The Three-Legged Stool (or the Golden Triangle)

The Three-Legged-Stool, or as I like to term it, the “Golden Triangle”, is an illustration used to describe the interdependent yet separate nature of the Program Manager, Chief Engineer, and Mission Assurance Manager (MAM) on a space system development program. The illustration brings to mind the idea of separate but equal leaders on the program, working collaboratively to succeed, and unable to individually achieve mission success. The reality, however, is not that simple, and often not that symbiotic. This can be a source of frustration for the MAM, as it is exceedingly difficult to excel in this job when the discipline is treated as an afterthought, or at best a bolt-on to the program, and not considered essential to success. But the truth is that, though the Three-Legged-Stool is descriptive of the relationship, it does not account for the fact that a program is not a democracy, the scope and funding of each functional area are not equal, and the assurance and specialty engineering disciplines represented under the mission assurance umbrella are not equally imperative to the engineering design of a delivered capability. Then why does the proverbial “stool” remain the ubiquitous depiction to describe the role and function of mission assurance on a program? Why is Mission Assurance and the role of MAM sometimes resisted by other program leaders? And what can a MAM do to overcome such resistance, and achieve the figurative three-legged-stool relationship? To answer these questions and elaborate further on the three-legged-stool relationship (and why I like to use the term “Golden Triangle”), it is necessary to first review the history of Mission Assurance and where the Three-Legged-Stool concept came from.

The formation of Mission Assurance as an integrated set of disciplines.

The story of Mission Assurance as a set of disciplines and Mission Assurance Management as a vocation is long and complex. Nor is it definitively known who founded Mission Assurance as we think of it. There isn’t even widespread agreement upon what the practice of Mission Assurance includes or even is! But to summarize the subject for this article, in the space industry, Mission Assurance is the process of ensuring that a space mission development program is executed safely, efficiently, and effectively, to produce a robust and reliable system that achieves the objectives of the end user. (For an expanded definition of Mission Assurance and its purpose, see my post “What is Mission Assurance?”). Although disciplines such as quality control and failure analysis have been around for a long time, the concept and terminology of Mission Assurance came about in the mid to late 1960s in connection with the Apollo program.

The subject matter area became more formalized and defined during the 1980s, particularly as a result of the findings from the formal investigation into the 1986 space shuttle Challenger disaster. The early 1980s was a period when the government aggressively incentivized and even pressured private industry and organizations like NASA to dramatically reduce the cost of space systems development, launch, and operations (sound familiar?). Driven by these pressures and by legislation such as President Ronald Reagan’s 1984 Commercial Space Launch Act, organizations knowingly reduced systems quality and reliability engineering activities as a means to cut cost and development timelines.

However, this heavily streamlined development and operations model was not embraced by NASA’s Jet Propulsion Laboratory (JPL), whose missions included the longest lifetimes and most challenging of space environments (e.g., Mariner, Viking, Pioneer, Voyager, Galileo, etc.), where reliability, redundancy, and the highest quality of workmanship were paramount to mission success. Because of these rigorous quality and reliability-focused requirements, (not to mention the public pressures to succeed due to the expensive and very visible nature of these missions), JPL created what they termed a “Mission Assurance Program”, organized to oversee the application of the reliability, quality, radiation, and safety engineering activities designed to ensure the success of JPL’s missions. This program also included the meticulous flow down and verification of these same requirements to their suppliers. I do not mean to suggest that such activities never happened before the implementation of this program, but in my research, JPL’s program is the first example of these, and other like disciplines being organized into a single program, managed by an experienced engineer, and set up independently from design engineering and program management in order to ensure the integrity of their efforts.

Mission Assurance and the role of the MAM arise.

As mentioned previously, the 1986 Challenger disaster functioned as a catalyst propelling Mission Assurance into the forefront as a critical discipline in space systems development. Results from the Rogers Commission, the investigation established by President Reagan and headed by Secretary of State William Rogers to determine and analyze the causes of the accident, cited findings the following findings direct contributors to the accident:

1. Over-reliance on past successes to qualify a design.
2. Lack of communication and transparency between mission stakeholders.
3. Poor risk management processes.
4. Inadequate reliability and failure analyses.
5. Inferior quality and safety practices.
6. Organizational pressures to meet cost and schedule targets.

All these deficiencies and more were directly addressed by the JPL Mission Assurance model which emphasized the independence of mission assurance from the program itself as a means to promote key mission success enabling engineering functions such as Quality Engineering, Systems Safety, Reliability Engineering, and Radiation Effects analysis. In response to the findings of the Rogers Commission, the other NASA centers were required to emulate JPL’s Mission Assurance program, and many industry partners followed soon after. Because of this Mission Assurance became what it is now, an independent program within a program led by an experienced manager and engineer, to manage Subject Matter Experts, enforce adherence to requirements and processes, contribute to Risk and Engineering Change Control Boards, and generally act as an independent reviewer for all mission key decisions and milestones. In short, the MAM became a strategic enabler, influencing programmatic practices, engineering technical approaches, and the management of risks crucial to mission success.

Adoption of the Three-Legged-Stool construct.

JPL was not the first organization to use the Three-Legged-Stool graphic as a method to describe the independence of several interdependence efforts to succeed. But they did begin and still do use the stool to describe the interrelation, independence, and essentiality of Program Management, Systems Engineering, and Mission Assurance, as critical to mission success. For a space systems development program to be successful three programmatic components must be diligently executed:

1. Program cost and schedule control.
2. Technical design and performance.
3. Risk and assurance management.

Expressed in simplest terms, program cost and schedule control are owned by program management, technical design and performance by the chief engineer, and risk and assurance management by the MAM. While in reality the control and execution of these functions is much more complicated, one can perceive the usefulness of a conceptual Three-Legged-Stool to describe the purposely separate, individual, yet critical interdependence of each of these functions to maximize the opportunity for mission success. On high-performing programs, these key leaders will expand their sphere of influence beyond their core areas and into the other elements, or “legs” of the stool. This is not to say that responsibility is transferred, rather, the knowledge and experience of the individual members will merge allowing for a high degree of trust, compromise, and operational effectiveness between the core functional areas of the program. In the best of circumstances, a program manager might assign the MAM to oversee the program while that person is on vacation. Or the chief engineer might leave the MAM to solve a technical problem affecting the program. Or the MAM might request either the program manager, chief engineer, or both to oversee aspects of the mission assurance program while out of the office, or unable to be assigned to the program full-time. This sharing of workloads is nice, but not the point of the Three-Legged-Stool construct. The point is that all three elements are required ingredients in the recipe for mission success, and the more trust, communication, technical authority, and mission ownership between these folks, the more efficient the program will be, and the higher the probability of mission success.

The “Golden Triangle” in place of the “Three-Legged-Stool”

Today the Three-Legged-Stool lives on, or at least as a similar representation. As I mentioned earlier, I personally like to use the “Golden Triangle”. I prefer this form of representation, firstly, because I have a hard time pairing the idea of a simple, wooden stool, with space flight programs.

On the other hand, a triangle has many mathematic, trigonometric, and philosophical qualities that apply to both engineering design and Mission Assurance Management. Furthermore, a triangle can still be used to illustrate the core concept of three individual functions required to accomplish a goal (the right amount of risk-mitigating measures, at just the right time to be most effective), let me explain further. Firstly, the Mission Assurance Golden Triangle has nothing to do with the “Golden Ratio”, the “Sacred Geometry”, the Fibonacci Sequence, or other intriguing mathematical relationships. My triangle is a Scalene (unequal sides and angles) triangle, the area of which can be thought of as the work required to complete a mission. The three sides can be thought of as the resources applied to perform the work (Program Management, Design Engineering, and Mission Assurance), and the height of this triangle is the risk posture of the mission, where a greater height equals lower risk, meaning more Mission Assurance resources applied given a fixed amount of Program Management and Engineering Design.

Notice again that the three sides are unequal, meaning that the necessary resources to complete the project are unequal. A technical program is not a democracy, and it is fair to say that the Management and Engineering functions are more critical to the completion of the work, if not the success of the mission. After all, no one designs a mission to fail, what they build they think will work. The purpose of Mission Assurance is to provide confidence that what they build will indeed be successful. The MAM is the integrator of the Mission Assurance functions and disciplines into the program, an independent reviewer, and a risk stakeholder for mission success. One can see how an engineer or a manager might not think that they need mission assurance to be successful. However, the proper ratio of Mission Assurance in proportion to Program Management and Design Engineering is critical to the overall achievement of Mission Success, inclusive of cost and schedule, for programs as complex and costly as the development of a space capability.

Then why is there sometimes resistance to the Three-Legged-Stool model, or even Mission Assurance in its entirety? 

For a business, it is not practical to implement the Three-Legged-Stool model, in exactly the same way as JPL intended. Mission Assurance and the MAM are entirely funded outside the program in most NASA centers and government agencies, allowing for maximum independence but in effect allowing for no cost or schedule constraints that otherwise bound the breadth and depth of Mission Assurance functions. Furthermore, many engineers have not had the opportunity to benefit from Mission Assurance and think they can perform the job by themselves, without independent review or specialty engineering. And when it comes down to it, any Program Manager worth their salt wants to perform as little work and spend as little money as possible to achieve success, and the proper application of Mission Assurance does cost time and money. Both responsibility and authority must be earned incrementally rather than granted, for example, a program manager is granted a charter by the president of the company explicitly granting that person authority over the budget, schedule, risk, and final engineering design of the project. These reasons and more sometimes contribute to Mission Assurance being considered the “Quality Police”, something that is “forced” on them, or otherwise viewed as an undesirable “tax” on the program driven by unnecessary program requirements. In my experience, people with these points of view simply have not had the experience of a good mission assurance team before or perhaps may have previously weathered the trials of a bad mission assurance team. In the for-profit space industry, the MAM generally is not granted a charter of responsibility and authority from the President, as is typically a Program Manager. Instead, while the Three-Legged-Stool model may be in effect in name, a MAM must earn the right to be the third leg of the stool and an influential leader in the program.

Achieving the Three-Legged-Stool, or “Golden Triangle”

This paradigm, while complicated and sometimes a source of frustration for the MAM, rewards successful communication and compromise, and facilitates a healthy push-pull relationship between the separate leadership functions of the program, resulting in a well-balanced risk position in alignment with that of the mission. Every MAM will have to overcome many obstacles along the way to becoming a true member of the Program Management Office, the conscience of the program, the voice of the customer, and a trusted risk manager. Some Program Managers and Chief Engineers will be more receptive to the MAM value proposition than others. Some programs, while requiring a few of the mission assurance disciplines, won’t necessarily benefit from, or possibly cannot afford to have a MAM. Persons in this field will find that the scope included with the MAM role will vary from program to program due to a variety of circumstances, some of which will not be under their control. I recommend MAMs earn their way into a true Three-Legged-Stool environment by acting as a mission partner, demonstrating value, building relationships, and architecting the Three-Legged-Stool program structure for themselves and appropriate to the mission. One won’t always be successful in this endeavor, and it could be frustrating when you’re putting in the effort and others are just not reciprocating, but the idea is to continuously strive for this ideal.