under Secretary of the Air Force, and managed by the Space and Missile Systems Center (SMC) in El Segundo, California. Our principal tasks are systems planning, systems engineering, integration, flight readiness verification, operations support and anomaly resolution for the DoD, Air Force, and National Security Space systems. Through our comprehensive knowledge of space systems and our sponsor’s needs, our breadth of staff expertise, and our long term, stable relationship with the DoD, we are able to integrate technical lessons learned across all military space programs and develop systems-of-systems architectures that integrate the functions of many separate space and ground systems.

Aerospace does not compete with industry for government contracts, and we do not manufacture products. The government relies on Aerospace for objective development of pre-competitive system specifications, and impartial evaluation of competing concepts and engineering hardware developments, to ensure that government procurements can meet the military user’s needs in a cost-and-performance-effective manner.

Aerospace employs about 3,450 people, of whom 2,400 are scientists and engineers with expertise in all aspects of space systems engineering and technology. The professional staff includes a large majority, 74%, with advanced degrees, with 29% holding Ph.Ds. The average experience of Members of the Technical Staff (MTS) is more than 25 years. We recruit more than two-thirds of our technical staff from experienced industry sources and the rest from new graduates, university staff, other nonprofit organizations, government agencies, and internal degree programs.

Aerospace has maintained a 43-year strategic partnership with the DoD and the National Security Space community, developing a data and experience base that covers virtually every military space program since 1960. We have evolved an unparalleled set of engineering design, analysis and systems simulation tools, along with computational, diagnostic test, and research facilities in critical space-specific disciplines that are used in day-to-day support of government space system programs.

Aerospace is the government’s integral engineering arm for National Security Space systems architecture and engineering. As such, Aerospace has broad access to intelligence information, government requirements development, all programs and contractors’ proprietary data and processes, and the full scope of government program planning information. We translate the requirements dictated by Congress and the military and national security management into engineering specifications that form the basis for competitive Request for Proposals (RFPs) to industry. We evaluate contractor technical designs and performance, and provide continuing technical insight and progress assessment for the government program manager throughout the engineering development, test and initial operation phases of space systems. In order to do this, Aerospace must have technical experience and breadth at least equal to the industrial firms we evaluate. I am extremely proud of the quality and performance record of our staff, as evidenced by the outstanding success record of the space launches and satellite systems Aerospace has technically supported on behalf of its government sponsors.

The Aerospace technical program office MTS are supported by a matrix of 1,000 engineering and scientific specialists in every discipline relevant to space systems, with extensive laboratory and diagnostic facilities. Typically, an expert in a particular field — propulsion, microelectronics, or infrared sensors, for example — will work on several programs during the course of a year, as each program has a need for a particular skill depending on its program phase. This approach permits Aerospace to develop and maintain state-of-the-art analytical and simulation models and test facilities that could not be afforded by a single program or contractor, but are efficiently used as needed by all programs.

Aerospace systems engineering currently supports 29 satellite programs, 8 launch vehicle boosters, and 13 ground station elements for the DoD and National Security customers. Our functions can be summarized as follows, covering the entire system acquisition process:

• planning and systems studies — pre-competitive systems definition
• trade-offs and simulations of system requirements to help prioritize user needs
• technical RFPs and technical evaluation of proposals
• early detection of development problems and timely identification of alternative solutions, to preserve schedule, cost and performance
• independent analysis, verification, and validation of data and performance to assure mission success
• launch verification and readiness assessments (boosters, satellites and ground systems),
• launch and on-orbit operations and workarounds

Aerospace’s launch readiness verification process

Independent launch readiness verification is a core competency of Aerospace as defined in our charter as an FFRDC supporting the Air Force. As such, Aerospace is directly accountable to SMC for verification of launch readiness. This responsibility is vested within the Space Launch Operations program offices and executed using our launch readiness verification process.

Prior to any launch, Aerospace provides a letter to SMC documenting the results of the launch verification process, confirming flight readiness of the launch vehicle. This letter is not just a formality, but represents the culmination of a long and rigorous assessment that draws upon the collective expertise of scientists and engineers within the program office and the engineering staff. The launch readiness verification letter provided by the Aerospace Vice President of Space Launch Operations to the Air Force was first introduced in the late 1970s to document our corporate commitment to mission success. This formal launch readiness verification provides assurance that all known technical issues have been assessed and resolved, residual launch risks have been satisfactorily assessed, and establishes confidence in launch mission success. The ultimate GO/NO-GO launch decision and flightworthiness certification rests with SMC, not Aerospace, however, the Air Force relies heavily on our readiness assessment in building confidence in its final decision.

The process used to independently determine launch system flight readiness is a capability that has evolved over 40 years. Aerospace’s role in independent launch readiness verification began with the Mercury-Atlas program in 1960, shortly after the corporation was founded. The Project Mercury launch vehicle had suffered two failures and a turnaround in reliability was required before human space flight could be attempted. The risk reduction techniques that Aerospace developed were instrumental in achieving mission success. Since then, we have applied this process to the design, development, and operation of more than 600 launches including all Atlas, Delta, Inertial Upper Stage, and Titan launch vehicle variants resulting in a proven track record of reducing launch risk.

The fundamental features of our launch readiness verification have been the same since first employed. Verification begins as early as the concept and requirements definition phase of most programs and continues through flight operations. Launch verification certification and readiness assessments include design, qualification, fabrication, acceptance, software, mission analysis, integration and test. Thorough launch readiness verification requires a detailed review by Aerospace staff of thousands of components, procedures, and test reports to verify flight readiness. Independent models are developed and maintained by Aerospace domain experts and exercised to validate and verify the contractors’ results. Resident Aerospace engineers are involved in all aspects of the launch campaign from manufacture through launch site operations. Launch readiness verification is a closed loop process via post flight analyses that use the independent analytical tools and independently acquired and processed flight telemetry data to provide feedback into the engineering design process, capture lessons learned, monitor trends, and establish a basis for proceeding into the next launch cycle.

To accomplish the entire spectrum of launch readiness verification requires that Aerospace retain a diverse cadre of skilled engineers with expertise in a wide variety of disciplines including systems engineering, mission integration, structures and mechanics, structural dynamics, guidance and control, power and electrical, avionics, telemetry, safety, flight mechanics, environmental testing, computers, software, product assurance, propulsion, fluid mechanics, aerodynamics, thermal, ground systems, facilities and operations. Our major objective is to retain the necessary skills and expertise needed to support planned as well as unexpected events.

The launch readiness verification process was reinvigorated in the late 1990s following a series of launch failures. Among the observations of the Space Launch Broad Area Review were that the root cause was the lack of disciplined system engineering in the design and processing of launch vehicles exacerbated by a premature dismantling of government oversight capability, particularly the engineering support capabilities; that space launch needed to re-establish clear lines of authority and accountability; that space launch is inherently more engineering intensive than other operational systems; and that properly conducted independent review is an essential element of mission success.

Now, I will address the committee’s specific questions:

1. What does it mean for a safety program to be “independent?î How is your organization structured to ensure its independence?

The government’s requirement for the Aerospace FFRDC mission requires complete objectivity and freedom from conflict of interest; a highly expert staff; full access to all space programs and contractor data sources; special simulation, computational, laboratory and diagnostic facilities; and continuity of effort that involves detailed familiarity with the sponsor’s programs, past experience, and future needs. We are focused on the government’s best interests, with no profit motive or predilection for any particular design or technical solution.

Although the Aerospace program offices are co-located with the Air Force programs, they are separate organizations with their own management structure. Technical recommendations are worked up through Aerospace management and are then presented to the Air Force. In addition to the launch verification letter, a formal launch readiness briefing is given to the Aerospace president. At this review, our president confirms that our technical analyses are thorough and objective, and our recommendations are based on sound engineering principles. Although the Aerospace launch readiness verification products are produced independently from those of the prime contractor, we also employ another independent review organization that reports to the SMC Commander. This independent review team also briefs our president on its findings to ensure that our process has yielded acceptable risks. This review is conducted just prior to the SMC Commander’s Flight Readiness Review (FRR). The Aerospace president is polled during the Commander’s FRR for his concurrence to proceed with final launch processing.

2. Given that more can always be done to improve safety, how do you ensure that your safety program is independent and vigilant, but that it won’t prevent the larger organization from carrying out its duties?

The key elements here are teamwork, technical rigor, and a goal for 100% mission success. Aerospace program offices are co-located with the Air Force programs and Aerospace engineers are in daily contact with their Air Force counterparts. Aerospace recognizes our obligation to identify issues in a timely manner and to keep the Air Force aware of any technical issues that may impact the overall program. The launch readiness verification process is involved with all phases of the program and is not merely a final assessment that is performed just prior to launch. The failures of 1998 and 1999 were in part due to ineffective teamwork. All successes since then can be attributed to a complete team effort among Aerospace, the Air Force, and the contractors. All team members understand and respect the value of the individual responsibilities and contributions. While vigilance and independence can identify otherwise unobserved risks, the entire team must work together to allow the larger organization to carry out its duties to achieve flightworthiness certification and a successful mission.

Just as important as teamwork is the technical rigor employed in the process to reach certification. We employ a well-defined launch readiness verification process with individual responsibilities and accountability. The burden of proof requires a positive demonstration that a system is flightworthy, rather than proving that an anomalous condition will cause a flight failure. The launch readiness verification process is part of an overarching flight readiness process. Many unforeseen events occur during each launch campaign that must be acted upon. The process rigor that we employ assures that no single event or issue is overlooked or prematurely closed. With 100% focus on mission success, the technical rigor and commitment by each team member enhances the larger organization decision process.

3. How do you ensure that the existence of Aerospace’s mission assurance program and independent launch verification process does not allow the larger organization that it serves to feel that it is absolved of responsibility for safety?

Final flightworthiness certification is the responsibility of the SMC Commander. At the final FRR, the Commander receives input from several organizations prior to giving the GO to proceed with launch processing. The Commander receives input from the Air Force Mission Director, launch vehicle program managers, launch ranges, SMC Chief Engineer, prime contractors, spacecraft program managers, Aerospace, and the Independent Readiness Review Team (IRRT).

Aerospace is directly accountable to SMC for the verification of launch readiness. Our task is to independently confirm readiness of the launch vehicle, assess mission risks, and assure that all risks are acceptably low to enter into launch. The ultimate GO/NO-GO launch decision rests with the SMC Commander, not Aerospace; however, the Air Force relies heavily on our readiness assessment in building confidence in the final decision.

4. How do you ensure that dissenting opinions are offered without creating a process that can never reach closure?

The verification process includes all stakeholders at major decision points and milestones. Dissenting opinions are heard and data is required to resolve engineering issues. Aerospace makes every effort to ensure that our positions are based on sound engineering practices backed up by factual data. Aerospace’s engineering staff objectively develops their technical recommendations and supporting analyses that are then coordinated with the Aerospace program offices and management. Management encourages the sharing of all points of view and is responsible for ultimately deciding on a final recommendation. When an issue is well founded in science and engineering, the path forward is usually identifiable, e.g., additional inspections, tests, analyses, etc. For issues that do not have concrete solutions, risks are assessed by senior review teams based on technical data. When a ìpureî technical solution is not possible, the Air Force is provided with a risk assessment that outlines the degree of risk associated with each course of action.

As I mentioned previously, the independent launch readiness verification end-to-end system review process culminates in a launch readiness assessment for each mission. A formal flight readiness certification provides assurance that all known technical issues have been assessed and resolved, residual launch risks have been satisfactorily assessed and confidence in launch mission success has been established as acceptable. It is this process, as outlined in the following figure, that ensures acceptable closure of every issue.