I'm sure many of you are thinking – Boy anyone with a resume that long must be very.., very --- old! Well that may be true, but it’s sure nice to have your bio read off some place other than your own memorial service – I may seem pretty old to some of you young computer wizards, but where I live now, I'm considered one of the young bucks - but I've learned not to play golf with anyone for money who isn’t over 90! And I haven’t broken even yet! But in my opinion I'm just the right age to be able to tell you that… This year, 2013, marks the golden jubilee of the founding of the International System Safety Society. The charter meeting of our Society was held on December 6, 1963 on the campus of the University of Southern California. I know – I was there!

1

I am privileged to be able to make these remarks, by which I hope to acquaint - or for you old timers, review - those unique circumstances that co-existed some 50 years ago that bought about the formalized practice of system safety and the birth of a society of – “professionals dedicated to the safety of systems, products and services” I feel that this is desirable for more than just a trip down memory lane – it is my hope to help you identify some areas where we can better fulfill the visions of our pioneering trailblazers. My use of the term pioneers is not limited to some bygone era, but rather to quote Webster, “a person or group that originates or helps open a new line of thought or activity or new method or technical development” therefore, many of you here in this room can rightfully considered pioneers of system safety.

2

It has been noted – ” you can never know just how far you have come, unless you know where you started”

3

From my perspective, this society has come a long ways these past 50 years, and to help you realize just how far - let's review the circumstances, obstacles and trailblazing that occurred in the mid 20th century - relative to system safety. Throughout history, it has been an established doctrine that risks of serious accidents and injuries must be a primary consideration of any complex engineering endeavor. However, the means for best achieving acceptable safety was far from clear. This was especially true in the emerging aerospace field. Let me try to help you recapture the unique and extraordinary period of time that existed in aerospace in the post World War II period - a perfect storm that brought birth to the practice and acceptance of the system safety concept, and subsequently this society

4

Shortly following the end of WWII in 1945, a new conflict began, known as the Cold War. A major concern to U.S. leaders was the success of the soviet rocket program. In 1957, the Soviets launched SP-1, a small satellite into earth orbit - quickly known around the world as Sputnik. Although completely harmless in itself, Sputnik became a game changer. To the politicians and public media it put the soviets in the lead, because of the perceived superior missile launch capability sputnik had demonstrated. Frantic attempts by our military to put an American object into orbit became an embarrassment due to various spectacular launch pad explosions, as seen by all on the nightly news.

5

The cold war became an ongoing poker game called mutual assured destruction or MAD. The primary players in this game were the Soviet Union and the United States. The stakes were nothing less than the survival of civilization… the poker chips used by both players were nuclear warheads and the systems needed to deliver them to the opponents critical targets. Although this may have been a ‘cold war’ to those of us on active duty in strategic air command, it got pretty hot at times. It soon became apparent to the poker players, that accurate inter-continental ballistic missiles (ICBMs) should become the primary chip to play in the “MAD” poker game because of their better abilities to penetrate enemy airspace defenses. And thus a more effective counter-strike chip. Sputnik had captured the worlds imagination like nothing else at that time. The missile race was on full speed. The white house and congress demanded that the DoD get operational ICBMs quickly - whatever the cost… this was a great time to be in the business of making ICBMs.

6

The specific aspect of the aerospace field that is most pertinent to this discussion on the birth of the System Safety Society is that of the nuclear-armed ICBM. Although invented in this country, rockets using liquid propellants were initially put into military use by the Germans in World War II. Both ram jet and rocket propelled rockets rained destruction on English and Belgium cities in 1944 -45. The superior performance of these rockets over existing artillery weapons caused visionary leaders in both the soviet and us military to seek out the scientist and engineers that had been responsible developing these German rockets. At the collapse of the Nazi regime in the spring of 1945, Wernher von Braun, the chief scientist for the German missile industry, made a critical decision to escape the soviet dragnet put out for him, and with many of his key technical staff, surrendered to the us special service agents sent out to find him. He was quickly brought to the U.S. And upon finding him willing to help the U.S. Army in developing missiles like the V-2 rocket, established his team at the Redstone Arsenal in Huntsville, Alabama. Soon the Redstone Arsenal was sending out requests for proposals (RFPs) to industry to perform research and development studies rockets capable of delivering nuclear warheads to enemy targets 5 to 8 thousands of miles away. The aircraft industry, feeling the pinch of postwar aircraft contract cancelations, and was desperate to get into the new missile game. Over the years these firms would merge and remerge - forging new corporate names, such as Lockheed-Martin and McDonald-Douglas. I was always hoping that Fairchild and Honeywell would merge to form a company called Fairwell- Honeychild. In 1947 the Rocketdyne division of North American Aviation was awarded contracts, to develop improved liquid rocket engines. A testing facility was constructed at a remote rocky site in the hills above my home town of Simi Valley, just across the LA city and county limits. This is where, in 1958, after serving as a bio-environmental engineering officer in the Air Force, and earning my masters at UC Berkeley, I continued my 48-year career in the environmental health and product safety fields. An interesting sidelight, at least to me, was that while growing up in Simi Valley, my Boy Scout troop would make overnight campouts to the location this test site was located. We enjoyed playing war games using the World War I trenches from the movie set for Sgt. York, one of many movies filmed there. I remember when the initial rocket engine test rocked the high school room I was sitting like a mild earthquake combined with a thunderstorm. We soon became accustomed to the rumbling from Rocketdyne testing, and enjoyed watching reactions from visitors to the valley when a test firing went off. Back in 1946, San Diego-based Convair, convinced a special DoD advisory committee, to fund a research project for developing a truly intercontinental missile that could strike the heart of the USSR from bases in the states. This program was called Atlas, the first ICBM activity undertaken by the U.S. Air Force. At that time there were numerous technical problems needing solutions - to minimize lift-off weight, the Atlas had thin metal skin propellant tanks that had no structural integrity, and relied on internal gas pressure to keep from collapsing. Essentially the Atlas was to be a flying balloon using liquid oxygen and RP1, a jet fuel blend, as propellants. For the next 9 years atlas was funded as a research test bed only.

7

However, in 1955, as the cold war heated up in Korea, both Convair and Martin-Denver were directed to begin full scale ICBM development. 10 years later, Atlas became the first operational U.S. ICBM, there were no system safety specifications inserted into any of the Atlas or Titan I related contracts. Both programs suffered numerous catastrophic mishaps during development testing and operational deployment. These costly and often fatal accidents were instrumental - along with counter strike vulnerability concerns - prompted the Air Force, to push the solid fueled Minuteman I, and storable liquid Titan II programs in the late 1950s. These ICBMs could be kept fueled and launched from a protected silo within minutes of a detected enemy attack. As soon as these ICBMs were operational, both Atlas and Titan military projects were cancelled. The DoD and NASA continued to use them successfully as space launch vehicle boosters. When we examine where system safety entered the world of the ICBM, there are various paths to follow. Many individuals were involved, each representing a particular vantage point. Therefore, please recognize that this narration represents my personal viewpoint and best effort research. I would hope that this review of the origins of our society, will serve to stimulate memories and bring forth corrections and improved histories that can made into an official society document. The spectacular ICBM mishaps in the 1950s and early 60s was a major concern, not only to the program managers, but to the Aerospace Safety Directorate, then located within the Inspector General's Office at Norton AFB in San Bernardino. Originally established to deal with the many aircraft accidents the Air Force had been experiencing, this directorate was attempting to get a handle on how to deal with the safety of ICBMs, certainly a horse of a different color to these military aviators. Pilot error could no longer used to blame for uncertain causation factors. For some years the directorate had sponsored aircraft accident investigation training for Air Force flight safety officers and airmen. At that time these courses were being conducted under contract with USC’s Aviation Safety Division, these courses involved techniques to reconstruct accident events to search for the causative elements. Around 1962, this USC program was placed under the technical direction of C.O. (Chuck) Miller, who had previously been a test pilot and flight safety officer at Chance-Vought. Chuck was a colleague of Jerry Lederer, president of the Flight Safety Foundation, who had been advocating the need for a proactive safety effort within aircraft design activities, since before World War II. Jerry later became the NASA Safety Director, and Chuck, the head of the Aviation Branch at the National Transportation Safety Board. Perhaps you remember seeing Chuck on national TV news broadcasts being interviewed following a serious commercial airliner crashes.

8

It was way back in 1954 that Chuck presented a paper before the Flight Safety Foundation’s yearly seminar, entitled.. “Applying Lessons Learned from Accident Investigations to Design through a System Safety Concept”. It is likely this is the first published paper with the term “system safety” in its title. Although accepted doctrine now, at that time these concepts represented a radical departure from traditional fly-fix-fly philosophy that provided work for the accident investigators, but not much comfort for the test pilots. Col. George Ruff, one of the more visionary officers at the Air Force Safety Directorate, was assigned to study the ICBM accident issues. He identified the more critical factors contributing to these mishaps.

9

In the early 60s Col Ruff, and some members of his staff, went to Chuck for suggestions for dealing with this unique critical safety problem. From these discussions, Ruff became convinced that a contracted system safety program to proactively identify causative hazards before the accident was the only feasible solution.

10

However, implementing this solution faced numerous obstacles. Corporate legal did not like potential hazards in their products documented. Engineering, reliability, and other established disciplines felt that they were already addressing safety. Some company OS&H managers did not want another safety activity on their turf. Beginning 1960, Col Ruff used the annual Air Force-Industry safety conferences as a vehicle to discuss system safety concepts with industry attendees. The question was how best to formulate contractual requirement for system safety. These open discussions influenced many of the conference attendees from industry to alert their respective management to begin planning suitable approaches to competitively bid system safety in ICBM related programs and proposals. It was assumed correctly that all obstacles would be overcome by contractual requirements and funding.

11

Among those taking this message home to Seattle was Niel Classon of Boeing Aerospace. With the support of Gen Phillips, the Air Force program manager, Neil implemented a system safety activity for the Minuteman I program in December of 1960. In time, Dave Haasl, with the help of other Boeing system safety engineers, including Clif Ericson, trail blazed the quantitative, total system, top-down, fault tree analysis technique on the minuteman program.

12

In July of 1960, a system safety office was established within the Air Force Ballistic Missile

Division (BMD). In April 1962 this office released, BSD Exhibit 62-41 entitled “System

Safety Engineering: Military Specification for the Development of Air Force Ballistic

Missiles”. It was basically a guide on how to incorporate system safety program

requirements into BMD missile contracts.

Around this time, the Accident Investigation School at USC was contracted to add courses

on system safety management. Chuck Miller prepared the course syllabus, and with some

instructors, including Roger Lockwood, introduced system safety concepts to Air Force

safety and program office personnel assigned to attend this class. In addition to class room

activities, Chuck arranged with my corporate boss, tours of the Rocketdyne rocket test site,

where I was the host – discussing some propellant and engine testing safety related war

stories and observing atlas engine test firings. Thus by 1961, I had become acquainted with

Chuck Miller and George Ruff, the key innovators of aerospace system safety.

By mid 1962 Ruff was able to release BSD Exhibit 62-41. This signaled a message to the

contractors to the need for becoming prepared to deal with system safety requirements in

new ICBM contract bid requests known as RFPs. This typically meant someone was tasked

to get familiar with BSD 62-41. The person tapped at Rocketdyne was George Peters, then

head of Human Engineering and Maintainability. George then convinced me to transfer out

the Environmental Health and Safety Department into his Reliability Engineering Group to

take the lead role in preparing compliance with 62-42 just before the release of MIL-S-

38130 (USAF), “General Requirements for Safety Engineering of System and Equipment”

in July of 1963. These provided glossaries of terms and criteria for basic system safety

engineering tasks. It also expanded the scope of system safety to include all phases of

product design, development, testing and operations.

13

The July 1963 Air Force-Industry Safety Conference was held at the Palm Springs Resort and Spa. It focused on MIL-S-38130. Some 50 or so other representatives from various aerospace contractors attended. This gave us an opportunity to become aquatinted in a non-competitive environment. It was around the piano bar, relaxing after dinner, that Chuck Miller proposed that the system safety people from both industry and the military would benefit from a professional society that would promote the implementation of the system safety concept, and provide for an open exchange of ideas and technical concepts.

14

Chuck noted that other system related disciplines like reliability, maintainability and human factors had formed such organizations. The concern was expressed that if system safety became seen by top management as just a sub-element of one of these disciplines, it would likely never have the influence on the design or operation of aerospace systems necessary to reduce accidents and fatalities. Within a few months, Roger Lockwood was contacting key system safety people in the LA area for a small contribution for a fund to help establish some sort of association. Chuck and Roger invited the system safety practitioners in the area to USC for the graduation of their current class. It was at this gathering, on the 6th of December, 1963, that Roger announced he had obtained an initial state charter for a non-profit to be called the – “Aerospace System Safety Society”, with himself as president. I have from Roger, a listing of those who paid the initial dues, and thus can call themselves “Charter Members” of the Society. In 1964, Roger served as the first president, first treasurer, prepared and mailed the first newsletters of the Society, a truly pioneering effort.

15

Roger had earlier obtained his degree from USC, before being commissioned and becoming a pilot in the Air Force, specializing in search and rescue of forced down planes and crashes. He then became the accident investigating specialist for his wing, initiating an interest for proactive design safety. He remained active in the reserves for many years, obtaining the rank of Lt. Col before retiring. He indicated he still flies with a Civil Air Patrol organization when I visited with him earlier this month in San Pedro. He sends his greeting to you here at the 50th anniversary celebration. When I asked Roger for his photo to add to this slide, he provided these USC clips. I doubt if he is imbedded with this bevy of USC cheerleaders, so that must be Roger behind the face mask. This then constituted the charter meeting of the organization, now called the International System Safety Society. An event we here and now celebrate its golden jubilee anniversary year. That this organization with its humble beginning should be able to celebrate its 50th birthday, is a tribute to the extraordinary dedications of our pioneers to the survival and enhancement of the system safety concept. It may be difficult for many here today to fully appreciate the many obstacles encountered by these pioneers. Fifty years ago there were many who could not readily see the need for a new engineering discipline that addressed a subject that was felt to be already well covered by their own activity. As previously noted, it took a perfect storm of inter-relating influences to overcome the resistance to initiating something as radical as system safety into the established, powerful, and well supported world of quantifiable reliability engineering. The rocket scientist advising BSD management were far more comfortable with hard numbers generated by the reliability analyses, than the more qualitative out puts of the hazard analyses. To many, better safety was just a matter of getting a higher reliability number defined. I'm sure many of us have examples of when just the opposite was true - where the desire to meet a design reliability goal, introduced serious hazardous risks.

16

Leaving the history of the formative years of our society in the for a later time – let’s look again the elements of this unique and localized perfect storm formative years that slowly gathered during the cold war which brought birth to our society 50 years ago.

17

1. The panic fueled by sputnik, soviet success in manned space launches, and cold war concerns.

2. The rush to field ICBMs in protective silos

3. Embarrassing and costly explosive missile testing accidents.

18

4. The vision of system safety passed on by Chuck Miller to Col Ruff and others attending his classes at USC.

5. The demonstrated effectiveness of the initial system safety programs at Boeing

19

6. The release of BSD 62-41 & mil-s-38130

7. Air force/industry safety conferences. All culminating in the formation this self standing society of system safety professionals – not a sub-section of some other discipline’s organization It is my hope that this brief review will help renew the dedication of current ISSS members and officers toward continuing that vision - of providing improved freedom from unnecessary hazardous risks – in all types of endeavors, far afield from ICBMs - that our pioneering trailblazers marked out for us. Thank you, and may god’s blessing be with you all, and with this society.

20