Risk Management Analysis<\/p>\n
Challenger Space Shuttle
\nMax of 4 pages of text plus cover page and reference page totaling 6 pages
\n1.5 line spacing 11 or 12 pnt font
\nMin of 4 sources \/ no max but be realistic in four pages of text<\/p>\n
Answer each of the following from the end of the paper:
\nRisk Management Plan
\nQ3
\nQ4<\/p>\n
Risk Identification
\nQ8
\nQ10<\/p>\n
Risk Quantification
\nQ16
\nQ17<\/p>\n
Risk Response (Risk Handling)
\nQ21
\nQ28<\/p>\n
Risk Control
\nQ35
\nQ42<\/p>\n
Support answers with current logic\/events and references\/citations
\nSome answers may only need two or three sentence answer while other questions will need more in-depth answering
\nSimple annotate which question you are answering without repeating the question as below:<\/p>\n
Q3: The best way to…..<\/p>\n
Q4: The office should have…..<\/p>\n
Q8: It depends on what…..<\/p>\n
THE SPACE SHUTTLE CHALLENGER DISASTER:
\nA CASE STUDY ON RISK MANAGEMENT
\nOn January 28, 1986, the Space Shuttle Challenger lifted off the launch pad at 11:38 a.m.,
\nbeginning the flight of mission 51-L.1 Approximately 74 seconds into the flight, the Challenger
\nwas engulfed in an explosive burn and all communication and telemetry ceased. Seven brave
\ncrewmembers lost their lives.<\/p>\n
On board the Challenger were Francis R. (Dick) Scobee<\/p>\n
[Commander], Michael John Smith [Pilot], Ellison S. Onizuka [Mission Specialist One], Judith
\nArlene Resnik [Mission Specialist Two], Ronald Erwin McNair [Mission Specialist Three], S.
\nChrista McAuliffe [Payload Specialist One], and Gregory Bruce Jarvis [Payload Specialist Two].
\nA faulty seal, or O-ring, on one of the two solid rocket boosters, caused the accident.
\nFollowing the accident, significant energy was expended trying to ascertain whether or
\nnot the accident was predictable. Controversy arose from the desire to assign, or to avoid, blame.
\nSome publications called it a management failure, specifically in risk management, while others
\ncalled it a technical failure.
\nWhenever accidents occurred in the past at NASA, an internal investigation team was
\nformed. But in this case, perhaps because of the visibility, the White House took the initiative in
\nappointing an independent commission. There did exist significant
\njustification for the commission. NASA was in a state of disarray, especially in the
\nCopyright 2001 by Dr. Harold Kerzner<\/p>\n
1<\/p>\n
The first digit indicates the fiscal year of the launch (i.e., \u201c5\u201d means 1985). The second number
\nindicates the launch site (i.e., \u201c1\u201d is the Kennedy Space Center in Florida, \u201c2\u201d is Vandenberg Air Force
\nBase in California). The letter represents the mission number (i.e., \u201cC\u201d would be the third mission
\nscheduled). This designation system was implemented after Space Shuttle flights one through nine,
\nwhich were designated STS-XX. STS is the Space Transportation System and XX would indicate the
\nflight number.<\/p>\n
Management ranks. The agency had been without a permanent administrator for almost four
\nmonths. The turnover rate at the upper echelons of management was significantly high, and
\nthere seemed to be a lack of direction from the top down.
\nAnother reason for appointing a Presidential Commission was the visibility of this
\nmission. This mission was highly publicized as the Teacher in Space mission with Christa
\nMcAuliffe, a Concord, New Hampshire schoolteacher selected from a list of over 10,000
\napplicants. The nation knew the names of all of the crewmembers on board Challenger. The
\nmission was highly publicized for months stating that Christa McAuliffe would be teaching
\nstudents from the Challenger on day four of the mission.
\nThe Presidential Commission consisted of the following members:
\nWilliam P. Rogers, Chairman: Former Secretary of State under President Nixon and
\nAttorney General under President Eisenhower.
\nNeil A. Armstrong, Vice Chairman: former astronaut and spacecraft commander for
\nApollo 11.
\nDavid C. Acheson: former Senior Vice President and General Counsel,
\nCommunications Satellite Corporation (1967-1974), and a partner in the law firm of
\nDrinker Biddle & Reath
\nDr. Eugene E. Covert: Professor and Head, Department of Aeronautics and
\nAstronautics at Massachusetts Institute of Technology.
\nDr. Richard P. Feynman: Physicist and Professor of Theoretical Physics at
\nCalifornia Institute of Technology; Nobel Prize winner in Physics, 1965.
\nRobert B. Hotz: Editor-in-chief of Aviation Week & Space Technology magazine
\n(1953-1980).
\nMajor General Donald J. Kutyna, USAF: Director of Space Systems and
\nCommand, Control, Communications.
\nDr. Sally K. Ride: Astronaut and mission specialist on STS-7, launched on June 18,
\n1983, becoming the first American woman in space. She also flew on mission 41-G
\nlaunched October 5, 1984. She holds a Doctorate in Physics form Stanford
\nUniversity (1978) and was still an active astronaut.
\nRobert W. Rummel: Vice President of Trans World Airlines and President of Robert
\nW. Rummel Associates, Inc., of Mesa, Arizona.
\nJoseph F. Sutter: Executive Vice President of the Boeing Commercial Airplane
\nCompany.
\nDr. Arthur B. C. Walker, Jr.: Astronomer and Professor of Applied Physics;
\nformerly Associate Dean of the Graduate Division at Stanford University, and<\/p>\n
-2-<\/p>\n
consultant to Aerospace Corporation, Rand Corporation and the National Science
\nFoundation.
\nDr. Albert D. Wheelon: Executive Vice President, Hughes Aircraft Company.
\nBrigadier General Charles Yeager, USAF (Retired): Former experimental test
\npilot. He was the first person to penetrate the sound barrier and the first to fly at a
\nspeed of more than 1,600 miles an hour.
\nDr. Alton G. Keel, Jr., Executive Director: Detailed to the Commission from his
\nposition in the Executive Office of the President, Office of Management and Budget,
\nas Associate Director for National Security and International Affairs; formerly
\nHelpant Secretary of the Air Force for Research, Development and Logistics, and
\nSenate Staff.
\nThe Commission interviewed more than 160 individuals, and more than 35 formal panel
\ninvestigative sessions were held generating almost 12,000 pages of transcript. Almost 6,300
\ndocuments totaling more than 122,000 pages, along with hundreds of photographs were
\nexamined and made a part of the Commission\u2019s permanent database and archives.<\/p>\n
These<\/p>\n
sessions and all the data gathered added to the 2,800 pages of hearing transcript generated by the
\nCommission in both closed and open sessions. Unless otherwise stated, all of the quotations and
\nmemos in this case study come from the direct testimony cited in the Report by the Presidential
\nCommission (RPC).<\/p>\n
BACKGROUND TO THE SPACE TRANSPORTATION SYSTEM
\nDuring the early 1960s, NASA\u2019s strategic plans for post-Apollo manned space
\nexploration rested upon a three-legged stool. The first leg was a reusable space transportation
\nsystem, the Space Shuttle, which could transport people and equipment to low earth orbits and
\nthen return to earth in preparation for the next mission. The second leg was a manned space
\nstation that would be re-supplied by the Space Shuttle and serve as a launch platform for space
\nresearch and planetary exploration. The third leg would be planetary exploration to Mars. But by
\nthe late 1960s, the United States was involved in the Vietnam War. The war was becoming<\/p>\n
-3-<\/p>\n
costly. In addition, confidence in the government was eroding because of civil unrest and
\nassassinations. With limited funding due to budgetary cuts, and the lunar landing missions
\ncoming to an end, prioritization of project ( help with nursing paper writing from experts with MSN & DNP degrees)s was necessary. With a Democratic Congress
\ncontinuously attacking the cost of space exploration, and minimal support from President Nixon,
\nthe space program was left standing on one leg only, the Space Shuttle.
\nPresident Nixon made it clear that funding for all programs would be impossible, and that
\nfunding for any program on the order of the Apollo Program was likewise not possible.
\nPresident Nixon seemed to favor the space station concept, but this required the development of
\na reusable Space Shuttle. Thus, NASA\u2019s Space Shuttle Program became the near-term priority.
\nOne of the reasons for the high priority given to the Space Shuttle program was a 1972
\nstudy completed by Dr. Oskar Morgenstern and Dr. Klaus Heiss of the Princeton based
\nMathematica organization. The study showed that the Space Shuttle could orbit payloads for as
\nlittle as $100 per pound based on 60 launches per year with payloads of 65,000 pounds. This
\nprovided tremendous promise for military applications such as reconnaissance and weather
\nsatellites, as well as scientific research.
\nUnfortunately, the pricing data was somewhat tainted. Much of the cost data was
\nprovided by companies that were hopeful of becoming NASA contractors and therefore provided
\nunrealistically low cost estimates in hopes of winning future bids. The actual cost per pound was
\nmore than 20 times the original estimate. Furthermore, the main engines never achieved the 109
\npercent of thrust that NASA desired, thus limiting the payloads to 47,000 pounds instead of the
\npredicted 65,000 pounds. In addition, the European Space Agency began successfully developing
\nthe capability to place satellites into orbit and began competing with NASA for the commercial
\nsatellite business.<\/p>\n
-4-<\/p>\n
NASA SUCCUMBS TO POLITICS AND PRESSURE
\nTo retain Shuttle funding, NASA was forced to make a series of major concessions. First,
\nfacing a highly constrained budget, NASA sacrificed the research and development necessary to
\nproduce a truly reusable Shuttle, and instead accepted a design that was only partially reusable,
\neliminating one of the features that made the Shuttle attractive in the first place. Solid rocket
\nboosters (SRBs) were used instead of safer liquid fueled boosters because they required a much
\nsmaller research and development effort. Numerous other design changes were made to reduce
\nthe level of research and development required.
\nSecond, to increase its political clout and to guarantee a steady customer base, NASA
\nenlisted the support of the United States Air Force.<\/p>\n
The Air Force could provide the<\/p>\n
considerable political clout of the Defense Department and had many satellites, which required
\nlaunching. However, Air Force support did not come without a price. The Shuttle payload bay
\nwas required to meet Air Force size and shape requirements, which placed key constraints on the
\nultimate design. Even more important was the Air Force requirement that the Shuttle be able to
\nlaunch from Vandenburg Air Force Base in California. This constraint required a larger cross
\nrange than the Florida site, which in turn decreased the total allowable vehicle weight. The
\nweight reduction required the elimination of the design\u2019s air breathing engines, resulting in a
\nsingle-pass unpowered landing. This greatly limited the safety and landing versatility of the
\nvehicle.2
\nAs the year 1986 began, there was extreme pressure on NASA to \u201cFly out the Manifest.\u201d
\nFrom its inception, the Space Shuttle Program had been plagued by exaggerated expectations,<\/p>\n
-5-<\/p>\n
funding inconsistencies, and political pressure. The ultimate vehicle and mission design were
\nshaped almost as much by politics as physics. President Kennedy\u2019s declaration, that the United
\nStates would land a man on the moon before the end of the decade, had provided NASA\u2019s
\nApollo Program with high visibility, a clear direction, and powerful political backing. The Space
\nShuttle Program was not as fortunate; it had neither a clear direction nor consistent political
\nbacking.
\nCost containment became a critical issue for NASA. In order to minimize cost, NASA
\ndesigned a Space Shuttle system that utilized both liquid and solid propellants. Liquid propellant
\nengines are more easily controllable than solid propellant engines. Flow of liquid propellant
\nfrom the storage tanks to the engine can be throttled and even shut down in case of an
\nemergency. Unfortunately, an all-liquid-fuel design was prohibitive because a liquid fuel system
\nis significantly more expensive to maintain than a solid fuel system.
\nSolid fuel systems are less costly to maintain. However, once a solid propellant system is
\nignited, it cannot be easily throttled or shut down. Solid propellant rocket motors burn until all
\nof the propellant is consumed. This could have a significant impact on safety, especially during
\nlaunch, at which time the solid rocket boosters are ignited and have maximum propellant loads.
\nAlso, solid rocket boosters can be designed for reusability whereas liquid engines are generally a
\none-time use.
\nThe final design that NASA selected was a compromise of both solid and liquid fuel
\nengines. The Space Shuttle would be a three-element system composed of the Orbiter vehicle,
\nan expendable external liquid fuel tank carrying liquid fuel for the Orbiter\u2019s engines, and two<\/p>\n
2<\/p>\n
Kurt Hoover and Wallace T. Fowler, (The University of Texas at Austin and The Texas Space Grant
\nConsortium) \u201cStudies in Ethics, Safety and Liability for Engineers,\u201d (web site:
\nhttps:\/\/monkessays.com\/write-my-essay\/tsgc.utexas.edu\/archive\/general\/ethics\/shuttle.html page 2.)
\n-6-<\/p>\n
recoverable solid rocket boosters.3<\/p>\n
The Orbiter\u2019s engines were liquid fuel because of the<\/p>\n
necessity for throttle capability. The two solid rocket boosters would provide the added thrust
\nnecessary to launch the Space Shuttle into its orbiting altitude.
\nIn 1972, NASA selected Rockwell as the prime contractor for building the Orbiter. Many
\nindustry leaders believed that other competitors who had actively participated in the Apollo
\nProgram had a competitive advantage.<\/p>\n
Rockwell, however, was awarded the contract.<\/p>\n
Rockwell\u2019s proposal did not include an escape system. NASA officials decided against the
\nlaunch escape system since it would have added too much weight to the Shuttle at launch and
\nwas very expensive. There was also some concern on how effective an escape system would be
\nif an accident occurred during launch while all of the engines were ignited. Thus, the Space
\nShuttle Program became the first U.S. manned spacecraft without a launch escape system for the
\ncrew.
\nIn 1973, NASA went out for competitive bidding for the solid rocket boosters. The
\ncompetitors were Morton-Thiokol, Inc. (MTI) [henceforth called Thiokol], Aerojet General,
\nLockheed, and United Technologies. The contract was eventually awarded to Thiokol because
\nof<\/p>\n
its<\/p>\n
low<\/p>\n
cost,<\/p>\n
$100<\/p>\n
million<\/p>\n
lower<\/p>\n
than<\/p>\n
the<\/p>\n
nearest<\/p>\n
competitor.<\/p>\n
Some<\/p>\n
believed that other competitors who ranked higher in technical design and safety should have
\nbeen given the contract. NASA believed that Thiokol-built solid rocket motors would provide
\nthe lowest cost per flight.<\/p>\n
THE SOLID ROCKET BOOSTERS<\/p>\n
3<\/p>\n
The terms \u201csolid rocket booster\u201d (SRB) and \u201csolid rocket motor\u201d (SRM) will be used interchangeably.
\n-7-<\/p>\n
Thiokol\u2019s solid rocket boosters had a height of approximately 150 feet and a diameter of
\n12 feet. The empty weight of each booster was 192,000 lbs. and the full weight was 1,300,000
\nlbs. Once ignited, each booster provided 2.65 million lbs. of thrust, which is more than 70
\npercent of the thrust needed to lift off the launch pad.
\nThiokol\u2019s design for the boosters was criticized by some of the competitors and even
\nNASA personnel. The boosters were to be manufactured in four segments and then shipped
\nfrom Utah to the launch site where the segments would be assembled into a single unit. The
\nThiokol design was largely based upon the segmented design of the Titan III solid rocket motor
\nproduced by United Technologies in the 1950s for Air Force satellite programs.<\/p>\n
Satellite<\/p>\n
programs were unmanned efforts.
\nThe four solid rocket sections made up the case of the booster, which essentially encased
\nthe rocket fuel and direct the flow of the exhaust gases. This is shown in Figure 1. The
\ncylindrical shell of the case is protected from the propellant by a layer of insulation. The mating
\nsections of the field joint are called the tang and the clevis. One hundred and seventy seven pins
\nspaced around the circumference of each joint hold the tang and the clevis together. The joint is
\nsealed in three ways. First, zinc chromate putty is placed in the gap between the mating
\nsegments and their insulation. This putty protects the second and third seals that are rubber-like
\nrings, called O-rings. The first<\/p>\n
-8-<\/p>\n
Figure 1. The Solid Rocket Booster<\/p>\n
-9-<\/p>\n
O-ring is called the primary O-ring and is lodged in the gap between the tang and the clevis. The
\nlast seal is called the secondary O-ring, which is identical to the primary O-ring except it is
\npositioned further downstream in the gap. Each O-ring is 0.280 inches in diameter. The
\nplacement of each O-ring can be seen in Figure 2. Another component of the field joint is called
\nthe leak check port, which is shown in Figure 3. The leak check port is designed to allow
\ntechnicians to check the status of the two O-ring seals. Pressurized air is inserted through the
\nleak check port into the gap between the two O-rings. If the O-rings maintain the pressure, and
\ndo not let the pressurized air past the seal, the technicians know the seal is operating properly.4
\nIn the Titan III assembly process, the joints between the segmented sections contained
\none O-ring. Thiokol\u2019s design had two O-rings instead of one. The second O-ring was initially
\nconsidered as redundant, but included to improve safety. The purpose of the O-rings was to seal
\nthe space in the joints such that the hot exhaust gases could not escape and damage the case of
\nthe boosters.
\nBoth the Titan III and Shuttle O-rings were made of Viton rubber, which is an
\nelastomeric material. For comparison, rubber is also an elastomer. The elastomeric material
\nused is a fluoroelastomer, which is an elastomer than contains fluorine. This material was
\nchosen because of its resistance to high temperatures and its compatibility with the surrounding
\nmaterials. The Titan III O-rings were molded in one piece whereas the Shuttle\u2019s SRB O-rings
\nwould be manufactured in five sections and then glued together. Routinely, repairs would be
\nnecessary for inclusions and voids in the rubber received from the material suppliers.<\/p>\n
4<\/p>\n
The Challenger Accident: Mechanical Causes of the Challenger Accident; University of Texas; (web site:
\nhttps:\/\/monkessays.com\/write-my-essay\/me.utexas.edu\/~uer\/challenger\/chall2.html pages 1-2.)
\n-10-<\/p>\n
Figure<\/p>\n
2.<\/p>\n
Location<\/p>\n
-11-<\/p>\n
Of<\/p>\n
The<\/p>\n
O-Rings<\/p>\n
Figure 3. Cross-Section Showing The Leak Test Port<\/p>\n
-12-<\/p>\n
BLOWHOLES
\nThe primary purpose of the zinc chromate putty was to act as a thermal barrier that
\nprotected the O-rings from the hot exhaust. As mentioned before, the O-ring seals were tested
\nusing the leak check port to pressurize the gap between the seals. During the test, the secondary
\nseal was pushed down into the same, seated position as it occupied during ignition
\npressurization. However, because the leak check port was between the two O-ring seals, the
\nprimary O-ring was pushed up and seated against the putty. The position of the O-rings during
\nflight and their position during the leak check test is shown in Figure 3.
\nDuring early flights, engineers worried that, because the putty above the primary seal
\ncould withstand high pressures, the presence of the putty would prevent the leak test from
\nidentifying problems with the primary seal. They contended that the putty would seal the gap
\nduring testing regardless of the condition of the primary seal. Since the proper operation of the
\nprimary seal was essential, engineers decided to increase the pressure used during the test to
\nabove the pressure that the putty could withstand. This would insure that the primary O-ring was
\nproperly sealing the gap without the aid of the putty. Unfortunately, during this new procedure,
\nthe high-test pressures blew holes through the putty before the primary O-ring could seal the gap.
\nSince the putty was on the interior of the assembled solid rocket booster, technicians could
\nnot mend the blowholes in the putty. As a result, this procedure left small, tunneled holes in the
\nputty. These holes would allow focused exhaust gases to contact a small segment of the primary
\nO-ring during launch. Engineers realized that this was a problem, but decided to test the seals at
\nthe high pressure despite the formation of blowholes, rather than risking a launch with a faulty
\nprimary seal.<\/p>\n
-13-<\/p>\n
The purpose of the putty was to prevent the hot exhaust gases from reaching the O-rings.
\nFor the first nine successful Shuttle launches, NASA and Thiokol used asbestos-bearing putty
\nmanufactured by the Fuller-O\u2019Brien Company of San Francisco. However, because of the
\nnotoriety of products containing asbestos, and the fear of potential lawsuits, Fuller-O\u2019Brien
\nstopped manufacturing the putty that had served the Shuttle so well. This created a problem for
\nNASA and Thiokol.
\nThe new putty selected came from Randolph Products of Carlstadt, New Jersey.
\nUnfortunately, with the new putty, blowholes and O-ring erosion were becoming more common
\nto a point where the Shuttle engineers became worried. Yet the new putty was still used on the
\nboosters. Following the Challenger disaster, testing showed that, at low temperatures, the
\nRandolph putty became much stiffer than the Fuller-O\u2019Brien putty and lost much of its
\nstickiness.5<\/p>\n
O-RING EROSION
\nIf the hot exhaust gases penetrate the putty and contact the primary O-ring, the extreme
\ntemperatures would break down the O-ring material. Because engineers were aware of the
\npossibility of O-ring erosion, the joints were checked after each flight for evidence of erosion.
\nThe amount of O-ring erosion found on flights before the new high-pressure leak check
\nprocedure was around twelve percent. After the new high pressure leak test procedure the
\npercentage of O-ring erosion was found to increase by eighty-eight percent. High percentages of
\nO-ring erosion in some cases allowed the exhaust gases to pass the primary O-ring and begin
\neroding the secondary O-ring.<\/p>\n
5<\/p>\n
Some managers argued that some O-ring erosion was<\/p>\n
Ibid; page 3.
\n-14-<\/p>\n
\u201cacceptable\u201d because the O-rings were found to seal the gap even if they were eroded by as
\nmuch as one-third their original diameter.6 The engineers believed that the design and operation
\nof the joints were an acceptable risk because a safety margin could be identified quantitatively.
\nThis numerical boundary would become an important precedent for future risk assessment.<\/p>\n
JOINT ROTATION
\nDuring ignition, the internal pressure from the burning fuel applies approximately 1000
\npounds per square inch on the case wall, causing the walls to expand. Because the joints are
\ngenerally stiffer than the case walls, each section tends to bulge out. The swelling of the solid
\nrocket sections causes the tang and the clevis to become misaligned; this misalignment is called
\njoint rotation. A diagram showing a field joint before and after joint rotation is shown in Figure
\n4. The problem with joint rotation is that it increases the gap size near the O-rings. This
\nincrease in size is extremely fast, which makes it difficult for the O-rings to follow the increasing
\ngap and keep the seal.7
\nPrior to ignition, the gap between the tang and the clevis is approximately 0.004 inches. At
\nignition, the gap will enlarge too between 0.042 and 0.060 inches, but for a maximum of 0.60
\nseconds, and then return to its original position.<\/p>\n
6
\n7<\/p>\n
Ibid; page 4.
\nIbid; page 4.
\n-15-<\/p>\n
Joint Rotation
\nGap Opening<\/p>\n
Tang<\/p>\n
(0.042 in. \u2013 0.060 in.)<\/p>\n
Primary O-Ring
\nSecondary O-Ring<\/p>\n
Pressurized Joint<\/p>\n
Unpressurized Joint<\/p>\n
Rotation Effect
\n(exaggerated)
\nPint = 1000 psig<\/p>\n
No Rotation
\nPint = 0 psig<\/p>\n
Clevis<\/p>\n
Figure 4. Field Joint Rotation<\/p>\n
-16-<\/p>\n
O-RING RESILIENCE
\nThe term O-ring resilience refers to the ability of the O-ring to return to its original shape
\nafter it has been deformed. This property is analogous to the ability of a rubber band to return to
\nits original shape after it has been stretched. As with a rubber band, the resiliency of an O-ring is
\ndirectly<\/p>\n
related<\/p>\n
to<\/p>\n
its<\/p>\n
temperature.<\/p>\n
As<\/p>\n
the<\/p>\n
temperature<\/p>\n
of<\/p>\n
the O-ring gets lower, the O-ring material becomes stiffer. Tests have shown that an O-ring at
\n75\u00b0F is five times more responsive in returning to its original shape than an O-ring at 30\u00b0F. This
\ndecrease in O-ring resiliency during a cold weather launch would make the O-ring much less
\nlikely to follow the increasing gap size during joint rotation.<\/p>\n
As a result of poor O-ring<\/p>\n
resiliency the O-ring would not seal properly.8<\/p>\n
THE EXTERNAL TANK
\nThe solid rockets are each joined forward and aft to the external liquid fuel tank.
\nThey are not connected to the Orbiter vehicle. The solid rocket motors are mounted first, and the
\nexternal liquid fuel tank is put between them and connected. Then the Orbiter is mounted to the
\nexternal tank at two places in the back and one place forward, and those connections carry all of
\nthe structural loads for the entire system at liftoff and through the ascent phase of flight. Also
\nconnected to the Orbiter, under the Orbiter\u2019s wing, are two large propellant lines 17 inches in
\ndiameter. The one on the port side carries liquid hydrogen from the hydrogen tank in the back
\npart of the<\/p>\n
8<\/p>\n
Ibid; pages 4-5.
\n-17-<\/p>\n
external tank. The line on the right side carries liquid oxygen from the oxygen tank at the
\nforward end, inside the external tank. (RPC, p. 50)
\nThe external tank contains about 1.6 million lbs. of propellant, or about 526,000 gallons.
\nThe Orbiter\u2019s three engines burn the liquid hydrogen and liquid oxygen at a ratio of 6:1 and at a
\nrate equivalent to emptying out a family swimming pool every 10 seconds! Once ignited, the
\nexhaust gases leave the Orbiter\u2019s three engines at approximately 6,000 miles per hour. After the
\nfuel is consumed, the external tank separates from the Orbiter, falls to earth and disintegrates in
\nthe atmosphere on re-entry.<\/p>\n
THE SPARE PARTS PROBLEM
\nIn March 1985, NASA\u2019s Administrator, James Beggs, announced that there would be one
\nShuttle flight per month for all of fiscal year 1985. In actuality, there were only six flights.
\nRepairs became a problem. Continuous repairs were needed on the heat tiles required for reentry, the braking system and the main engines\u2019 hydraulic pumps. Parts were routinely borrowed
\nfrom other Shuttles. The cost of spare parts was excessively high, and NASA was looking for
\ncost containment.<\/p>\n
RISK IDENTIFICATION PROCEDURES
\nThe necessity for risk management was apparent right from the start. Prior to the launch of
\nthe first Shuttle in April of 1981, hazards were analyzed and subjected to a formalized hazard
\nreduction process as described in NASA Hand Book, NHB5300.4. The process required that the
\ncredibility and probability of the hazards be determined. A Senior Safety Review Board was
\nestablished for overseeing the risk assessment process. For the most part, the risks assessment<\/p>\n
-18-<\/p>\n
process was qualitative. The conclusion reached was that no single hazard or combination of
\nhazards should prevent the launch of the first Shuttle as long as the aggregate risk remains
\nacceptable.
\nNASA used a rather simplistic Safety (Risk) Classification System. A quantitative method
\nfor risk assessment was not in place at NASA because the data needed to generate statistical
\nmodels would be expensive and labor-intensive. If the risk identification procedures were overly
\ncomplex, NASA would have been buried in paperwork due to the number of components on the
\nSpace Shuttle. The risk classification system selected by NASA is shown below:<\/p>\n
Level<\/p>\n
Description<\/p>\n
Criticality 1 (C1)<\/p>\n
Loss of life and\/or vehicle if the component fails.<\/p>\n
Criticality 2 (C2)<\/p>\n
Loss of mission if the component fails.<\/p>\n
Criticality 3 (C3)<\/p>\n
All others<\/p>\n
Criticality 1R (C1R)
\nCriticality 2R (C2R)<\/p>\n
Redundant components exist. The failure of both
\ncould cause loss of life and\/or vehicle.
\nRedundant components exist. The failure of both
\ncould cause loss of mission.<\/p>\n
From 1982 on, the O-ring seal was labeled Criticality 1. By 1985, there were 700
\ncomponents identified as Criticality 1.<\/p>\n
TELECONFERENCING<\/p>\n
-19-<\/p>\n
The Space Shuttle Programs involves a vast number of people at both NASA and the
\ncontractors. Because of the geographical separation between NASA and the contractors, it
\nbecame impractical to have continuous meetings. Travel between Thiokol in Utah and the Cape
\nin Florida was one day\u2019s travel each way. Therefore, teleconferencing became the primary
\nmethod of communication and a way of life. Interface meetings were still held, but the emphasis
\nwas on teleconferencing. All locations could be linked together in one teleconference and data
\ncould be faxed back and forth as needed.<\/p>\n
THE PAPERWORK CONSTRAINTS
\nWith the rather optimistic flight schedule provided to the news media, NASA was under
\nscrutinization and pressure to deliver. For fiscal 1986, the mission manifest called for 16 flights.
\nThe pressure to meet schedule was about to take its toll. Safety problems had to be resolved
\nquickly.
\nAs the number of flights scheduled began to increase, so did the requirements for
\nadditional paperwork. The majority of the paperwork had to be completed prior to NASA\u2019s
\nFlight Readiness Review meetings (FRR). Prior to every flight (approximately one week), flight
\noperations and cargo managers were required to endorse the commitment of flight readiness to
\nthe NASA Associate Administrator for Space Flight at the Flight Readiness Review meetings.
\nThe responsible project ( help with nursing paper writing from experts with MSN & DNP degrees)\/element managers would conduct pre-FFR meetings with their
\ncontractors, center managers and the NASA Level II manager. The content of the FFR meetings
\nincluded:
\n\u2022<\/p>\n
Overall status, plus establishing the baseline in terms of significant changes since the last
\nmission.<\/p>\n
-20-<\/p>\n
\u2022<\/p>\n
Review significant problems resolved since the last review, and significant anomalies
\nfrom the previous flight.<\/p>\n
\u2022<\/p>\n
Review all open items and constraints remaining to be resolved before the mission.<\/p>\n
\u2022<\/p>\n
Present all new waivers since the last flight.<\/p>\n
NASA personnel were working excessive overtime, including weekends, to fulfill the
\npaperwork requirements and prepare for the required meetings. As the number of space flights
\nincreased, so did the paperwork and overtime.
\nThe paperwork constraints were affecting the contractors as well. Additional paperwork
\nrequirements existed for problem solving and investigations. On October 1, 1985 an Interoffice
\nMemo was sent from Scott Stein, Space Booster Project Engineer at Thiokol to Bob Lund, Vice
\nPresident for Engineering at Thiokol, and to other selected managers concerning the O-ring
\nInvestigation Task Force:
\nWe are currently being hog-tied by paperwork every time we try to
\naccomplish anything. I understand that for production programs, the
\npaperwork is necessary. However, for a priority, short schedule
\ninvestigation, it makes accomplishment of our goals in a timely
\nmanner extremely difficult, if not impossible. We need the authority to
\nbypass some of the paperwork jungle. As a representative example
\nof problems and time that could easily be eliminated, consider
\nassembly or disassembly of test hardware by manufacturing
\npersonnel. \u2026\u2026 I know the established paperwork procedures can
\nbe violated if someone with enough authority dictates it. We did that
\nwith the DR system when the FWC hardware \u201cTiger Team\u201d was
\nestablished. If changes are not made to allow us to accomplish work
\nin a reasonable amount of time, then the O-ring investigation task
\nforce will never have the potency necessary to resolve problems in a
\ntimely manner.
\nBoth NASA and the contractors were now feeling the pressure caused by the paperwork
\nconstraints.<\/p>\n
-21-<\/p>\n
ISSUING WAIVERS
\nOne quick way of reducing paperwork and meetings was to issue a waiver. Historically a
\nwaiver was a formalized process that allows an exception either to a rule, specification, technical
\ncriteria or risk. Waivers were ways to reduce excessive paperwork requirements. Project
\nmanagers and contract administrators had the authority to issue waivers, often with the intent of
\nbypassing standard protocols in order to maintain a schedule. The use of waivers had been in
\nplace well before the manned space program even began. What is important here was NOT
\nNASA\u2019s use of the waiver, but the JUSTIFICATION for the waiver given the risks.
\nNASA had issued waivers on both Criticality 1 status designations and launch constraints.
\nIn 1982, the solid rocket boosters were designated C1 by the Marshall Space Flight Center
\nbecause failure of the O-rings could have caused loss of crew and the Shuttle. This meant that
\nthe secondary O-rings were not considered redundant. The SRB Project Manager at Marshall,
\nLarry Malloy, issued a waiver just in time for the next Shuttle launch to take place as planned.
\nLater, the O-rings designation went from C1 to C1R, (i.e. a redundant process) thus partially
\navoiding the need for a waiver. The waiver was a necessity to keep the Shuttle flying according
\nto the original manifest.
\nHaving a risk identification of C1 was not regarded as a sufficient reason to cancel a launch.
\nIt simply meant that component failure could be disastrous. It implied that this might be a
\npotential problem that needed attention. If the risks were acceptable, NASA could still launch.
\nA more serious condition was the issuing of launch constraints. Launch constraints were official
\nNASA designations for situations in which mission safety was a serious enough problem to<\/p>\n
-22-<\/p>\n
justify a decision not to launch. But once again, a launch constraint did not imply that the launch
\nshould be delayed. It meant that this was an important problem and needed to be addressed.
\nFollowing the 1985 mission that showed O-ring erosion and exhaust gas blow-by, a launch
\nconstraint was imposed. Yet on each of the next five Shuttle missions, NASA\u2019s Malloy issued a
\nlaunch constraint waiver allowing the flights to take place on schedule without any changes to
\nthe O-rings.
\nWere the waivers a violation of serious safety rules just to keep the Shuttle flying The
\nanswer is NO! NASA had protocols such as policies, procedures and rules for adherence to
\nsafety.<\/p>\n
Waivers were also protocols but for the purpose of deviating from other existing<\/p>\n
protocols. Neither Larry Malloy, his colleagues at NASA, or the contractors had any intentions
\nof doing evil.<\/p>\n
Waivers were simply a way of saying that we believe that the risk is an<\/p>\n
ACCEPTABLE RISK.
\nThe lifting of launch constraints and the issuance of waivers became the norm or standard
\noperating procedure. Waivers became a way of life. If waivers were issued and the mission was
\ncompleted successfully, then the same waivers would exist for the next flight and did not have to
\nbe brought up for discussion at the Flight Readiness Review meeting. The justification for the
\nwaivers seemed to be the similarity between flight launch conditions, temperature, etc.
\nLaunching under similar conditions seemed to be important for the engineers at NASA and
\nThiokol because it meant that the forces acting on the O-rings were within their region of
\nexperience and could be correlated to existing data. The launch temperature effect on the Orings was considered predictable and therefore constituted an acceptable risk to both NASA and
\nThiokol, thus perhaps eliminating costly program delays in having to redesign the O-rings. The
\ncompletion of each Shuttle mission added another data point to the region of experience thus<\/p>\n
-23-<\/p>\n
guaranteeing the same waivers on the next launch. Flying with acceptable risk became the norm
\nin NASA\u2019s culture.<\/p>\n
LAUNCH LIFTOFF SEQUENCE PROFILE: POSSIBLE ABORTS
\nDuring the countdown to liftoff, the launch team closely monitors weather conditions, not
\nonly at the launch site, but also at touchdown sites should the mission need to be prematurely
\naborted.
\nDr. Frynman: Would you explain why we are so sensitive to the
\nweather
\nMr. Moore (NASA\u2019s Deputy Administrator for Space Flight):
\nYes, there are several reasons. I mentioned the return to the
\nlanding site. We need to have visibility if we get into a situation
\nwhere we need to return to the landing site after launch, and the
\npilots and the commanders need to be able to see the runway and
\nso forth. So, you need a ceiling limitation on it [i.e. weather].
\nWe also need to maintain specifications on wind velocity so we
\ndon\u2019t exceed crosswinds. Landing on a runway and getting too
\nhigh of a crosswind may cause us to deviate off of the runway and
\nso forth, so we have a crosswind limit. During assent, assuming a
\nnominal flight, a chief concern is damage to tiles due to rain. We
\nhave had experiences in seeing what the effects of a brief shower
\ncan do in terms of the tiles. The tiles are thermal insulation blocks,
\nvery thick. A lot of them are very thick on the bottom of the
\nOrbiter. But if you have a raindrop and you are going at a very
\nhigh velocity, it tends to erode the tiles, pock the tiles, and that
\ncauses us a grave concern regarding the thermal protection.
\nIn addition to that, you are worried about the turnaround time of
\nthe Orbiters as well, because with the kind of tile damage that one
\ncould get in rain, you have an awful lot of work to do to go back
\nand replace tiles back on the system. So, there are a number of
\nconcerns that weather enters into, and it is a major factor in our
\nassessment of whether or not we are ready to launch. (RPC, p. 18)<\/p>\n
-24-<\/p>\n
Approximately six to seven seconds prior to the liftoff, the Shuttle\u2019s main engines (liquid
\nfuel) ignite. These engines consume one half million gallons of liquid fuel. It takes nine hours
\nprior to launch to fill the liquid fuel tanks. At ignition, the engines are throttled up to 104 percent
\nof rated power. Redundancy checks on the engines\u2019 systems are then made. The launch site
\nground complex and the Orbiter\u2019s onboard computer complex check a large number of details
\nand parameters about the main engines to make sure that everything are proper and that the main
\nengines are performing as planned.
\nIf a malfunction is detected, the system automatically goes into a shutdown sequence, and
\nthe mission is scrubbed. The primary concern at this point is to make the vehicle \u201csafe.\u201d The
\ncrew remains on board and performs a number of functions to get the vehicle into a safe mode.
\nThis includes making sure that all propellant and electrical systems are properly safed. Ground
\ncrews at the launch pad begin servicing the launch pad. Once the launch pad is in a safe
\ncondition, the hazard and safety teams begin draining the remaining liquid fuel out of the
\nexternal tank.
\nIf no malfunction is detected during this six-second period of liquid fuel burn, then a
\nsignal is sent to ignite the two solid rocket boosters and liftoff occurs. For the next two minutes,
\nwith all engines ignited, the Shuttle goes through a Max Q or high dynamic pressure phase that
\nexerts maximum pressure loads on the Orbiter vehicle. Based upon the launch profile, the main
\nengines may be throttled down slightly during the Max Q phase to lower the loads.
\nAfter 128 seconds into the launch sequence, all of the solid fuel is expended and the solid
\nrocket boosters (SRBs) staging occurs. The SRB parachutes are deployed. The SRBs then fall
\nback to earth 162 miles from the launch site and are recovered for examination, cleaning, and
\nreuse on future missions. The main liquid fuel engines are then throttled up to maximum power.<\/p>\n
-25-<\/p>\n
After 523 seconds into the liftoff, the external liquid fuel tanks are essentially expended of fuel.
\nThe main engines are shut down. Ten to 18 seconds later, the external tank is separated from the
\nOrbiter and disintegrates on re-entry into the atmosphere.
\nFrom a safety perspective, the most hazardous period is the first 128 seconds when the SRB
\nare ignited. According to Arnold Aldrich, Manager, NASA\u2019s STS Program, Johnson Space
\nCenter:
\nOnce the Shuttle System starts off the launch pad, there is no
\ncapability in the system to separate these [solid propellant] rockets
\nuntil they reach burnout. They will burn for two minutes and eight
\nor nine seconds, and the system must stay together. There is not a
\ncapability built into the vehicle that would allow these to separate.
\nThere is a capability available to the flight crew to separate at this
\ninterface the Orbiter from the tank, but that is thought to be
\nunacceptable during the first stage when the booster rockets are on
\nand thrusting. So, essentially the first two minutes and a little
\nmore of flight, the stack is intended and designed to stay together,
\nand it must stay together to fly successfully.
\nMr. Hotz: Mr. Aldrich, why is it unacceptable to separate the
\nOrbiter at that stage
\nMr. Aldrich: It is unacceptable because of the separation
\ndynamics and the rupture of the propellant lines. You cannot
\nperform the kind of a clean separation required for safety in the
\nproximity of these vehicles at the velocities and the thrust levels
\nthey are undergoing, [and] the atmosphere they are flying through.
\nIn that regime, it is the design characteristic of the total system.
\n(RPC, p. 51)
\nIf an abort is deemed necessary during the first 128 seconds, the actual abort will not
\nbegin until AFTER SRB staging has occurred, which is after 128 seconds into the launch
\nsequence. Based upon the reason and timing of an abort, options include:
\nType of Abort
\nOnce-Around Abort
\nTransatlantic Abort
\nTransatlantic Abort
\nReturn-to-Landing-Site<\/p>\n
Landing Site
\nEdwards Air Force Base
\nDaKar
\nCasablanca
\n(RTLS) Kennedy Space Center<\/p>\n
-26-<\/p>\n
Arnold Aldrich commented on different abort profiles:
\nChairman Rogers: During the two-minute period, is it possible to
\nabort through the Orbiter
\nMr. Aldrich: You can abort for certain conditions. You can start
\nan abort, but the vehicle won\u2019t do anything yet, and the intended
\naborts are build around failures in the main engine system, the
\nliquid propellant systems and their controls. If you have a failure
\nof a main engine, it is well detected by the crew and by the ground
\nsupport, and you can call for a return-to-launch-site abort. That
\nwould be logged in the computer. The computer would be set up to
\nexecute it, but everything waits until the solids take you to altitude.
\nAt that time, the solids will separate in the sequence I described,
\nand then the vehicle flies downrange some 400 miles, maybe 10 to
\n15 additional minutes, while all of the tank propellant is expelled
\nthrough these engines.
\nAs a precursor to setting up the conditions for this return-tolaunch-site abort to be successful towards the end of that burn
\ndownrange, using the propellants and the thrust of the main
\nengines, the vehicle turns and actually points heads up back
\ntowards Florida. When the tank is essentially depleted, automatic
\nsignals are sent to close off the [liquid] propellant lines and to
\nseparate the Orbiter, and the Orbiter then does a similar approach
\nto the one we are familiar with with orbit back to the Kennedy
\nSpace Center for approach and landing.
\nDr. Walker: So, the propellant is expelled but not burned
\nMr. Aldrich: No, it is burned. You burn the system on two
\nengines all the way down-range until it is gone, and then you turn
\naround and come back because you don\u2019t have enough to burn to
\norbit. That is the return-to-launch-site abort, and it applies during
\nthe first 240 seconds of \u2013 no, 240 is not right. It is longer than that
\n\u2013 the first four minutes, either before or after separation you can
\nset that abort up, but it will occur after the solids separate, and if
\nyou have a main engine anomaly after the solids separate, at that
\ntime you can start the RTLS, and it will go through that same
\nsequence and come back.
\nDr. Ride: And you can also only do an RTLS if you have lost just
\none main engine. So if you lose all three main engines, RTLS isn\u2019t
\na viable abort mode.<\/p>\n
-27-<\/p>\n
Mr. Aldrich: Once you get through the four minutes, there\u2019s a
\nperiod where you now don\u2019t have the energy conditions right to
\ncome back, and you have a forward abort, and Jesse mentioned the
\nsites in Spain and on the coast of Africa. We have what is called a
\ntrans-Atlantic abort, and where you can use a very similar
\nsequence to the one I just described. You still separate the solids,
\nyou still burn all the propellant out of the tanks, but you fly across
\nand land across the ocean.
\nMr. Hotz: Mr. Aldrich, could you recapitulate just a bit here Is
\nwhat you are telling us that for two minutes of flight, until the
\nsolids separate, there is not practical abort mode
\nMr. Aldrich: Yes, sir.
\nMr. Hotz: Thank you.
\nMr. Aldrich: A trans-Atlantic abort can cover a range of just a
\nfew seconds up to about a minute in the middle where the acrossthe-ocean sites are effective, and then you reach this abort oncearound capability where you go all the way around and land in
\nCalifornia or back to Kennedy by going around the earth. And
\nfinally, you have abort-to-orbit where you have enough propulsion
\nto make orbit but not enough to achieve the exact orbital
\nparameters that you desire. That is the way that the abort profiles
\nare executed.
\nThere are many, many nuances of crew procedure and different
\nconditions and combinations of sequences of failures that make it
\nmuch more complicated than I have described it. (RPC pp. 51-52)<\/p>\n
THE O-RING PROBLEM
\nThere were two kinds of joints on the Shuttle \u2013 field joints that were assembled at the
\nlaunch site connecting together the SRB\u2019s cylindrical cases, and nozzle joints that connected the
\naft end of the case to the nozzle. During the pressure of ignition, the field joints could become
\nbent such that the secondary O-ring could lose contact within an estimated 0.17 to 0.33 seconds
\nafter ignition. If the primary O-ring failed to seal properly before the gap within the joints
\nopened up and the secondary seal failed, the results could be disastrous.<\/p>\n
-28-<\/p>\n
When the solid propellant boosters are recovered after separation, they are disassembled
\nand checked for damage. The O-rings could show evidence of coming into contact with heat.
\nHot gases from the ignition sequence could blow by the primary O-ring briefly before sealing.
\nThis \u201cblow-by\u201d phenomenon could last for only a few milliseconds before sealing and result in
\nno heat damage to the O-ring. If the actual sealing process takes longer than expected, then
\ncharring and erosion of the O-rings can occur. This would be evidenced by gray or black soot
\nand erosion to the O-rings. The terms used are impingement erosion and \u201cby-pass\u201d erosion with
\nthe latter identified also as sooted \u201cblow-by.\u201d
\nRoger Boisjoly of Thiokol describes blow-by erosion and joint rotation as follows:
\nO-ring material gets removed from the cross section of the O-ring
\nmuch, much faster than when you have bypass erosion or blow-by,
\nas people have been terming it. We usually use the characteristic
\nblow-by to define gas past it, and we use the other term [bypass
\nerosion] to indicate that we are eroding at the same time. And so
\nyou can have blow-by without erosion, [and] you [can] have blowby with erosion. (RPC, pp. 784-85)
\nAt the beginning of the transient cycle [initial ignition rotation, up
\nto 0.17 seconds] . . . [the primary O-ring] is still being attacked by
\nhot gas, and it is eroding at the same time it is trying to seal, and it
\nis a race between, will it erode more than the time allowed to have
\nit seal. (RPC, p. 136)
\nOn January 24, 1985, STS 51-C [Flight No. 15] was launched at 51\u00b0F, which was the
\nlowest temperature of any launch up to that time. Analyses of the joints showed evidence of
\ndamage. Black soot appeared between the primary and secondary O-rings. The engineers
\nconcluded that the cold weather had caused the O-rings to harden and move more slowly. This
\nallowed the hot gases to blow by and erode the O-rings. This scorching effect indicated that low
\ntemperature launches could be disastrous.<\/p>\n
-29-<\/p>\n
On July 31, 1985, Roger Boisjoly of Thiokol sent an interoffice memo to R. K. Lund,
\nVice President for Engineering, at Thiokol:
\nThis letter is written to insure that management is fully aware of the
\nseriousness of the current O-ring erosion problem in the SRM joints
\nfrom an engineering standpoint.
\nThe mistakenly accepted position on the joint problem was to fly
\nwithout fear of failure and to run a series of design Assessments
\nwhich would ultimately lead to a solution or at least a significant
\nreduction of the erosion problem. This position is now drastically
\nchanged as a result of the SRM 16A nozzle joint erosion which
\neroded a secondary O-ring with the primary O-ring never sealing.
\nIf the same scenario should occur in a field joint (and it could), then
\nit is a jump ball as to the success or failure of the joint because the
\nsecondary O-ring cannot respond to the clevis opening rate and may
\nnot be capable of pressurization. The result would be a catastrophe
\nof the highest order \u2013 loss of human life.
\nAn unofficial team (a memo defining the team and its purpose was
\nnever published) with [a] leader was formed on 19 July 1985 and
\nwas tasked with solving the problem for both the short and long
\nterm. This unofficial team is essentially nonexistent at this time.
\nIn my opinion, the team must be officially given the responsibility
\nand the authority to execute the work that needs to be done on a
\nnon-interference basis (full time assignment until completed).
\nIt is my honest and very real fear that if we do not take immediate
\naction to dedicate a team to solve the problem with the field joint
\nhaving the number one priority, then we stand in jeopardy of losing
\na flight along with all the launch pad facilities. (RPC, p. 691-692)
\nOn August 9, 1985, a letter was sent from Brian Russell, Manager of the SRM Ignition
\nSystem, to James Thomas at the Marshall Space Flight Center. The memo addressed the
\nfollowing:
\nPer your request, this letter contains the answers to the two
\nquestions you asked at the July Problem Review Board telecon.
\n1. Question: If the field joint secondary seal lifts off the metal
\nmating surfaces during motor pressurization, how soon will it
\nreturn to a position where contact is re-established<\/p>\n
-30-<\/p>\n
Answer: Bench test data indicates that the O-ring resiliency
\n(its capability to follow the metal) is a function of temperature
\nand rate of case expansion. MTI [Thiokol] measured the force
\nof the O-ring against Instron plattens, which simulated the
\nnominal squeeze on the O-ring and approximated the case
\nexpansion distance and rate.
\nAt 100\u00b0F, the O-ring maintained contact. At 75\u00b0F, the O-ring
\nlost contact for 2.4 seconds. At 50\u00b0F, the O-ring did not reestablish contact in 10 minutes at which time the test was
\nterminated.
\nThe conclusion is that secondary sealing capability in the SRM
\nfield joint cannot be guaranteed.
\n2. Question: If the primary O-ring does not seal, will the
\nsecondary seal seat in sufficient time to prevent joint leakage
\nAnswer: MTI has no reason to suspect that the primary seal
\nwould ever fail after pressure equilibrium is reached; i.e., after
\nthe ignition transient. If the primary O-ring were to fail from 0
\nto 170 milliseconds, there is a very high probability that the
\nsecondary O-ring would hold pressure since the case has not
\nexpanded appreciably at this point. If the primary seal were to
\nfail from 170 to 330 milliseconds, the probability of the
\nsecondary seal holding is reduced.
\nFrom 330 to 600
\nmilliseconds the chance of the secondary seal holding is small.
\nThis is a direct result of the O-ring\u2019s slow response compared
\nto the metal case segments as the joint rotates. (RPC, pp.
\n1568-1569)
\nAt NASA, the concern for a solution to the O-ring problem became not only a technical
\ncrisis, but also a budgetary crisis. In a July 23, 1985, memorandum from Richard Cook,
\nProgram Analyst, to Michael Mann, Chief of the STS Resource Analysis Branch, the impact of
\nthe problem was noted:
\nEarlier this week you asked me to investigate reported problems
\nwith the charring of seals between SRB motor segments during
\nflight operations. Discussions with program engineers show this to
\nbe a potentially major problem affecting both flight safety and
\nprogram costs.<\/p>\n
-31-<\/p>\n
Presently three seals between SRB segments use double O-rings
\nsealed with putty. In recent Shuttle flights, charring of these rings
\nhas occurred. The O-rings are designed so that if one fails, the
\nother will hold against the pressure of firing. However, at least in
\nthe joint between the nozzle and the aft segment, not only has the
\nfirst O-ring been destroyed, but the second has been partially eaten
\naway.
\nEngineers have not yet determined the cause of the problem.
\nCandidates include the use of a new type of putty (the putty
\nformerly in use was removed from the market by EPA because it
\ncontained asbestos), failure of the second ring to slip into the
\ngroove which must engage it for it to work properly, or new, and
\nas yet unidentified, assembly procedures at Thiokol. MSC is trying
\nto identify the cause of the problem, including on-site investigation
\nat Thiokol, and OSF hopes to have some results from their analysis
\nwithin 30 days. There is little question, however, that flight safety
\nhas been and is still being compromised by potential failure of the
\nseals, and it is acknowledged that failure during launch would
\ncertainly be catastrophic. There is also indication that staff
\npersonnel knew of this problem sometime in advance of
\nmanagement\u2019s becoming apprised of what was going on.
\nThe potential impact of the problem depends on the as yet
\nundiscovered cause. If the cause is minor, there should be little or
\nno impact on budget or flight rate. A worse case scenario,
\nhowever, would lead to the suspension of Shuttle flights, redesign
\nof the SRB, and scrapping of existing stockpiled hardware. The
\nimpact on the FY 1987-8 budget could be immense.
\nIt should be pointed out that Code M management [NASA\u2019s
\nAssociate Administrator for Space Flight] is viewing the situation
\nwith the utmost seriousness. From a budgetary standpoint, I would
\nthink that any NASA budget submitted this year for FY 1987 and
\nbeyond should certainly be based on a reliable judgment as to the
\ncause of the SRB seal problem and a corresponding decision as to
\nbudgetary action needed to provide for its solution.\u201d (RPC, pp.
\n391-392)
\nOn October 30, 1985, NASA launched Flight STS 61-A [Flight no. 22] at 75\u00b0F.<\/p>\n
This<\/p>\n
flight also showed signs of sooted blow-by, but the color was significantly blacker. Although
\nthere was some heat effect, there was no measurable erosion observed on the secondary O-ring.
\nSince blow-by and erosion now occurred at a higher launch temperature, the original premise<\/p>\n
-32-<\/p>\n
that launches under cold temperatures were a problem was now being questioned. Table 1 shows
\nthe temperature at launch of all the Shuttle flights up to this time and the O-ring damage, if any.
\nManagement at both NASA and Thiokol wanted concrete evidence that launch
\ntemperature was directly correlated to blow-by and erosion. Other than simply a \u201cgut feel\u201d,
\nengineers were now stymied on how to show the direct correlation. NASA was not ready to
\ncancel a launch simply due to an engineer\u2019s \u201cgut feel\u201d.
\nWilliam Lucas, Director of the Marshall Space Center, made it clear that NASA\u2019s
\nmanifest for launches would be adhered to. Managers at NASA were pressured to resolve
\nproblems internally rather than to escalate them up the chain of command. Managers became
\nafraid to inform anyone higher up that they had problems, even though they knew that one
\nexisted.<\/p>\n
-33-<\/p>\n
Table 1
\nErosion and Blow-by History
\n(Temperature in ascending order from coldest to warmest)
\nFlight<\/p>\n
Date<\/p>\n
Temperature Erosion Blow-by
\nComments
\n\u00b0F
\nIncidents Incidents
\n____ _______ _________ _____ ______ ___________________________
\n51-C 01\/24\/85
\n53
\n3
\n2
\nMost erosion any flight; blow-by;
\nsecondary O-rings heated up
\n41-B 02\/03\/84
\n57
\n1
\nDeep, extensive erosion
\n61-C 01\/12\/86
\n58
\n1
\nO-rings erosion
\n41-C 04\/06\/84
\n63
\n1
\nO-rings heated but no damage
\n1
\n04\/12\/81
\n66
\nCoolest launch without problems
\n6
\n04\/04\/83
\n67
\n51-A 11\/08\/84
\n67
\n51-D 04\/12\/85
\n67
\n5
\n11\/11\/82
\n68
\n3
\n03\/22\/82
\n69
\n2
\n11\/12\/81
\n70
\n1
\nExtent of erosion unknown
\n9
\n11\/28\/83
\n70
\n41-D 08\/30\/84
\n70
\n1
\n51-G 06\/17\/85
\n70
\n7
\n06\/18\/83
\n72
\n8
\n08\/30\/83
\n73
\n51-B 04\/29\/85
\n75
\n61-A 10\/20\/85
\n75
\n2
\nNo erosion but soot between O-rings
\n51-I 08\/27\/85
\n76
\n61
\n11\/26\/85
\n76
\n41-G 10\/05\/84
\n78
\n51-J 10\/03\/85
\n79
\n4
\n06\/27\/82
\n80
\nNo data; casing lost at sea
\n51-F 07\/29\/85
\n81<\/p>\n
-34-<\/p>\n
Richard Feynman, Nobel laureate and member of the Rogers Commission, concluded that a
\nNASA official altered the safety criteria so that flights could be certified on time under pressure
\nimposed by the leadership of William Lucas. Feynman commented:
\n\u2026 They, therefore, fly in a relatively unsafe condition with a
\nchance of failure of the order of one percent. Official management
\nclaims to believe that the probability of failure is a thousand times
\nless.
\nWithout concrete evidence of the temperature effect on the O-rings, the secondary O-ring
\nwas regarded as a redundant safety constraint and the criticality factor was changed from C1 to
\nC1R. Potentially serious problems were treated as anomalies peculiar to a given flight. Under
\nthe guise of anomalies, NASA began issuing waivers to maintain the flight schedules. Pressure
\nwas placed upon contractors to issue closure reports. On December 24, 1985, L. O. Wear
\n[NASA\u2019s SRM Program Office Manager] sent a letter to Joe Kilminster, Thiokol\u2019s Vice
\nPresident for the Space Booster Program:
\nDuring a recent review of the SRM Problem Review Board open
\nproblem list I found that we have 20 open problems, 11 opened
\nduring the past 6 months, 13 open over 6 months, 1 three years old,
\n2 two years old, and 1 closed during the past six months. As you
\ncan see our closure record is very poor. You are requested to
\ninitiate the required effort to assure more timely closures and the
\nMTI personnel shall cordinate directly with the S&E personnel the
\ncontents of the closure reports. (RPC, p. 1554)<\/p>\n
PRESSURE, PAPERWORK AND WAIVERS
\nTo maintain the flight schedule, critical issues such as launch constraints had to be
\nresolved or waived.<\/p>\n
This would require extensive documentation.<\/p>\n
During the Rogers<\/p>\n
Commission investigation, there seemed to be a total lack of coordination between NASA\u2019s<\/p>\n
-35-<\/p>\n
Marshall Space Center and Thiokol. Joe Kilminster, Thiokol\u2019s Vice President for the Space
\nBooster Program, testified:
\nMr. Kilminster: Mr. Chairman, if I could, I would like to respond
\nto that. In response to the concern that was expressed \u2013 and I had
\ndiscussions with the team leader, the task force team leader, Mr.
\nDon Kettner, and Mr. Russell and Mr. Ebeling. We held a meeting
\nin my office and that was done in the October time period where
\nwe called the people who were in a support role to the task team,
\nas well as the task force members themselves.
\nIn that discussion, some of the task force members were looking to
\ncircumvent some of our established systems. In some cases, that
\nwas acceptable; in other cases, it was not. For example, some of
\nthe work that they had recommended to be done was involved with
\nfull-scale hardware, putting some of these joints together with
\nvarious putty layup configurations; for instance, taking them apart
\nand finding out what we could from that inspection process.
\nDr. Sutter: Was that one of these things that was outside of the
\nnormal work, or was that accepted as a good idea or a bad idea
\nMr. Kilminster: A good idea, but outside the normal work, if you
\nwill.
\nDr. Sutter: Why not do it
\nMr. Kilminster: Well, we were doing it. But the question was,
\ncan we circumvent the system, the paper system that requires, for
\ninstance, the handling constraints on those flight hardware items
\nAnd I said no, we can\u2019t do that. We have to maintain our handling
\nsystem, for instance, so that we don\u2019t stand the possibility of
\ninjuring or damaging a piece of flight hardware.
\nI asked at that time if adding some more people, for instance, a
\nsafety engineer \u2013 that was one of the things we discussed in there.
\nThe consensus was no, we really didn\u2019t need a safety engineer.
\nWe had the manufacturing engineer in attendance who was in
\nsupport of that role, and I persuaded him that, typical of the way
\nwe normally worked, that he should be calling on the resources
\nfrom his own organization, that is, in Manufacturing, in order to
\nget this work done and get it done in a timely fashion.
\nAnd I also suggested that if they ran across a problem in doing
\nthat, they should bubble that up in their management chain to get<\/p>\n
-36-<\/p>\n
help in getting the resources to get that done. Now, after that
\nsession, it was my impression that there was improvement based
\non some of the concerns that had been expressed, and we did get
\nquite a bit of work done. For your Assessment, I would like to talk
\na little bit about the sequence of events for this task force.
\nChairman Rogers: Can I interrupt Did you know at that time it
\nwas a launch constraint, a formal launch constraint
\nMr. Kilminster: Not an overall launch constraint as such. Similar
\nto the words that have been said before, each Flight Readiness
\nReview had to address any anomalies or concerns that were
\nidentified at previous launches and in that sense, each of those
\nanomalies or concerns were established in my mind as launch
\nconstraints unless they were properly reviewed and agreed upon by
\nall parties.
\nChairman Rogers: You didn\u2019t know there was a difference
\nbetween the launch constraint and just considering it an anomaly
\nYou thought they were the same thing
\nMr. Kilminster: No, sir. I did not think they were the same thing.
\nChairman Rogers: My question is: Did you know that this
\nlaunch constraint was placed on the flights in July 1985
\nMr. Kilminster: Until we resolved the O-ring problem on that
\nnozzle joint, yes. We had to resolve that in a fashion for the
\nsubsequent flight before we would be okay to fly again.
\nChairman Rogers: So you did know there was a constraint on
\nthat
\nMr. Kilminster: On a one flight per one flight basis; yes, sir.
\nChairman Rogers: What else would a constraint mean
\nMr. Kilminster: Well, I get the feeling that there\u2019s a perception
\nhere that a launch constraint means all launches, whereas we were
\naddressing each launch through the Flight Readiness Review
\nprocess as we went.
\nChairman Rogers: No, I don\u2019t think–the testimony that we\u2019ve
\nhad is that a launch constraint is put on because it is a very serious
\nproblem and the constraint means don\u2019t fly unless it\u2019s fixed or
\ntaken care of, but somebody has the authority to waive it for a<\/p>\n
-37-<\/p>\n
particular flight. And in this case, Mr. Mulloy was authorized to
\nwaive it, which he did, for a number of flights before 51-L. Just
\nprior to 51-L, the papers showed the launch constraint was closed
\nout, which I guess means no longer existed. And that was done on
\nJanuary 23, 1986. Now, did you know that sequence of events
\nMr. Kilminster: Again, my understanding of closing out, as the
\nterm has been used here, was to close it out on the problem actions
\nlist, but not as an overall standard requirement. We had to address
\nthese at subsequent Flight Readiness Reviews to insure that we
\nwere all satisfied with the proceeding to launch.
\nChairman Rogers: Did you understand the waiver process, that
\nonce a constraint was placed on this kind of a problem, that a flight
\ncould not occur unless there was a formal waiver
\nMr. Kilminster: Not in the sense of a formal waiver, no, sir.
\nChairman Rogers: Did any of you
\ndocuments saying that<\/p>\n
Didn\u2019t you get the<\/p>\n
Mr. McDonald: I don\u2019t recall seeing any documents for a formal
\nwaiver. (RPC, pp. 1577-1578)<\/p>\n
MISSION 51-L
\nOn January 25, 1986, questionable weather caused a delay of Mission 51-L to January
\n27. On January 26, the launch was reconfirmed for 9:37 a.m. on the 27th. However, on the
\nmorning of January 27, a malfunction with the hatch, combined with high crosswinds, caused
\nanother delay. All preliminary procedures had been completed and the crew had just boarded
\nwhen the first problem appeared. A microsensor on the hatch indicated that the hatch was not
\nshut securely. It turned out that the hatch was shut securely but the sensor had malfunctioned.
\nValuable time was lost in determining the problem.
\nAfter the hatch was finally closed, the external handle could not be removed. The threads
\non the connecting bolt were stripped and instead of cleanly disengaging when turned, simply
\nspun around. Attempts to use a portable drill to remove the handle failed. Technicians on the
\n-38-<\/p>\n
scene asked Mission Control for permission to saw off the bolt. Fearing some form of structural
\nstress to the hatch, engineers made numerous time-consuming calculations before giving the goahead to cut off the bolt. The entire
\nprocess consumed almost two hours before the countdown resumed.
\nHowever, the misfortunes continued. During the attempts to verify the integrity of the
\nhatch and remove the handle, the wind had been steadily rising. Chief Astronaut John Young
\nflew a series of approaches in the Shuttle training aircraft and confirmed the worst fears of
\nmission control. The crosswinds at the Cape were excess of the level allowed for the abort
\ncontingency. The opportunity had been missed. The mission was then reset to launch the next
\nday, January 28, at 9:38 a.m. Everyone was quite discouraged since extremely cold weather was
\nforecast for Tuesday that could further postpone the launch.9
\nWeather conditions indicated that the temperature at launch could be as low as 26\u00b0F.
\nThis would be much colder and well below the temperature range that the O-rings were designed
\nto<\/p>\n
operate<\/p>\n
in.<\/p>\n
The<\/p>\n
components<\/p>\n
of<\/p>\n
the<\/p>\n
solid<\/p>\n
rocket<\/p>\n
motors<\/p>\n
were<\/p>\n
qualified only to 40\u00b0F at the lower limit. Undoubtedly, when the sun would come up and launch
\ntime approached, both the air temperature and vehicle would warm up, but there was still
\nconcern. Would the ambient temperature be high enough to meet the launch requirements
\nNASA\u2019s Launch Commit Criteria stated that no launch should occur at temperatures below 31\u00b0F.
\nThere were also worries over any permanent effects on the
\nShuttle due to the cold overnight temperatures. NASA became concerned and asked Thiokol for
\ntheir recommendation on whether or not to launch. NASA admitted under testimony that if
\nThiokol had recommended not launching, then the launch would not have taken place.<\/p>\n
9<\/p>\n
Hoover and Wallace; pages 3-4.
\n-39-<\/p>\n
At 5:45 p.m. eastern standard time, a teleconference was held between the Kennedy
\nSpace Center, Marshall Space Flight Center and Thiokol.<\/p>\n
Bob Lund, Vice President for<\/p>\n
Engineering, summarized the concerns of the Thiokol engineers that in Thiokol\u2019s opinion, the
\nlaunch should be delayed until noontime or even later such that a launch temperature of at least
\n53\u00b0F could be achieved. Thiokol\u2019s engineers were concerned that no data was available for
\nlaunches at this temperature of 26\u00b0F. This was the first time in 14 years that Thiokol had
\nrecommended not to launch.
\nThe design validation tests originally done by Thiokol covered only a narrow temperature
\nrange. The temperature data did not include any temperatures below 53\u00b0F. The O-rings from
\nFlight 51-C, which had been launched under cold conditions the previous year, showed very
\nsignificant erosion. This was the only data available on the effects of cold, but all of the Thiokol
\nengineers agreed that the cold weather would decrease the elasticity of the synthetic rubber Orings, which in turn might cause them to seal slowly and allow hot gases to surge through the
\njoint.10
\nAnother teleconference was set up for 8:45 p.m. to invite more parties to be involved in the
\ndecision. Meanwhile, Thiokol was asked to fax all relevant and supporting charts to all parties
\ninvolved in the 8:45 p.m. teleconference.
\nThe following information was included in the pages that were faxed:
\nBlow-by History:
\nSRM-15 Worst Blow-by
\n2 case joints (80\u00b0), (110\u00b0) Arc
\nMuch worse visually than SRM-22
\nSRM-22 Blow-by
\n2 case joints (30-40\u00b0)
\n10<\/p>\n
Ibid; page 4.
\n-40-<\/p>\n
SRM-13A, 15, 16A, 18, 23A, 24A
\nNozzle blow-by
\nField Joint Primary Concerns \u2013 SRM-25
\n A temperature lower than the current data base results in changing primary Oring sealing timing function
\nSRM-15A – 80\u00b0 arc black grease between O-rings
\nSRM-15B – 110\u00b0 arc black grease between O-rings
\nLower O-ring squeeze due to lower temp
\nHigher O-ring shore hardness
\nThicker grease viscosity
\nHigher O-ring pressure activation time
\nIf actuation time increases, threshold of secondary seal pressurization
\ncapability is approached
\nIf threshold is reached then secondary seal may not be capable of being
\npressurized
\nConclusions:
\nTemperature of O-ring is not only parameter controlling blow-by
\nSRM-15 with blow-by had an O-ring temp at 53\u00b0F
\nSRM-22 with blow-by had an O-ring temp at 75\u00b0F
\nFour development motors with no blow-by were tested at O-ring
\ntemp of 47\u00b0 to 52\u00b0F
\nDevelopment motors had putty packing which resulted in better
\nperformance
\nAt about 50\u00b0F blow-by could be experienced in case joints
\nTemp for SRM-25 on 1-28-86 launch will be: 29\u00b0F 9 a.m.
\n38\u00b0F 2 p.m.
\nHave no data that would indicate SRM-25 is different than SRM-15 other than
\ntemp
\nRecommendations:
\nO-ring temp must be = 53\u00b0F at launch
\nDevelopment motors at 47\u00b0 to 52\u00b0F with putty packing had no
\nblow-by
\nSRM-15 (the best simulation) worked at 53\u00b0
\nProject ambient conditions (temp & wind) to determine launch time
\nFrom NASA\u2019s perspective, the launch window was from 9:30 a.m. to 12:30 p.m. on
\nJanuary 28th. This was based upon weather conditions and visibility, not only at the launch site
\nbut also at the landing sites should an abort be necessary. An additional consideration was the
\nfact that the temperature might not reach 53\u00b0F prior to the launch window closing. Actually, the
\n-41-<\/p>\n
temperature at the Kennedy Space Center was not expected to reach 50\u00b0F until two days later.
\nNASA was hoping that Thiokol would change their minds and recommend launch.<\/p>\n
THE SECOND TELECONFERENCE
\nAt the second teleconference, Bob Lund once again asserted Thiokol\u2019s recommendation
\nnot to launch below 53\u00b0F. NASA\u2019s Mulloy then burst out over the teleconference network:
\n\u201c My God, Morton Thiokol! When do you want me to launch \u2013
\nnext April\u201d
\nNASA challenged Thiokol\u2019s interpretation of the data and argued that Thiokol was
\ninappropriately attempting to establish a new Launch Commit Criterion just prior to launch.
\nNASA asked Thiokol to re-evaluate their conclusions. Crediting NASA\u2019s comments with some
\nvalidity, Thiokol then requested a five-minute off-line caucus. In the room at Thiokol were 14
\nengineers, namely:
\nJerald Mason, Senior Vice President, Wasatch Operations
\nCalvin Wiggins, Vice President and General Manager, Space Division
\nJoe C. Kilminster, Vice President, Space Booster Programs
\nRobert K. Lund, Vice President, Engineering
\nLarry H. Sayer, Director, Engineering and Design
\nWilliam Macbeth, Manager, Case Projects, Space Booster Project
\nDonald M. Ketner, Supervisor, Gas Dynamics Section and Head Seal Task Force
\nRoger Boisjoly, Member, Seal Task Force
\nArnold R. Thompson, Supervisor, Rocket Motor Cases
\nJack R. Kapp, Manager, Applied Mechanics Department
\nJerry Burn, Associate Engineer, Applied Mechanics
\nJoel Maw, Associate Scientist, Heat Transfer Section
\nBrian Russell, Manager, Special Projects, SRM Project
\nRobert Ebeling, Manager, Ignition System and Final Assembly, SRB Project
\nThere were no safety personnel in the room because nobody thought to invite them. The
\ncaucus lasted some 30 minutes. Thiokol (specifically Joe Kilminster) then returned to the<\/p>\n
-42-<\/p>\n
teleconference stating that they were unable to sustain a valid argument that temperature affects
\nO-ring blow-by and erosion. Thiokol then reversed its position and was now recommending
\nlaunch.
\nNASA stated that the launch of the Challenger would not take place without Thiokol\u2019s
\napproval. But when Thiokol reversed its position following the caucus and agreed to launch,
\nNASA interpreted this as an acceptable risk. The launch would now take place.
\nMr. McDonald (Thiokol): The assessment of the data was that the
\ndata was not totally conclusive, that the temperature could affect
\neverything relative to the seal. But there was data that indicated
\nthat there were things going in the wrong direction, and this was
\nfar from our experience base.
\nThe conclusion being that Thiokol was directed to reassess all the
\ndata because the recommendation was not considered acceptable at
\nthat time of [waiting for] the 53 degrees [to occur]. NASA asked
\nus for a reassessment and some more data to show that the
\ntemperature in itself can cause this to be a more serious concern
\nthan we had said it would be. At that time Thiokol in Utah said
\nthat they would like to go off-line and caucus for about five
\nminutes and reassess what data they had there or any other
\nadditional data.
\nAnd that caucus lasted for, I think, a half hour before they were
\nready to go back on. When they came back on they said they had
\nreassessed all the data and had come to the conclusions that the
\ntemperature influence, based on the data they had available to
\nthem, was inconclusive and therefore they recommended a launch.
\n(RPC, p. 300)
\nDuring the Rogers Commission testimony, NASA\u2019s Mulloy stated his thought process in
\nrequesting Thiokol to rethink their position:
\nGeneral Kutyna: You said the temperature had little effect
\nMr. Mulloy: I didn\u2019t say that. I said I can\u2019t get a correlation
\nbetween O-ring erosion, blow-by and O-ring, and temperature.
\nGeneral Kutyna: 51-C was a pretty cool launch.
\nJanuary of last year.<\/p>\n
-43-<\/p>\n
That was<\/p>\n
Mr. Mulloy: It was cold before then but it was not that much
\ncolder than other launches.
\nGeneral Kutyna: So it didn\u2019t approximate this particular one
\nMr. Mulloy: Unfortunately, that is one you look at and say, aha,
\nis it related to a temperature gradient and the cold. The
\ntemperature of the O-ring on 51-C, I believe, was 53 degrees. We
\nhave fired motors at 48 degrees. (RPC, p. 290)
\nMulloy asserted he had not pressured Thiokol into changing their position. Yet, the
\ntestimony of Thiokol\u2019s engineers stated they believed they were being pressured.
\nRoger Boisjoly, one of Thiokol\u2019s experts on O-rings, was present during the caucus and
\nvehemently opposed the launch. During testimony, Boisjoly described his impressions of what
\noccurred during the caucus:
\nThe caucus was started by Mr. Mason stating that a management
\ndecision was necessary. Those of us who were opposed the launch
\ncontinued to speak out, and I am specifically speaking of Mr.
\nThompson and myself because in my recollection, he and I were
\nthe only ones who vigorously continued to oppose the launch. And
\nwe were attempting to go back and rereview and try to make clear
\nwhat we were trying to get across, and we couldn\u2019t understand why
\nit was going to be reversed.
\nSo, we spoke out and tried to explain again the effects of low
\ntemperature. Arnie actually got up from his position which was
\ndown the table and walked up the table and put a quad pad down in
\nfront of the table, in front of the management folks, and tried to
\nsketch out once again what his concern was with the joint, and
\nwhen he realized he wasn\u2019t getting through, he just stopped.
\nI tried one more time with the photos. I grabbed the photos and I
\nwent up and discussed the photos once again and tried to make the
\npoint that it was my opinion from actual observations that
\ntemperature was indeed a discriminator, and we should not ignore
\nthe physical evidence that we had observed.
\nAnd again, I brought up the point that SRM-15 had a 110 degree
\narc of black grease while SRM-22 had a relatively different<\/p>\n
-44-<\/p>\n
amount, which was less and wasn\u2019t quite as black. I also stopped
\nwhen it was apparent that I could not get anybody to listen.
\nDr. Walker: At this point did anyone else [i.e. engineers] speak
\nup in favor of the launch
\nMr. Boisjoly: No, sir. No one said anything, in my recollection.
\nNobody said a word. It was then being discussed amongst the
\nmanagement folks. After Arnie and I had our last say, Mr. Mason
\nsaid we have to make a management decision. He turned to Bob
\nLund and asked him to take off his engineering hat and put on his
\nmanagement hat. From this point on, management formulated the
\npoints to base their decision on. There was never one comment in
\nfavor, as I have said, of launching by any engineer or other
\nnonmanagement person in the room before or after the caucus. I
\nwas not even asked to participate in giving any input to the final
\ndecision charts.
\nI went back on the net with the final charts or final chart, which
\nwas the rationale for launching, and that was presented by Mr.
\nKilminster. It was handwritten on a notepad, and he read from that
\nnotepad. I did not agree with some of the statements that were
\nbeing made to support the decision. I was never asked nor polled,
\nand it was clearly a management decision from that point.
\nI must emphasize, I had my say, and I never take any management
\nright to take the input of an engineer and then make a decision
\nbased upon that input, and I truly believe that. I have worked at a
\nlot of companies, and that has been done from time to time, and I
\ntruly believe that, and so there was no point in me doing anything
\nany further [other] than [what] I had already attempted to do.
\nI did not see the final version of the chart until the next day. I just
\nheard it read. I left the room feeling badly defeated, but I felt I
\nreally did all I could to stop the launch. I felt personally that
\nmanagement was under a lot of pressure to launch, and they made
\na very tough decision, but I didn\u2019t agree with it.
\nOne of my colleagues who was in the meeting summed it up best.
\nThis was a meeting where the determination was to launch, and it
\nwas up to us to prove beyond a shadow of a doubt that it was not
\nsafe to do so. This is in total reverse to what the position usually is
\nin a preflight conversation or a Flight Readiness Review. It is
\nusually exactly opposite that.<\/p>\n
-45-<\/p>\n
Dr. Walker: Do you know the source of the pressure on
\nmanagement that you alluded to
\nMr. Boisjoly: Well, the comments made over the net are what I
\nfelt. I can\u2019t speak for them, but I felt it. I felt the tone of the
\nmeeting exactly as I summed up, that we were being put in a
\nposition to prove that we should not launch rather than being put in
\nthe position and prove that we had enough data to launch. (RPC,
\np. 793-794)
\nGeneral Kutyna: What was the motivation driving those who
\nwere trying to overturn your opposition
\nMr. Boisjoly: They felt that we had not demonstrated, or I had not
\ndemonstrated, because I was the prime mover in SRM-15. Because
\nof my personal observations and involvement in the Flight
\nReadiness Reviews, they felt that I had not conclusively
\ndemonstrated that there was a tie-in between temperature and
\nblow-by.
\nMy main concern was if the timing function changed and that seal
\ntook longer to get there, then you might not have any seal left
\nbecause it might be eroded before it seats. And then, if that timing
\nfunction is such that it pushes you from the 170 millisecond region
\ninto the 330 second region, you might not have a secondary seal to
\npick up if the primary is gone. That was my major concern.
\nI can\u2019t quantify it. I just don\u2019t know how to quantify that. But I
\nfelt that the observations made were telling us that there was a
\nmessage there telling us that temperature was a discriminator, and I
\ncouldn\u2019t get that point across. I basically had no direct input into
\nthe final recommendation to launch, and I was not polled.
\nI think Astronaut Crippin hit the tone of the meeting exactly right
\non the head when he said that the opposite was true of the way the
\nmeetings were normally conducted. We normally have to
\nabsolutely prove beyond a shadow of a doubt that we have the
\nability to fly, and it seemed like we were trying to prove, have
\nproved that we had data to prove that we couldn\u2019t fly at this time,
\ninstead of the reverse. That was the tone of the meeting, in my
\nopinion. (RPC, p. 676)
\nJerald Mason, Senior Vice President at Thiokol\u2019s Wasatch Division directed the caucus at
\nThiokol. Mason continuously asserted that a management decision was needed and instructed<\/p>\n
-46-<\/p>\n
Bob Lund, Vice President for Engineering, to take off his engineering hat and put on his
\nmanagement hat. During testimony, Mason commented on his interpretation of the data:
\nDr. Ride [a member of the Commission]: You know, what we\u2019ve
\nseen in the charts so far is that the data was inconclusive and so
\nyou said go ahead.
\nMr. Mason: . . . I hope I didn\u2019t convey that. But the reason for
\nthe discussion was the fact that we didn\u2019t have enough data to
\nquantify the effect of the cold, and that was the heart of our
\ndiscussion . . . We have had blow-by on earlier flights. We had not
\nhad any reason to believe that we couldn\u2019t experience it again at
\nany temperature . . . (RPC, p. 764)
\nAt the end of the second teleconference, NASA\u2019s Hardy at Marshall Space Flight Center
\nrequested that Thiokol put their recommendation to launch in writing and fax it to both Marshall
\nSpace Flight Center and Kennedy Space Center. The memo (shown below) was signed by Joe
\nKilminster, Vice President for Thiokol\u2019s Space Booster Program, and faxed at 11:45 p.m. the
\nnight before the launch.
\nCalculations show that SRM-25 O-rings will be 20\u00b0 colder than
\nSRM-15 O-rings
\nTemperature data not conclusive on predicting primary O-ring
\nblow-by
\nEngineering assessment is that:
\nColder O-rings will have increased effective durometer
\n(\u201charder\u201d)
\n\u201cHarder\u201d O-rings will take longer to \u201cseat\u201d
\nMore gas may pass primary O-ring before the primary
\nseal seats (relative to SRM-15)
\nDemonstrated sealing threshold is 3 times greater
\nthan 0.038\u201d erosion experienced on SRM-15
\nIf the primary seal does not seat, the secondary seal will
\nseat
\nPressure will get to secondary seal before the metal
\nparts rotate
\nO-ring pressure leak check places secondary seal
\nin outboard position which minimizes sealing
\ntime
\nMTI recommends STS-51L launch proceed on 28 January
\n1986<\/p>\n
-47-<\/p>\n
SRM-25 will not be significantly different from SRM-15<\/p>\n
THE ICE PROBLEM
\nAt 1:30 a.m. on the day of the launch, NASA\u2019s Gene Thomas, launch director, ordered a
\ncomplete inspection of the launch site due to cold weather and severe ice conditions. The prelaunch inspection of the Challenger and the launch pad by the ice-team was unusual to say the
\nleast. The ice-team\u2019s responsibility was to remove any frost or ice on the vehicle or launch
\nstructure. What they found during their inspection looked like something out of a science fiction
\nmovie. The freeze protection plan implemented by Kennedy personnel had gone very wrong.
\nHundreds of icicles, some up to 16 inches long, clung to the launch structure. The handrails and
\nwalkways near the Shuttle entrance were covered in ice, making them extremely dangerous if the
\ncrew had to make an emergency evacuation. One solid sheet of ice stretched from the 195 foot
\nlevel to the 235 foot level on the gantry. However, NASA continued to cling to its calculations
\nthat there would be no damage due to flying ice shaken loose during the launch.11 A decision
\nwas then made to delay the launch from 9:38 a.m. to 11:30 a.m. so that the ice on the launch pad
\ncould melt. The delay was still within the launch window of 9:30 a.m. \u2013 12:30 p.m.
\nAt 8:30 a.m., a second ice inspection was made. Ice was still significantly present at the
\nlaunch site. Robert Glaysher, Vice President for Orbital Operations at Rockwell, stated that the
\nlaunch was unsafe. Rockwell\u2019s concern was that falling ice could damage the heat tiles on the
\nOrbiter. This could have a serious impact during reentry.
\nAt 10:30 a.m., a third ice inspection was made. Though some of the ice was beginning to
\nmelt, there was still significant ice on the launch pad. The temperature of the left solid rocket
\nbooster was measured at 33\u00b0F and the right booster was measured at 19\u00b0F. Even though the<\/p>\n
-48-<\/p>\n
right booster was 34 degrees colder than Thiokol\u2019s original recommendation for a launch
\ntemperature (i.e., 53\u00b0F), no one seemed alarmed. Rockwell also agreed to launch even though
\ntheir earlier statement was that the launch was unsafe.
\nArnold Aldrich, Manager of the STS Program at the Johnson Space Center, testified on the
\nconcern over the ice problem:
\nMr. Aldrich: Kennedy facility people at that meeting, everyone in
\nthat meeting, voted strongly to proceed and said they had no
\nconcern, except for Rockwell. The comment to me from
\nRockwell, which was not written specifically to the exact words,
\nand either recorded or logged, was that they had some concern
\nabout the possibility of ice damage to the Orbiter. Although it was
\na minor concern, they felt that we had no experience base
\nlaunching in this exact configuration before, and therefore they
\nthought we had some additional risk of Orbiter damage from ice
\nthan we had on previous meetings, or from previous missions.
\nChairman Rogers: Did they sign off on it or not
\nMr. Aldrich: We don\u2019t have a sign-off at that point. It was not\u2014
\nit was not maybe 20 minutes, but it was close to that. It was within
\nthe last hour of launch.
\nChairman Rogers: But they still objected
\nMr. Aldrich: They issued what I would call a concern, a less than
\n100 percent concurrence in the launch. They did not say we do not
\nwant to launch, and the rest of the team over-ruled them. They
\nissued a more conservative concern. They did not say don\u2019t
\nlaunch.
\nGeneral Kutyna: I can\u2019t recall a launch that I have had where
\nthere was 100 percent certainty that everything was perfect, and
\neveryone around the table would agree to that. It is the job of the
\nlaunch director to listen to everyone, and it\u2019s our job around the
\ntable to listen and say there is this element of risk, and you
\ncharacterize this as 90 percent, or 95, and then you get a consensus
\nthat that risk is an acceptable risk, and then you launch.
\nSo I think this gentleman is characterizing the degree of risk, and
\nhe\u2019s honest, and he had to say something.
\n11<\/p>\n
Ibid; page 5.
\n-49-<\/p>\n
Dr. Ride: But one point is that their concern is a specific concern,
\nand they weren\u2019t concerned about the overall temperature or
\ndamage to the solid rockets or damage to the external tank. They
\nwere worried about pieces of ice coming off and denting the tile.
\n(RPC, pp. 237-238)
\nFollowing the accident, the Rogers Commission identified three major concerns about the
\nice-on-the-pad issue:
\n1. An analysis of all of the testimony and interviews established that Rockwell\u2019s
\nrecommendation on launch was ambiguous.<\/p>\n
The Commission found it<\/p>\n
difficult, as did Mr. Aldrich, to conclude that there was a no-launch
\nrecommendation. Moreover, all parties were asked specifically to contact
\nAldrich or Moore about launch objections due to weather. Rockwell made no
\nphone calls or further objections to Aldrich or other NASA officials after the
\n9:00 a.m. Mission Management Team meeting and subsequent to the
\nresumption of the countdown.
\n2. The Commission was also concerned about the NASA response to the
\nRockwell position at the 9:00 a.m. meeting. While it was understood that
\ndecisions have to be made in launching a Shuttle, the Commission was not
\nconvinced Levels I and II [of NASA\u2019s management] appropriately considered
\nRockwell\u2019s concern about the ice. However ambiguous Rockwell\u2019s position
\nwas, it was clear that they did tell NASA that the ice was an unknown
\ncondition. Given the extent of the ice on the pad, the admitted unknown effect
\nof the Solid Rocket Motor and Space Shuttle Main Engines ignition on the ice,
\nas well as the fact that debris striking the Orbiter was a potential flight safety
\nhazard, the Commission found the decision to launch questionable under those<\/p>\n
-50-<\/p>\n
circumstances. In this situation, NASA appeared to be requiring a contractor
\nto prove that it was not safe to launch, rather than proving it was safe.
\nNevertheless, the Commission had determined that the ice was not a cause of
\nthe 51-L accident and does not conclude that NASA\u2019s decision to launch
\nspecifically overrode a no-launch recommendation by an element contractor.
\n3. The Commission concluded that the freeze protection plan for launch pad 39B
\nwas inadequate. The Commission believed that the severe cold and presence
\nof so much ice on the fixed service structure made it inadvisable to launch on
\nthe morning of January 28, and that margins of safety were whittled down too
\nfar.<\/p>\n
It became obvious that NASA\u2019s management knew of the ice problem, but did they
\nknow of Thiokol\u2019s original recommendation not to launch and then their reversal Larry
\nMalloy, the SRB Project Manager for NASA, and Stanley Reinartz, NASA\u2019s Manager of
\nthe Shuttle Office, both admitted that they told Arnold Aldrich, Manager of the STS
\nprogram, Johnson Space Center, about their concern for the ice problem but there was no
\ndiscussion about the teleconferences with Thiokol over the O-rings. It appeared that
\nMalloy and Reinartz considered the ice as a potential problem whereas the O-rings
\nconstituted an acceptable risk. Therefore, only potential problems went up the chain of
\ncommand, not the components of the \u201caggregate acceptable launch risk.\u201d It became
\ncommon practice in Flight Readiness Review documentation to use the term \u201cacceptable
\nrisk.\u201d This became the norm at NASA and resulted in insulating senior management
\nfrom certain potential problems. It was the culture that had developed at NASA that<\/p>\n
-51-<\/p>\n
created the flawed decision-making process rather than an intent by individuals to
\nwithhold information and jeopardize safety.<\/p>\n
THE ACCIDENT
\nJust after liftoff at 0.678 seconds into the flight, photographic data showed a strong puff
\nof gray smoke spurting from the vicinity of the aft field joint on the right solid rocket booster.
\nThe two pad 39B cameras that would have recorded the precise location of the puff were
\ninoperative. Computer graphic analysis of film from other cameras indicated the initial smoke
\ncame from the 270 to 310-degree sector of the circumference of the aft field joint of the right
\nsolid rocket booster. This area of the solid booster faced the external tank. The vaporized
\nmaterial streaming from the joint indicated there was incomplete sealing action within the joint.
\nEight more distinctive puffs of increasingly blacker smoke were recorded between 0.836
\nand 2.500 seconds. The smoke appeared to puff upwards from the joint.<\/p>\n
While each smoke<\/p>\n
puff was being left behind by the upward flight of the Shuttle, the next fresh puff could be seen
\nnear the level of the joint. The multiple smoke puffs in this sequence occurred about four times
\nper second, approximating the frequency of the structural load dynamics and resultant joint
\nflexing. Computer graphics applied to NASA photos from a variety of cameras in this sequence
\nagain placed the smoke puffs\u2019 origin in the 270 to 310 degree sector of the original smoke spurt.
\nAs the Shuttle Challenger increased its upward velocity, it flew past the emerging and
\nexpanding smoke puffs. The last smoke was seen above the field joint at 2.733 seconds.
\nThe black color and dense composition of the smoke puffs suggested that the grease, joint
\ninsulation and rubber O-rings in the joint seal were being burned and eroded by the hot
\npropellant gases.<\/p>\n
-52-<\/p>\n
At approximately 37 seconds, Challenger encountered the first of several high altitude
\nwind shear conditions that lasted about 64 seconds. The wind shear created forces of relatively
\nlarge fluctuations on the vehicle itself. These were immediately sensed and countered by the
\nguidance, navigation and control systems.
\nThe steering system (thrust vector control) of the solid rocket booster responded to all
\ncommands and wind shear effects. The wind shear caused the steering system to be more active
\nthan on any previous flight.
\nBoth the Challenger\u2019s main engines and the solid rockets operated at reduced thrust
\napproaching and passing through the area of maximum dynamic pressure of 720 pounds per
\nsquare foot. Main engines had been throttled up to 104 percent thrust and the solid rocket
\nboosters were increasing their thrust when the first flickering flame appeared on the right solid
\nrocket booster in the area of the aft field joint. This first very small flame was detected on
\nimage-enhanced film at 58.788 seconds into the flight. It appeared to originate at about 305
\ndegrees around the booster circumference at or near the aft field joint.
\nOne film frame later from the same camera, the flame was visible without image
\nenhancement.<\/p>\n
It grew into a continuous, well-defined plume at 59.262 seconds.<\/p>\n
At<\/p>\n
approximately the same time (60 seconds), telemetry showed a pressure differential between the
\nchamber pressures in the right and left boosters. The right booster chamber pressure was lower,
\nconfirming the growing leak in the area of the field joint.
\nAs the flame plume increased in size, it was deflected rearward by the aerodynamic
\nslipstream and circumferentially by the protruding structure of the upper ring attaching the
\nbooster to the external tank. These deflections directed the flame plume onto the surface of the
\nexternal tank. This sequence of flame spreading is confirmed by analysis of the recovered<\/p>\n
-53-<\/p>\n
wreckage. The growing flame also impinged on the strut attaching the solid rocket booster to the
\nexternal tank.
\nThe first visual indication that swirling flame from the right solid rocket booster breached
\nthe external tank was at 64.660 seconds when there was an abrupt change in the shape and color
\nof the plume. This indicated that it was mixing with leaking hydrogen from the external tank.
\nTelemetered changes in the hydrogen tank pressurization confirmed the leak.<\/p>\n
Within 45<\/p>\n
milliseconds of the breach of the external tank, a bright, sustained glow developed on the black
\ntiled underside of the Challenger between it and the external tank.
\nBeginning around 72 seconds, a series of events occurred extremely rapidly that
\nterminated the flight. Telemetered data indicated a wide variety of flight system actions that
\nsupported the visual evidence of the photos as the Shuttle struggled futilely against the forces
\nthat were destroying it.
\nAt about 72.20 seconds, the lower strut linking the solid rocket booster and the external
\ntank was severed or pulled away from the weakened hydrogen tank permitting the right solid
\nrocket booster to rotate around the upper attachment strut. This rotation was indicated by
\ndivergent yaw and pitch rates between the left and right solid rocket boosters.
\nAt 73.124 seconds, a circumferential white vapor pattern was observed blooming from
\nthe side of the external tank bottom dome. This was the beginning of the structural failure of the
\nhydrogen tank that culminated in the entire aft dome dropping away. This released massive
\namounts of liquid hydrogen from the tank and created a sudden forward thrust of about 2.8
\nmillion pounds, pushing the hydrogen tank upward into the intertank structure. About the same
\ntime, the rotating right solid rocket booster impacted the intertank structure and the lower part of<\/p>\n
-54-<\/p>\n
the liquid oxygen tank. These structures failed at 73.137 seconds as evidenced by the white
\nvapors appearing in the intertank region.
\nWithin milliseconds there was massive, almost explosive, burning of the hydrogen
\nstreaming from the failed tank bottom and the liquid oxygen breach in the area of the intertank.
\nAt this point in its trajectory, while traveling at a Mach number of 1.92 at an altitude of
\n46,000 feet, the Challenger was totally enveloped in the explosive burn. The Challenger\u2019s
\nreaction control system ruptured, and a hypergolic burn of its propellants occurred producing the
\noxygen-hydrogen flames. The reddish brown colors of the hypergolic fuel burn were visible on
\nthe edge of the main fireball. The Orbiter, under severe aerodynamic loads, broke into several
\nlarge sections which emerged from the fireball. Separate sections that can be identified on film
\ninclude the main engine\/tail section with the engines still burning, one wing of the Orbiter, and
\nthe forward fuselage trailing a mass of umbilical lines pulled loose from the payload bay.
\nThe consensus of the Commission and participating investigative agencies was that the
\nloss of the Space Shuttle Challenger was caused by a failure in the joint between the two lower
\nsegments of the right solid rocket motor. The specific failure was the destruction of the seals that
\nwere intended to prevent hot gases from leaking through the joint during the propellant burn of
\nthe rocket motor. The evidence assembled by the Commission indicates that no other element of
\nthe Space Shuttle system contributed to this failure.
\nIn arriving at this conclusion, the Commission reviewed in detail all available data,
\nreports and records; directed and supervised numerous tests, analyses, and experiments by
\nNASA, civilian contractors and various government agencies; and then developed specific
\nfailure scenarios and the range of most probably causative factors.<\/p>\n
-55-<\/p>\n
The failure was due to a faulty design unacceptably sensitive to a number of factors.
\nThese factors were the effects of temperature, physical dimensions, the character of materials,
\nthe effects of reusability, processing, and the reaction of the joint to dynamic loading.<\/p>\n
NASA AND THE MEDIA
\nFollowing the tragedy, many believed that NASA\u2019s decision to launch was an attempt to
\nminimize further ridicule by the media. Successful Shuttle flights were no longer news because
\nthey were almost ordinary. However, launch aborts and delayed landings were more newsworthy
\nbecause they were less common. The Columbia launch, which immediately preceded the
\nChallenger mission, was delayed seven times. The Challenger launch had gone through four
\ndelays already. News anchor personnel were criticizing NASA. Some believed that NASA had
\nto do something quickly to dispel their poor public image.
\nThe Challenger mission had more media coverage and political ramifications than other
\nmissions. This would be the launch of the Teacher in Space Project. The original launch date of
\nthe Challenger was just before President Reagan\u2019s State of the Union message that was
\nscheduled for the evening of January 28. Some believed that the president would publicly praise
\nNASA for the Teacher in Space Project and possibly even talk to her live during his address.
\nThis would certainly enhance NASA\u2019s image.
\nFollowing the tragedy, there were questions as to whether or not the White House had pressured
\nNASA into launching the Shuttle because of President Reagan\u2019s (and NASA\u2019s) love of favorable
\npublicity. The commission found no evidence of White House intervention in the decision to
\nlaunch.<\/p>\n
-56-<\/p>\n
FINDINGS OF THE COMMISSION
\nDetermining the cause of an engineering disaster can take years of investigation. The
\nChallenger disaster arose from many factors including launch conditions, mechanical failure,
\ncommunication and decision-making. In the end, the last minute decision to launch put all
\npossible factors into a lethal action.
\nThe Commission concluded that the accident was rooted in history. The space Shuttle\u2019s
\nsolid rocket booster problem began with the faulty design of its joint and increased as both
\nNASA and contractor management first failed to recognize it as a problem, then failed to fix it,
\nand finally treated it as an acceptable flight risk.
\nMorton Thiokol, Inc., the contractor, did not accept the implication of tests early in the
\nprogram that the design had a serious and unanticipated flaw.<\/p>\n
NASA did not accept the<\/p>\n
judgment of its engineers that the design was unacceptable, and as the joint problems grew in
\nnumber and severity, NASA minimized them in management briefings and reports. Thiokol\u2019s
\nstated position was that \u201cthe condition is not desirable but is acceptable.\u201d
\nNeither Thiokol nor NASA expected the rubber O-rings sealing the joints to be touched
\nby hot gases of motor ignition, much less to be partially burned. However, as tests and then
\nflights confirmed damage to the sealing rings, the reaction by both NASA and Thiokol was to
\nincrease the amount of damage considered \u201cacceptable.\u201d At no time did management either
\nrecommend a redesign of the joint or call for the Shuttle\u2019s grounding until the problem was
\nsolved.
\nThe genesis of the Challenger accident \u2013 the failure of the joint of the right solid rocket
\nmotor \u2013 began with decisions made in the design of the joint and in the failure by both Thiokol<\/p>\n
-57-<\/p>\n
and NASA\u2019s Solid Rocket Booster project ( help with nursing paper writing from experts with MSN & DNP degrees) office to understand and respond to facts obtained
\nduring testing.
\nThe Commission concluded that neither Thiokol nor NASA responded adequately to
\ninternal warnings about the faulty seal design. Furthermore, Thiokol and NASA did not make a
\ntimely attempt to develop and verify a new seal after the initial design was shown to be deficient.
\nNeither organization developed a solution to the unexpected occurrences of O-ring erosion and
\nblow-by, even though this problem was experienced frequently during the Shuttle flight history.
\nInstead, Thiokol and NASA management came to accept erosion and blow-by as unavoidable
\nand an acceptable flight risk. Specifically, the Commission found that:
\n1. The joint test and certification program was inadequate.<\/p>\n
There was no<\/p>\n
requirement to configure the qualifications test motor as it would be in flight,
\nand the motors were static tested in a horizontal position, not in the vertical
\nflight position.
\n2. Prior to the accident, neither NASA nor Thiokol fully understood the
\nmechanism in which the joint sealing action took place.
\n3. NASA and Thiokol accepted escalating risk apparently because they \u201cgot
\naway with it last time.\u201d As Commissioner Feynman observed, the decision
\nmaking was:
\n\u201ca kind of Russian roulette. . . . [The Shuttle] flies [with Oring erosion] and nothing happens. Then it is suggested,
\ntherefore, that the risk is no longer so high for the next
\nflights. We can lower our standards a little bit because we
\ngot away with it last time. . . . You got away with it, but it
\nshouldn\u2019t be done over and over again like that.\u201d
\n4. NASA\u2019s system for tracking anomalies for Flight Readiness Reviews failed in
\nthat, despite a history of persistent O-ring erosion and blow-by, flight was still<\/p>\n
-58-<\/p>\n
permitted. It failed again in the strange sequence of six consecutive launch
\nconstraint waivers prior to 51-L, permitting it to fly without any record of a
\nwaiver, or even of an explicit constraint.<\/p>\n
Tracking and continuing only<\/p>\n
anomalies that are \u201coutside the data base\u201d of prior flight allowed major
\nproblems to be removed from, and lost by, the reporting system.
\n5. The O-ring erosion history presented to Level I at NASA Headquarters in
\nAugust 1985 was sufficiently detailed to require corrective action prior to the
\nnext flight.
\n6. A careful analysis of the flight history of O-ring performance would have
\nrevealed the correlation of O-ring damage and low temperature. Neither
\nNASA nor Thiokol carried out such an analysis; consequently, they were
\nunprepared to properly evaluate the risks of launching the 51-L mission in
\nconditions more extreme than they had encountered before.
\nThe Commission also identified a concern for the \u201csilent\u201d safety program.<\/p>\n
The<\/p>\n
Commission was surprised to realize after many hours of testimony that NASA\u2019s safety staff was
\nnever mentioned. No witness related the approval or disapproval of the reliability engineers, and
\nnone expressed the satisfaction or dissatisfaction of the quality assurance staff. No one thought
\nto invite a safety representative or a reliability and quality assurance engineer to the January 27,
\n1986, teleconference between Marshall and Thiokol.<\/p>\n
Similarly, there was no safety<\/p>\n
representative on the Mission Management Team that made key decisions during the countdown
\non January 28, 1986.
\nThe unrelenting pressure to meet the demands of an accelerating flight schedule might
\nhave been adequately handled by NASA if it had insisted upon the exactingly thorough<\/p>\n
-59-<\/p>\n
procedures that were its hallmark during the Apollo program. An extensive and redundant safety
\nprogram comprising interdependent safety, reliability and quality assurance functions existed
\nduring the lunar program to discover any potential safety problems. Between that period and
\n1986, however, the safety program became ineffective. This loss of effectiveness seriously
\ndegraded the checks and balances essential for maintaining flight safety.
\nOn April 3, 1986, Arnold Aldrich, the Space Shuttle program manager, appeared before the
\nCommission at a public hearing in Washington. D.C. He described five different communication
\nor organization failures that affected the launch decision on January 28, 1986. Four of those
\nfailures related directly to faults within the safety program. These faults included a lack of
\nproblem reporting requirements, inadequate trend analysis, misrepresentation of criticality and
\nlack of involvement in critical discussions. A robust safety organization that was properly
\nstaffed and supported might well have avoided these faults and thus eliminated the
\ncommunication failures.
\nNASA had a safety program to ensure that the communication failures to which Mr.
\nAldrich referred did not occur. In the case of mission 51-L, that program fell short.
\nThe Commission concluded that there were severe pressures placed on the launch
\ndecision-making system to maintain a flight schedule. These pressures caused rational men to
\nmake irrational decisions.
\nWith the 1982 completion of the orbital flight test series, NASA began a planned
\nacceleration of the Space Shuttle launch schedule. One early plan contemplated an eventual rate
\nof a mission a week, but realism forced several downward revisions. In 1985, NASA published
\na project ( help with nursing paper writing from experts with MSN & DNP degrees)ion calling for an annual rate of 24 flights by 1990. Long before the Challenger<\/p>\n
-60-<\/p>\n
accident, however, it was becoming obvious that even the modified goal of two flights a month
\nwas overambitious.
\nIn establishing the schedule, NASA had not provided adequate resources. As a result, the
\ncapabilities of the launch decision-making system were strained by the modest nine-mission rate
\nof 1985, and the evidence suggested that NASA would not have been able to accomplish the 15
\nflights scheduled for 1986. These were the major conclusions of a Commission examination of
\nthe pressures and problems attendant upon the accelerated launch schedule:
\n1. The capabilities of the launch decision-making system were stretched to the limit to
\nsupport the flight rate in winter 1985\/1986. Projections into the spring and summer
\nof 1986 showed a clear trend; the system, as it existed, would have been unable to
\ndeliver crew training software for scheduled flights by the designated dates. The
\nresult would have been an unacceptable compression of the time available for the
\ncrews to accomplish their required training.
\n2. Spare parts were in critically short supply. The Shuttle program made a conscious
\ndecision to postpone spare parts procurements in favor of budget items of perceived
\nhigher priority. Lack of spare parts would likely have limited flight operations in
\n1986.
\n3. Stated manifesting policies were not enforced. Numerous late manifest changes (after
\nthe cargo integration review) have been made to both major payloads and minor
\npayloads throughout the Shuttle program
\nLate changes to major payloads or program requirements required
\nextensive resources (money, manpower, facilities) to implement.<\/p>\n
-61-<\/p>\n
If many late changes to \u201cminor\u201d payloads occurred, resources were
\nquickly absorbed.
\nPayload specialists frequently were added to a flight well after announced
\ndeadlines.
\nLate changes to a mission adversely affect the training and development of
\nprocedures for subsequent missions.
\n4. The scheduled flight rate did not accurately reflect the capabilities and resources.
\nThe flight rate was not reduced to accommodate periods of adjustment in
\nthe capacity of the work force. There was no margin for error in the
\nsystem to accommodate unforeseen hardware problems.
\nResources were primarily directed toward supporting the flights and thus
\nnot enough were available to improve and expand facilities needed to
\nsupport a higher flight rate.
\n5. Training simulators may have been the limiting factor on the flight rate: the two
\ncurrent simulators could not train crews for more than 12-15 flights per year.
\n6. When flights come in rapid succession, current requirements did not ensure that
\ncritical anomalies occurring during one flight are identified and addressed
\nappropriately before the next flight.<\/p>\n
CHAIN-OF-COMMAND COMMUNICATION FAILURE
\nThe commission also identified a communication failure within the reporting structure at
\nboth NASA and Thiokol. Part of the problem with the chain of command structure was the idea
\nof the proper reporting channel. Engineers report only to their immediate managers, while those<\/p>\n
-62-<\/p>\n
managers report only to their direct supervisors. Engineers and managers believed in the chain
\nof command structure; they felt reluctant to go above their superiors with their concerns.
\nBoisjoly at Thiokol and Powers at Marshall felt that they had done all that they could as far as
\nvoicing their concerns. Anything more could have cost them their jobs. When questioned at the
\nRogers Commission hearing about why he did not voice his concerns to others, Powers replied,
\n\u201cThat would not be my reporting channel.\u201d The chain of command structure dictated the only
\npath which information could travel at both NASA and Thiokol. If information was modified or
\nsilenced at the bottom of the chain, there was not an alternate path for it to take to reach highlevel officials at NASA. The Rogers Commission concluded that there was a breakdown in
\ncommunication between Thiokol engineers and top NASA officials and faulted the management
\nstructure for not allowing important information about the SRBs to flow to the people who
\nneeded to know it. The Commission reported that the \u201cfundamental problem was poor technical
\ndecision-making over a period of several years by top NASA and contractor personnel.\u201d
\nBad news does not travel well in organizations like NASA and Thiokol. When the early
\nsigns of problems with the SRBs appeared, Thiokol managers did not believe that the problems
\nwere serious. Thiokol did not want to accept the fact that there could be a problem with their
\nboosters. When Marshall received news of the problems, they considered it Thiokol\u2019s problem
\nand did not pass the bad news upward to NASA headquarters. At Thiokol, Boisjoly described
\nhis managers as shutting out the bad news. He claims that he argued about the importance of the
\nO-ring seal problems until he was convinced that \u201cno one wanted to hear what he had to say.\u201d
\nWhen Lund finally decided to recommend delay of the launch to Marshall, managers at Marshall
\nrejected the bad news and refused to accept the recommendation not to launch. As with any<\/p>\n
-63-<\/p>\n
information going up the chain of command at these two organizations, bad news could often be
\nmodified so that it had less impact, perhaps skewing its importance.12<\/p>\n
On January 31, 1986, President Ronald Reagan stated:
\n\u201cThe future is not free: the story of all human progress is one of a struggle against all odds.
\nWe learned again that this America, which Abraham Lincoln called the last, best hope of man
\non Earth, was built on heroism and noble sacrifice. It was built by men and women like our
\nseven star voyagers, who answered a call beyond duty, who gave more than was expected or
\nrequired and who gave it little thought of worldly reward.\u201d<\/p>\n
EPILOGUE
\nFollowing the tragic accident, virtually every senior manager that was involved in the
\nSpace Shuttle Challenger decision-making processes, at both NASA and Thiokol, accepted early
\nretirement. Whether this was the result of media pressure, peer pressure, fatigue or stress we can
\nonly postulate. The only true failures are the ones from which nothing is learned. Lessons on
\nhow to improve the risk management process were learned, unfortunately at the expense of
\nhuman life.
\nOn January 27, 1967, Astronauts Gus Grissom, Edward White and Roger Chaffee were
\nkilled on board a test on Apollo-Saturn 204. James Webb, NASA\u2019s Administrator at that time,
\nwas allowed by President Johnson to conduct an internal investigation of the cause.<\/p>\n
The<\/p>\n
investigation was primarily a technical investigation. NASA was fairly open with the media<\/p>\n
12<\/p>\n
The Challenger Accident: Administrative Causes of the Challenger Accident; (web site:
\nhttps:\/\/monkessays.com\/write-my-essay\/me.utexas.edu\/~uer\/challenger\/chall3.html pages 8-9.)
\n-64-<\/p>\n
during the investigation.<\/p>\n
As a result of the openness, the credibility of the agency was<\/p>\n
maintained.
\nWith the Challenger accident, confusion arose as to whether it was a technical failure or
\nmanagement failure. There was no question in anyone\u2019s mind that the decision-making process
\nwas flawed. NASA and Thiokol acted independently in their response to criticism. Critical
\ninformation was withheld, at least temporarily, and this undermined people\u2019s confidence in
\nNASA. The media, as expected, began a vengeful attack on NASA and Thiokol.
\nFollowing the Apollo-Saturn 204 fire, there were few changes made in management
\npositions at NASA. Those changes that did occur were the result of a necessity for improvement
\nand where change was definitely warranted. Following the Challenger accident, almost every
\ntop management position at NASA underwent a change of personnel.
\nHow an organization fares after an accident is often measured by how well it interfaces
\nwith the media. Situations such as the Tylenol tragedy and the Apollo-Saturn 204 fire bore this
\nout.
\nFollowing the accident, and after critical data was released, papers were published
\nshowing that the O-ring data correlation was indeed possible. In one such paper, Lighthall13
\nshowed that not only was a correlation possible, but the real problem may be a professional
\nweakness shared by many people, but especially engineers, who have been required to analyze
\ntechnical data.<\/p>\n
Lighthall\u2019s argument was that engineering curriculums might not provide<\/p>\n
engineers with strong enough statistical education, especially in covariance analysis. The Rogers
\nCommission also identified this conclusion when they found that there were no engineers at
\nNASA trained in statistical sciences.<\/p>\n
-65-<\/p>\n
Almost all scientific achievements require the taking of risks. The hard part is deciding
\nwhich risk is worth taking and which is not. Every person who has ever flown in space, whether
\nmilitary or civilian, was a volunteer. They were all risk-takers who understood that safety in
\nspace can never be guaranteed with 100 percent accuracy.<\/p>\n
13<\/p>\n
Frederick F. Lighthall, \u201cLaunching The Space Shuttle Challenger: Disciplinary Deficiencies in the
\nAnalysis of Engineering Data,\u201d IEEE Transactions on Engineering Management, Vol. 38, No: 1, February
\n1991, pp. 63-74
\n-66-<\/p>\n
Discussion Questions
\nBelow are a series of questions categorized according to the principles of risk management.
\nThere may not be any single right or wrong answer to these questions.<\/p>\n
RISK MANAGEMENT PLAN
\n1.<\/p>\n
Does it appear, from the data provided in the case, that a risk management plan was in
\nexistence<\/p>\n
2.<\/p>\n
If such a plan did exist, then why wasn\u2019t it followed, or was it followed<\/p>\n
3.<\/p>\n
Is there a difference between a risk management plan, quality assurance plan, and safety
\nplan, or are they the same<\/p>\n
4.<\/p>\n
Would there have been a better way to handle risk management planning at NASA
\nassuming 16 flights per year, 25 flights per year, or as originally planned, 60 flights per
\nyear Why is the number of flights per year critical in designing a formalized risk
\nmanagement plan<\/p>\n
RISK IDENTIFICATION
\n5.<\/p>\n
What is the difference between a risk and an anomaly Who determines the difference<\/p>\n
6.<\/p>\n
Does there appear to be a structured process in place for risk identification at either NASA
\nor Thiokol<\/p>\n
7.<\/p>\n
How should problems with risk identification be resolved if there exist differences of
\nopinion between the customer and the contractors<\/p>\n
8.<\/p>\n
Should senior management or sponsors be informed about all risks identified or just the
\noverall \u201caggregate\u201d risk<\/p>\n
9.<\/p>\n
How should one identify or classify the risks associated with using solid rocket boosters on
\nmanned spacecraft rather than the conventional liquid fuel boosters<\/p>\n
10. How should one identify or classify tradeoff risks such as trading off safety for political
\nacceptability
\n11. How should one identify or classify the risks associated with pressure resulting from
\nmaking promises that may be hard to keep
\n12. Suppose that a risk identification plan were established at the beginning of the space
\nprogram when the Shuttle was still considered an experimental design. If the Shuttle is now<\/p>\n
-67-<\/p>\n
considered as an operational vehicle rather than as an experimental design, could that affect
\nthe way that risks were identified to the point where the risk identification plan would need
\nto be changed<\/p>\n
RISK QUANTIFICATION
\n13. Given the complexity of the Space Shuttle Program, is it feasible and\/or practical to
\ndevelop a methodology for quantifying risks, or should each situation be addressed
\nindividually Can we have both a quantitative and qualitative risk Assessment system in
\nplace at the same time
\n14. How does one quantify the dangers associated with the ice problem
\n15. How should risk quantification problems be resolved if there exist differences of opinion
\nbetween the customer and the contractors
\n16. If a critical risk is discovered, what is the proper way for the project ( help with nursing paper writing from experts with MSN & DNP degrees) manager to present to
\nsenior management the impact of the risk How do you as a project ( help with nursing paper writing from experts with MSN & DNP degrees) manager make sure
\nthat senior management understand the ramifications
\n17. How were the identified risks quantified at NASA Is the quantification system truly
\nquantitative or is it a qualitative system
\n18. Were probabilities assigned to any of the risks Why or why not<\/p>\n
RISK RESPONSE (RISK HANDLING)
\n19. How does an organization decide what is or is not an acceptable risk
\n20. Who should have final say in deciding upon the appropriate response mechanism for a risk
\n21. What methods of risk response were used at NASA
\n22. Did it appear that the risk response method selected was dependent on the risk or on other
\nfactors
\n23. How should an organization decide whether or not to accept a risk and launch if the risks
\ncannot be quantified
\n24. What should be the determining factors in deciding which risks are brought upstairs to the
\nexecutive levels for review before selecting the appropriate risk response mechanism
\n25. Why weren\u2019t the astronauts involved in the launch decision (i.e. the acceptance of the risk)
\nShould they have been involved<\/p>\n
-68-<\/p>\n
26. What risk response mechanism did NASA administrators use when they issued waivers for
\nthe Launch Commit Criteria
\n27. Are waivers a type of risk response mechanism
\n28. Did the need to maintain a flight schedule compromise the risk response mechanism that
\nwould otherwise have been taken
\n29. What risk response mechanism were managers at Thiokol and NASA using when they
\nignored the recommendations of their engineers
\n30. Did the engineers at Thiokol and NASA do all they could to convince their own
\nmanagement that the wrong risk response mechanism was about to be taken
\n31. When NASA pressed its contractors to recommend a launch, did NASA\u2019s risk response
\nmechanism violate their responsibility to ensure crew safety
\n32. When NASA discounted the effects of the weather, did NASA\u2019s risk response mechanism
\nviolate their responsibility to ensure crew safety<\/p>\n
RISK CONTROL
\n33. How much documentation should be necessary for the tracking of a risk management plan
\nCan this documentation become overexcessive and create decision-making problems
\n34. Risk management includes the documentation of lessons-learned. In the case study, was
\nthere an audit trail of lessons learned or was that audit trail simply protection memos
\n35. How might Thiokol engineers have convinced both their own management and NASA to
\npostpone the launch
\n36. Should someone have stopped the Challenger launch and, if so, how could this have been
\naccomplished without risking one\u2019s job and career
\n37. How might an engineer deal with pressure from above to follow a course of action that the
\nengineer knows to be wrong
\n38. How could the chains of communication and responsibility for the Shuttle Program have
\nbeen made to function better
\n39. Because of the ice problem, Rockwell could not guarantee the Shuttle\u2019s safety, but did
\nnothing to veto the launch. Is there a better way for situations as this to be handled in the
\nfuture<\/p>\n
-69-<\/p>\n
40. What level of risk should have been acceptable for launch
\n41. How should we handle situations where people in authority believe that the potential
\nrewards justify what they believe to be relatively minor risks
\n42. If you were on a jury attempting to place liability, whom would you say was responsible for
\nthe Challenger disaster