You are on page 1of 259

Report of the

v PRESIDENTTIAL
' Of

(VJ
Q
M /A I COMMISSION
on the Space Shuttle j
Challenger Accident

mm
HI
jH

Ufa
BIS
ii
a

ftg*s
Report to the President

By The
PRESIDENTIAL
COMMISSION 1 ill-1714 02 "
on the Space Shuttle
Challenger Accident

June 6th, 1986


Washington, D.C.
IN MEMORIAM

"The future is not free: the story of all human progress is one of a struggle against all
odds. We learned again that this America, which Abraham Lincoln called the last, best
hope of man on Earth, was built on heroism and noble sacrifice. It was built by men and
women like our seven star voyagers, who answered a call beyond duty, who gave more
than was expected or required and who gave it little thought of worldly reward."
President Ronald Reagan January 31, 1986

Francis R. (Dick) Scobee


Commander
Michael John Smith
Pilot
Ellison S. Onizuka
Mission Specialist One
Judith Arlene Resnik
Mission Specialist Two
Ronald Erwin McNair
Mission Specialist Three
S. Christa McAuliffe
Payload Specialist One
Gregory Bruce Jarvis
Payload Specialist Two
Presidential Commission
on the
Space Shuttle Challenger Accident

June 6, 1986

Dear Mr. President:

On behalf of the Commission, it is my privilege to present


the report of the Presidential Commission on the Space Shuttle
Challenger Accident.

Since being sworn in on February 6, 1986, the Commission


has been able to conduct a comprehensive investigation of the
Challenger accident. This report documents our findings and
makes recommendations for your consideration.

Our objective has been not only to prevent any recurrence


of the failure related to this accident, but to the extent pos-
sible to reduce other risks in future flights. However, the
Commission did not construe its mandate to require a detailed
evaluation of the entire Shuttle system. It fully recognizes
that the risk associated with space flight cannot be totally
eliminated.

Each member of the Commission shared the pain and anguish


the nation felt at the loss of seven brave Americans in the
Challenger accident on January 28, 1986.

The nation's task now is to move ahead to return to safe


space flight and to its recognized position of leadership in
space. There could be no more fitting tribute to the Challenger
crew than to do so.

Sincerely,

William P. Rogers
Chairman

The President of the United States


The White House
Washington, D. C. 20500

600 Maryland Avenue, S.W. Washington. D.C. 20024 (202)453-1405


In compliance with the Executive Order 12546 of February 3, 1986,
the undersigned present the report of the
Presidential Commission on the Space Shuttle Challenger Accident.

Chairman, Maryland

^. David C.^cheson Eugejjre E. Covert


District of Columbia Massachusetts

</fm(M4/
Richard P. Feyj^an Robert B. Hotz J ' [ N
California Maryland \j

Donald jy'Ki/tyna
Illinois

Robert W. Rmnmel
Arizona Washington

ft 02e<Vt
Arthur B. C. Walker, (/Jr. Albert D. Wheelon
California California

Charles E. Yeagc
Yeaqer - )
California
Volume I

Report of the Presidential Commission on the Space Shuttle Challenger Accident


with
Appendix A Commission Activities
Appendix B Commission Documentation System
Appendix C Observations Concerning the Processing and Assembly of Flight 51-L
Appendix D Supporting Charts and Documents

Volume II

Appendix E Independent Test Team Report to the Commission


Appendix F Personal Observations on Reliability of Shuttle
Appendix G Human Factors Analysis
Appendix H Flight Readiness Review Treatment of O-ring Problems
Appendix I NASA Pre-Launch Activities Team Report
Appendix J NASA Mission Planning and Operations Team Report
Appendix K NASA Development and Production Team Report
Appendix L NASA Accident Analysis Team Report
Appendix M Comments by Morton Thiokol on NASA Report

Volume III

Appendix N NASA Photo and TV Support Team Report


Appendix 0 NASA Search, Recovery and Reconstruction Task Force Team Report

Volume IV

Hearings of the Presidential Commission on the Space Shuttle


Challenger Accident: February 6, 1986 to February 25, 1986

Volume V

Hearings of the Presidential Commission on the Space Shuttle


Challenger Accident: February 26, 1986 to May 2, 1986
Volume I

Table of Contents

Preface 1
Chapter I Introduction 2
Chapter II Events Leading Up to the Challenger Mission 10
Chapter III The Accident 19
Chapter IV The Cause of the Accident 40
Chapter V The Contributing Cause of the Accident 82
Chapter VI An Accident Rooted in History 120
Chapter VII The Silent Safety Program 152
Chapter VIII Pressures on the System 164
Chapter IX Other Safety Considerations 178
Recommendations 198
The Commission 202
The Staff 204
Appendix A Commission Activities 206
Appendix B Commission Documentation System 214
Appendix C Observations Concerning the Processing and Assembly of Flight 51-L 219
Appendix D Supporting Charts and Documents 225
Preface

The accident of Space Shuttle accident but which require attention to make
Challenger, mission 51-L, interrupt- future flights safer. Careful attention was given
ing for a time one of the most pro- to concerns expressed by astronauts because the
ductive engineering, scientific and ex- Space Shuttle program will only succeed if the
ploratory programs in history, evoked a wide highly qualified men and women who fly the
range of deeply felt public responses. There was Shuttle have confidence in the system.
grief and sadness for the loss of seven brave However, the Commission did not construe its
members of the crew; firm national resolve that mandate to require a detailed investigation of all
those men and women be forever enshrined in aspects of the Space Shuttle program; to review
the annals of American heroes, and a determina- budgetary matters; or to interfere with or
tion, based on that resolve and in their memory, supersede Congress in any way in the perform-
to strengthen the Space Shuttle program so that ance of its duties. Rather, the Commission
this tragic event will become a milestone on the focused its attention on the safety aspects of future
way to achieving the full potential that space of- flights based on the lessons learned from the in-
fers to mankind. vestigation with the objective being to return to
The President, who was moved and troubled safe flight.
by this accident in a very personal way, appointed Congress recognized the desirability, in the first
an independent Commission made up of persons instance, of having a single investigation of this
not connected with the mission to investigate it. national tragedy. It very responsibly agreed to
The mandate of the Commission was to: await the Commission's findings before deciding
what further action might be necessary to carry
1. Review the circumstances surrounding the out its responsibilities.
accident to establish the probable cause or causes For the first several days after the accident
of the accident; and possibly because of the trauma resulting from the
2. Develop recommendations for corrective or accident NASA appeared to be withholding in-
other action based upon the Commission's find- formation about the accident from the public.
ings and determinations. After the Commission began its work, and at its
suggestion, NASA began releasing a great deal
Immediately after being appointed, the Com- of information that helped to reassure the public
mission moved forward with its investigation and, that all aspects of the accident were being in-
with the full support of the White House, held vestigated and that the full story was being told
public hearings dealing with the facts leading up in an orderly and thorough manner.
to the accident. In a closed society other options Following the suggestion of the Commission,
are available; in an open society unless classified NASA established several teams of persons not
matters are involved other options are not, involved in the mission 51-L launch process to
either as matter of law or as a practical matter. support the Commission and its panels. These
In this case a vigorous investigation and full NASA teams have cooperated with the Commis-
disclosure of the facts were necessary. The way sion in every aspect of its work. The result has
to deal with a failure of this magnitude is to been a comprehensive and complete investiga-
disclose all the facts fully and openly; to take im- tion.
mediate steps to correct mistakes that led to the The Commission believes that its investigation
failure; and to continue the program with re- and report have been responsive to the request
newed confidence and determination. of the President and hopes that they will serve
The Commission construed its mandate the best interests of the nation in restoring the
somewhat broadly to include recommendations United States space program to its preeminent
on safety matters not necessarily involved in this position in the world.

1
Chapter I

Introduction

The Space Shuttle concept had its Space Shuttle, earlier considered only the
genesis in the 1960s, when the Apollo transport element of a broad, multi-objective
lunar landing spacecraft was in full space plan, became the focus of NASA's near-
development but had not yet flown. term future.
From the earliest days of the space program, it
seemed logical that the goal of frequent,
economical access to space might best be served The Space Shuttle Design
by a reusable launch system. In February, 1967,
the President's Science Advisory Committee lent The embryo Shuttle program faced a number
weight to the idea of a reusable spacecraft by of evolutionary design changes before it would
recommending that studies be made "of more become a system in being. The first design was
economical ferrying systems, presumably involv- based on a "fly back" concept in which two stages,
ing partial or total recovery and use." each manned, would fly back to a horizontal,
In September, 1969, two months after the in- airplane-like landing. The first stage was a huge,
itial lunar landing, a Space Task Group chaired winged, rocket-powered vehicle that would carry
by the Vice President offered a choice of three the smaller second stage piggyback; the carrier
long-range plans: would provide the thrust for liftoff and flight
through the atmosphere, then release its
A $8-$ 10 billion per year program involv-
passenger the orbiting vehicle and return to
ing a manned Mars expedition, a space sta-
Earth. The Orbiter, containing the crew and
tion in lunar orbit and a 50-person Earth-
payload, would continue into space under its own
orbiting station serviced by a reusable ferry,
rocket power, complete its mission and then fly
or Space Shuttle.
back to Earth.
An intermediate program, costing less than
The second-stage craft, conceived prior to 1970
$8 billion annually, that would include the
as a space station ferry, was a vehicle considerably
Mars mission.
larger than the later Space Shuttle Orbiter. It car-
A relatively modest $4-$5.7 billion a year
ried its rocket propellants internally, had a flight
program that would embrace an Earth-
deck sufficiently large to seat 12 space station-
orbiting space station and the Space Shut-
bound passengers and a cargo bay big enough
tle as its link to Earth.1
to accommodate space station modules. The Or-
In March, 1970, President Nixon made it clear biter's size put enormous weightlifting and thrust-
that, while he favored a continuing active space generating demands on the first-stage design.
program, funding on the order of Apollo was not This two-stage, fully reusable design
in the cards. He opted for the shuttle-tended space represented the optimum Space Shuttle in terms
base as a long-range goal but deferred going of "routine, economical access to space," the catch-
ahead with the space station pending develop- phrase that was becoming the primary guideline
ment of the shuttle vehicle. Thus the reusable for development of Earth-to-orbit systems. It was.
however, less than optimum in terms of the For the launch system, NASA examined a
development investment required: an estimated number of possibilities. One was a winged but
$10-13 billion, a figure that met with disfavor in unmanned recoverable liquid-fuel vehicle based
both Congress and the Office of Management and on the eminently successful Saturn 5 rocket from
Budget. the Apollo Program. Other plans envisioned
In 1971, NASA went back to the drawing simpler but also recoverable liquid-fuel systems,
board, aware that development cost rather than expendable solid rockets and the reusable Solid
system capability would probably be the deter- Rocket Booster. NASA had been using solid-fuel
mining factor in getting a green light for Shuttle vehicles for launching some small unmanned
development. Government and industry studies spacecraft, but solids as boosters for manned flight
sought developmental economies in the con- was a technology new to the agency. Mercury,
figuration. One proposal found acceptance: Gemini and Apollo astronauts had all been
eliminate the Orbiter's internal tanks and carry rocketed into space by liquid-fuel systems.
the propellant in a single, disposable External Nonetheless, the recoverable Solid Rocket
Tank. It provided a smaller, cheaper Orbiter Booster won the nod, even though the liquid
without substantial performance loss. rocket offered potentially lower operating costs.

Artist's drawing depicts Space Shuttle stacked for launch in


view from dorsal side of Orbiter (left) and from the left side
of stack.
The overriding reason was that pricing estimates ment that NASA struggled through the Shuttle
indicated a lower cost of development for the solid development years of the 1970s. The planned
booster. five-Orbiter fleet was reduced to four. Budgetary
Emerging from this round of design decision difficulties were compounded by engineering
making was the Space Shuttle: a three-element problems and, inevitably in a major new system
system composed of the Orbiter, an expendable whose development pushes the frontiers of
external fuel tank carrying liquid propellants for technology, there was cost growth. This combina-
the Orbiter's engines, and two recoverable Solid tion of factors induced schedule slippage. The ini-
Rocket Boosters. It would cost, NASA estimated tial orbital test flights were delayed by more than
early in 1972, $6.2 billion to develop and test a two years.
five-Orbiter Space Shuttle system, about half The first Shuttle test flights were conducted at
what the two-stage "fly back" design would have Dryden Flight Research Facility, California, in
cost. To achieve that reduction, NASA had to 1977. The test craft was the Orbiter Enterprise,
accept somewhat higher system operating costs a full-size vehicle that lacked engines and other
and sacrifice full reusability. The compromise systems needed for orbital flight. The purpose of
design retained recoverability and reuse of two these tests was to check out the aerodynamic and
of the three elements and still promised to trim flight control characteristics of the Orbiter in at-
substantially the cost of delivering payloads to mospheric flight. Mounted piggyback atop a
orbit. modified Boeing 747, the Enterprise was carried
The final configuration was selected in March, to altitude and released for a gliding approach
1972. and landing at the Mojave Desert test center. Five
such flights were made. They served to validate
the Orbiter's computers and other systems. They
The Space Shuttle also demonstrated the craft's subsonic handling
qualities, in particular its performance in the
Development precise unpowered landings that would be re-
quired on all Shuttle flights.
In August, 1972, NASA awarded a contract
The Enterprise test flights were followed in
to Rockwell International Corporation's Space
1977-80 by extensive ground tests of Shuttle
Transportation Systems Division for design and
systems, including vibration tests of the entire
development of the Space Shuttle Orbiter. Mar-
assembly Orbiter, External Tank and Solid
tin Marietta Denver Aerospace was assigned
Rocket Boosters at Marshall. Main engine test
development and fabrication of the External firings were conducted at National Space
Tank, Morton Thiokol Corporation was award-
Technology Laboratories at Bay St. Louis,
ed the contract for the Solid Rocket Boosters, and
Mississippi, and on the launch pad at Kennedy.
Rocketdyne, a division of Rockwell, was selected
By early 1981, the Space Shuttle was ready for
to develop the Orbiter main engines.
an orbital flight test program. This was careful-
NASA divided managerial responsibility for
ly crafted to include more than 1,000 tests and
the program among three of its field centers.
data collection procedures. All flights were to be
Johnson Space Center, Houston, Texas, was
launched from Kennedy and terminate at Ed-
assigned management of the Orbiter. Marshall
wards Air Force Base, where the Dryden Flight
Space Flight Center, Huntsville, Alabama, was
Research Facility is located (actually the third
made responsible for the Orbiter's main engines,
flight landed at White Sands Test Facility, New
the External Tank and the Solid Rocket Boosters.
Mexico, because the normally dry lakebed at Ed-
Kennedy Space Center, Merritt Island, Florida,
wards was flooded). Originally intended as a six-
was given the job of assembling the Space Shut-
mission program, the orbital test series was reduc-
tle components, checking them out and conduct-
ed to four flights:
ing launches. Because these three centers will be
mentioned repeatedly in this report, they will STS-1 (Space Transportation System 1),
hereafter be identified simply as Johnson, Mar- April 12-14, 1981, Orbiter Columbia, was
shall and Kennedy. a two-day demonstration of the Orbiter's
It was in an increasingly austere fiscal environ- ability to go into orbit and return safely. Its
main payload was a flight instrumentation digit identifies the launch site (1 is Kennedy, 2
pallet containing equipment for recording Vandenberg Air Force Base, California). The let-
temperatures, pressures and acceleration ter corresponds to the alphabetical sequence for
levels at various points around the Orbiter. the fiscal year, B being the second mission
In addition, there were checkouts of the scheduled. Here is a brief summary of the 21 mis-
cargo bay doors, attitude control system and sions launched from late 1982 to January, 1986:
orbital maneuvering system. STS-5, November 11-16, 1982, Orbiter
STS-2, November 12-14, 1981, Orbiter Columbia, launched two communications
Columbia, marked the first test of the satellites, which later were boosted to
Remote Manipulator System and carried a geosynchronous orbit by attached propul-
payload of Earth survey instruments. This sion systems.
was the first time any spacecraft had flown STS-6, April 4-9, 1983, Orbiter Challenger,
twice. Failure of a fuel cell shortened the was highlighted by the first Shuttle-based
flight by about three days. spacewalk, or extravehicular activity. The
STS-3, March 22-30, 1982, Orbiter Colum- crew successfully deployed the 5,000-pound
bia, was the longest of the initial test series, Tracking and Data Relay Satellite, first of
staying aloft eight days. Activities included three planned NASA communications
a special test of the manipulator in which satellites.
the robot arm removed a package of in- STS-7, June 18-24, 1983, Orbiter
struments from the payload bay but did not Challenger, delivered a second pair of com-
release it into space. The flight included ex- mercial communications satellites. The mis-
periments in materials processing. sion also included additional payload release
STS-4, June 27-July 4, 1982, Orbiter Co- and recapture tests using the Remote
lumbia, featured another test of the robot Manipulator System. This flight marked the
arm, which extended a scientific payload first retrieval of an object from orbit.
over the side of the payload bay, then re- STS-8, August 30-September 6, 1983, Or-
berthed it. Materials processing experiments biter Challenger, included more robot arm
were conducted, as were a number of scien- tests plus deployment of a commer-
tific investigations. This flight carried the cial/public service communications satellite.
first Department of Defense payload. STS-9, November 28-December 8, 1983,
With the landing of STS-4, the orbital flight Orbiter Columbia, carried the first Spacelab
test program came to an end with 95 percent of in the payload bay. The mission marked
its objectives accomplished. The interval between Columbia's return to service after a year's
flights had been trimmed from seven months to hiatus, during which it had been extensive-
four, then three. NASA declared the Space Shut- ly modified.
tle "operational," a term that has encountered Flight 10 (41-B), February 3-11, 1984, Or-
some criticism because it erroneously suggests biter Challenger, was highlighted by the in-
that the Shuttle had attained an airline-like degree troduction of the Manned Maneuvering
of routine operation. In any event, NASA regard- Unit, a backpack propulsion unit that allows
ed all flights after STS-4 operational in the sense astronauts to maneuver in space independ-
that payload requirements would take precedence ent of the Orbiter. The mission also
over spacecraft testing, requiring larger crews. launched two communications satellites, but
After completing the orbital test in mid-1982, their boosters failed to put them into geosyn-
NASA began the "operational phase" of the Space chronous orbit. For the first time, the Shut-
Shuttle program, beginning with STS-5. The tle landed on the concrete runway at Ken-
STS for Space Transportation System nedy Space Center.
sequential numbering was still in effect at that Flight 11 (41-C), April 6-13, 1984, Orbiter
time; after STS-9 NASA changed the method of Challenger, featured an important
numbering missions. Thereafter each flight was demonstration of Shuttle ability: the
designated by two numbers and a letter, such as retrieval, repair and redeployment of the
41-B. The first digit indicates the fiscal year of malfunctioning Solar Maximum Mission
the scheduled launch (4 for 1984). The second spacecraft with the help of a Manned
Maneuvering Unit. Other activity includ- satellite which failed to activate after deploy-
ed deployment of the Long Duration Ex- ment on Flight 16 was retrieved, repaired
posure Facility, a large cylinder containing and successfully redeployed.
materials samples to be retrieved and ex- Flight 21 (51-J), October 3-10, 1985, Or-
amined after long exposure to the space biter Atlantis was devoted to another
environment. Department of Defense mission.
I Flight 12 (41-D), August 30-September 5, Flight 22 (61-A), October 30-November 6,
1984, Orbiter Discovery, was devoted 1985, Orbiter Challenger, carried the fourth
primarily to launch of three communications Spacelab mission, devoted to materials proc-
satellites. The mission demonstrated essing experimentation.
repeated deployment and retraction of a Flight 23 (61-B), November 26-December
large, foldable solar array to investigate the 3, 1985, Orbiter Atlantis, was highlighted
practicability of using such solar wings as by an experiment in astronaut assembly of
power sources for extended Shuttle mis- structures in orbit and attendant study of
sions, space platforms or the space station. extravehicular dynamics and human factors.
I Flight 13 (41-G), October 5-13, 1984, Or- The mission also deployed three com-
biter Challenger, launched the NASA Earth munications satellites.
Radiation Budget Explorer. A cargo bay Flight 24 (61-C), January 12-18, 1986, Or-
pallet carried instruments for Earth obser- biter Columbia, launched a commercial
vations, including an advanced imaging communications satellite, deployed a Hitch-
radar. hiker secondary payload, conducted ex-
I Flight 14(51-A), November 8-16, 1984, Or- periments in infrared imaging, acquired
biter Discovery, launched two communica- photos and spectral images of Comet
tions satellites and retrieved two others that Halley.
had been sent into unusable orbits after Flight 25 (51-L), January 28, 1986, Orbiter
deployment on Flight 10. Challenger. The accident.
Flight 15 (51-C), January 24-27, 1985, Or-
Including the initial orbital tests, the Space
biter Discovery, carried a Department of
Defense payload. Shuttle flew 24 successful missions over a
57-month period. Columbia made seven trips into
Flight 16 (51-D), April 12-19, 1985, Orbiter
space, Discovery six and Atlantis two. Challenger
Discovery, deployed two commercial
flew most frequently nine times prior to its
satellites; one, Leasat-3, remained in low or- fateful last flight.
bit when the upper stage booster failed to
In those 24 flights, the Shuttle demonstrated
activate.
its ability to deliver a wide variety of payloads;
Flight 17 (51-B), April 29-May 6, 1985, Or- its ability to serve as an orbital laboratory; its
biter Challenger, carried a second Spacelab utility as a platform for erection of large struc-
mission and materials processing tures; and its use for retrieval and repair of or-
experiments. biting satellites.
Flight 18 (51-G), June 17-24, 1985, Orbiter
Discovery, delivered three communications
satellites, deployed a low-cost Spartan scien- Elements of the
tific satellite and retrieved it after a period Space Shuttle
of free flight.
Flight 19 (51-F), July 29-August 6, 1985, The Space Shuttle is the principal component
Orbiter Challenger, carried the third of a national Space Transportation System
Spacelab mission, which covered a broad designed to accommodate not only NASA's
range of experiments in plasma physics, predictable needs but also those of the Depart-
astrophysics, solar astronomy and materials ment of Defense and commercial payload spon-
processing. sors. Technically speaking, transportation system
Flight 20 (51-1), August 27-September 3, hardware embraces not only the Shuttle but its
1985, Orbiter Discovery, deployed three Spacelab laboratory component, the upper stage
communications satellites. The Leasat-3 propulsion units, contemplated heavy lift vehicles
and space tugs for moving payloads from one or- periments in space, or cargo disposed on special
bit to another. To provide for the broadest possi- pallets. To handle cargo in orbital flight, the
ble spectrum of civil/military missions, the Space payload bay has the 50-foot mechanical arm that
Shuttle was designed to deliver 65,000 pounds of is controlled from within the crew compartment.
payload to an easterly low Earth orbit or 32,000 A television camera and lights mounted near the
pounds to polar orbit. The following sections end of the arm enable the operator to see what
describe the main elements of the Shuttle system. the "hand" is doing.
Just as important as delivering cargo to orbit
The Orbiter is recovering a satellite and bringing it back to
The Orbiter is as large as a mid-size airline Earth retrieving a satellite in need of refurbish-
transport and has a structure like that of an air- ment, for example. The Orbiter can carry 16 tons
craft: an aluminum alloy skin stiffened with of cargo back from space.
stringers to form a shell over frames and The feasibility of a reusable Space Shuttle
bulkheads of aluminum or aluminum alloy. The hinges on a particularly vital requirement: pro-
major structural sections of the Orbiter are the tecting the Orbiter from the searing heat
forward fuselage, which encompasses the generated by friction with the atmosphere when
pressurized crew compartment; the mid fuselage, the craft returns to Earth. Temperatures during
which contains the payload bay; the payload bay entry may rise as high as 2,750 degrees
doors; the aft fuselage, from which the main Fahrenheit on the leading edge of the wing and
engine nozzles project; and the vertical tail, which 600 degrees on the upper fuselage, the "coolest"
splits open along the trailing edge to provide a area. The thermal protection system devised for
speed brake used during entry and landing. the Orbiter must prevent the temperature of the
The crew compartment is divided into two aluminum skin from rising above 350 degrees
levels the flight deck on top and the middeck during either ascent or entry.
below. Besides working space, the crew compart- The Orbiter has four kinds of external insula-
ment contains the systems needed to provide a tion that are applied to various parts of the struc-
habitable environment (atmosphere, tempera- ture according to the temperature each is likely
ture, food, water, the crew sleep facilities and to experience. The craft's nose cap and the leading
waste management). It also houses the electronic, edges of the wings are protected with an all-
guidance and navigation systems. carbon composite consisting of layers of graphite
The Orbiter crew may include as many as eight cloth in a carbon matrix. The outer layers are
people, although generally the limit is seven. The converted chemically to silicon carbide, the same
crew consists of the commander, the captain of material that has long been used as an abrasive
the ship; the pilot, second in command; and two in grindstones. Areas subjected to the next
or more mission specialists. One or more payload greatest heat are shielded with high-temperature
specialists can also be accommodated. A mission ceramic tiles about six inches square and vary-
specialist coordinates activities of the Orbiter and ing in thickness from one to five inches, depen-
crew in support of a given payload objective. A ding on the protection needed. So-called "low-
payload specialist may manage specific ex- temperature" tiles are of the same material
periments. The commander, pilot and mission nearly pure glass, of which 90 percent of the
specialists are career astronauts assigned to the volume is "air" for use on areas requiring less
mission by NASA. Payload specialists do not protection. (Low-temperature is relative; tiles so
come from the Astronaut Office. They are as- designated can withstand a temperature of 1,200
signed, by payload sponsors in coordination with degrees Fahrenheit.) About 30,000 tiles, each dif-
NASA. ferent, are installed on each Orbiter.
Cargoes up to 24 tons have been carried in the
payload bay. Clamshell doors on the top of the Space Shuttle Main Engines
Orbiter meet along the craft's spine to enclose the The three high-performance rocket engines in
bay, which is 15 feet wide and 60 feet long. the aft section of the Orbiter fire for about the
The payload bay is designed to hold securely first 8 ^ minutes of flight after liftoff. At sea level,
a wide range of objects. They may include one each engine generates 375,000 pounds of thrust
or more communications satellites to be launch- at 100 percent throttle.
ed from orbit, an autonomous Spacelab for ex- The propellants for the engines are the fuel (liq-
uid hydrogen) and the oxidizer (liquid oxygen) The intertank structure or "intertank" connects
carried in the External Tank. Combustion takes the two propellant tanks. It is a cylindrical struc-
place in two stages. First, the propellants are mix- tural section that houses instruments and receives
ed and partly burned in pre-burners. Hot gases and distributes most of the thrust load from the
from the pre-burners drive the high-pressure tur- Solid Rocket Boosters. The front end of each
bopumps which deliver propellants to the main booster is connected to the External Tank at the
injector. Combustion, once initiated by electrical intertank midsection.
igniters, is self-sustaining. Before firing, the very A multilayered thermal coating covers the out-
cold liquid propellant is allowed to flow into the side of the External Tank to protect it from ex-
system as far as the pre-burners and combustion treme temperature variations during pre-launch,
chamber to cool the pumps and ducts so that the launch, and the first 8K2 minutes of flight. That
hydrogen and oxygen in the system will remain insulation reduces the boil-off rate of the pro-
liquid v/hen the engine is started. pellants, which must be kept at very low
The main engines have been throttled over a temperatures to remain liquid. It also is meant
range of 65 to 104 percent of the thrust at sea to minimize ice that might form from condensa-
level. At liftoff, they are thrusting at 100 percent. tion on the outside of the propellant tanks.
Computers command engine thrust to 104 per- In addition to the Solid Rocket Booster forward
cent as soon as the Shuttle clears the tower. They attachment points on either side of the intertank,
throttle to 65 percent to reduce the maximum three other attachment points link each booster
aerodynamic loads that occur at an altitude of to the aft major ring frame of the External Tank.
about 34,000 feet. Thereafter, the thrust is again The boosters are thus connected to the tank at
increased to provide an acceleration of three times four points, one forward and three aft.
that of gravity in the last minute or so of powered Three structural elements link the Orbiter to
flight. the External Tank. A "wishbone" attachment
beneath the crew compartment connects the for-
External Tank ward end of the Orbiter to the tank. The two aft
The External Tank carries the propellants for connections are tripods at the base of the Exter-
the Orbiter's main engines143,000 gallons of nal Tank.
liquid oxygen and 383,000 gallons of liquid A command from the Orbiter computer jet-
hydrogen, which is much lighter than a com- tisons the External Tank 18 seconds after main
parable volume of oxygen. Together, the pro- engine cutoff, about 8 Vi minutes after liftoff. To
pellants weigh a little more than 790 tons. Mar- ensure that it will travel a predictable path, a tum-
tin Marietta Denver Aerospace, Michoud, Loui- ble system rotates the tank end-over-end at a
siana, builds the tank, a welded aluminum alloy minimum rate of two revolutions per minute. The
cylinder with an ogive nose and a hemispherical tank breaks up upon atmospheric entry, falling
tail. It is 154 feet long and 27 Vi feet in diameter. into the planned area of the Indian or Pacific
Because the Orbiter and the two Solid Rocket Ocean about an hour after liftoff. The External
Boosters are attached to it at liftoff, the External Tank is the only main component of the Space
Tank absorbs the thrust of the combined propul- Shuttle that is not recovered and reused.
sion system. It withstands complex load effects
and pressures from the propellants. Solid Rocket Boosters
The liquid oxygen tank forms the nose of the The two solid-propellant rocket boosters are
External Tank. It contains oxidizer kept liquid almost as long as the External Tank and attached
at a temperature of - 297 degrees Fahrenheit. A to each side of it. They contribute about 80 per-
removable conical nose cap acts as an cent of the total thrust at liftoff; the rest comes
aerodynamic fairing. Inside the tank, baffles from the Orbiter's three main engines. Roughly
reduce sloshing and the associated control prob- two minutes after liftoff and 24 miles down range,
lems. The liquid hydrogen tank does not need the solid rockets have exhausted their fuel. Ex-
baffles because the fuel is so light that sloshing plosives separate the boosters from the External
does not induce significant forces. The liquid Tank. Small rocket motors move them away from
hydrogen tank accounts for the greater part of the External Tank and the Orbiter, which con-
the External Tank. Its contents are even colder tinue toward orbit under thrust of the Shuttle's
than the LOX: - 423 degrees Fahrenheit. main engines.
8
The Solid Rocket Booster is made up of several satellites deployed into orbit, retrieved or
subassemblies: the nose cone, Solid Rocket Motor repaired; observations made of the Earth and the
and the nozzle assembly. Marshall is responsi- solar system. The Shuttle makes one revolution
ble for the Solid Rocket Booster; Morton Thiokol, of the Earth approximately every 90 minutes dur-
Inc., Wasatch Division, Brigham City, Utah, is ing the satellite mission.
the contractor for the Solid Rocket Motors. Each When it comes out of orbit, the Shuttle is mov-
Solid Rocket Motor case is made of 11 individual ing at about 17,500 miles an hour. Reaction
cylindrical weld free steel sections about 12 feet engines position the Orbiter nose forward again
in diameter. When assembled, they form a tube for entry into the atmosphere. Those thrusters
almost 116 feet long. The 11 sections are the for- continue to control the Orbiter's attitude until the
ward dome section, six cylindrical sections, the atmosphere becomes dense enough for the
aft External Tank-attach ring section, two stif- aerodynamic surfaces to take effect.
fener sections, and the aft dome section. The Shuttle enters the ever-thickening blanket
The 11 sections of the motor case are joined of atmosphere at 400,000 feet of altitude and a
by tang-and-clevis joints held together by 177 speed of more than 17,000 miles an hour (about
steel pins around the circumference of each joint. Mach 25). The Orbiter's nose is positioned 40
After the sections have been machined to fine degrees above its flight path. That attitude in-
tolerances and fitted, they are partly assembled creases aerodynamic drag, thus helping to
at the factory into four casting segments. Those dissipate the tremendous amount of energy that
four cylindrical segments are the parts of the the spacecraft has when it enters the atmosphere.
motor case into which the propellant is poured Friction heats the surface of the Orbiter, which
(or cast). They are shipped by rail in separate is protected by thermal tiles, and ionizes the sur-
pieces to Kennedy. rounding air, preventing radio communication
Joints assembled before the booster is shipped with Earth for the next 13 minutes.
are known as factory joints. Joints between the The flight control system's computer program
four casting segments are called field joints; they allows use of the reaction thrusters and
are connected at Kennedy when the booster aerodynamic surfaces in combination to control
segments are stacked for final assembly. the spacecraft. At Mach 4.2, the rudder is ac-
tivated, and the last reaction thrusters are deac-
Orbital Maneuvering System tivated at Mach 1. Thereafter, the craft is entirely
The two engine pods on the aft fuselage of the maneuvered like an airplane by movement of the
Orbiter contain maneuvering engines and their aerodynamic control surfaces: elevons, rudder,
propellant monomethyl hydrazine (the fuel) and speed brake, and body flap.
nitrogen tetroxide (the oxidizer). Helium In the landing approach, the Orbiter has no
pressurizes the propellant tanks, and the fuel and propulsion. It has only its velocity and altitude.
the oxidizer ignite on contact. Its energy must be carefully managed to
Forty-four small rocket motors in the Orbiter's maneuver the Shuttle aerodynamically to a safe
nose and aft section maneuvering system pods landing. Beginning this terminal phase, the glide
allow adjustments of the vehicle's attitude in pitch, slope is steep19 degrees as the Orbiter
yaw, and roll axes. They also may be used to descends toward the runway. Half a minute
make small changes of velocity along one of the before touchdown and two miles from the run-
Orbiter's three axes. way, the craft flares to a shallow, almost flat 1.5
degree glide slope. Touchdown occurs at 225
miles per hour. On the runway, the Orbiter rolls
to a stop, and the mission is complete.
Flight of a Shuttle
Except for ascent and entry, all of the Shut- References
tle's typical seven-day mission is in orbit. That 1
Space Task Group Report to the President, "The Post-
is where the goals of a given mission are ac- Apollo Space Program: Directions for the Future," September,
complished: scientific experiments carried out; 1969, pages 20 and 21.
Chapter II

Events Leading
Up to the
Challenger Mission

Preparations for the launch of mission for the observation of Halley's Comet.
51-L were not unusual, though they The NASA communications satellite was to
were complicated by changes in the have been placed in a geosynchronous orbit with
launch schedule. The sequence of the aid of a booster called the Inertial Upper
complex, interrelated steps involved in produc- Stage. The satellite would have supported com-
ing the detailed schedule and supporting logistics munications with the Space Shuttle and up to 23
necessary for a successful mission always requires other spacecraft.
intense effort and close coordination. The Spartan satellite was to have been
Flight 51-L of the Challenger was originally deployed into low Earth orbit using the remote
scheduled for July, 1985, but by the time the crew manipulator system. The Spartan instruments
was assigned in January, 1985, launch had been would have watched Halley's Comet when it was
postponed to late November to accommodate too close to the Sun for other observatories to do
changes in payloads. The launch was subsequent- so. Subsequently, the satellite would have been
ly delayed further and finally rescheduled for late retrieved and returned to Earth in the Shuttle
January, 1986. payload bay.
After the series of payload changes, the
Challenger cargo included two satellites in the
cargo bay and equipment in the crew compart- Crew Assignments
ment for experiments that would be carried out
during the mission. The payloads flown on mis- On January 27, 1985, one year before launch,
sion 51-L are listed in this table: NASA announced the names of the astronauts
assigned to mission 51-L:
Mission 51-L Payloads Commander Francis R. Scobee
Tracking and Data Relay Satellite-B Pilot Michael J. Smith
Spartan-Halley Satellite Mission Specialist Ellison S. Onizuka
Comet Halley Active Monitoring Program One
Fluid Dynamics Experiment Mission Specialist Judith A. Resnik
Phase Partitioning Experiment Two
Teacher in Space Project Mission Specialist Ronald E. McNair
Shuttle Student Involvement Program Three
Radiation Monitoring Experiment
The mission commander, Francis R. (Dick)
Scobee, first flew on the Space Shuttle as the pilot
The primary payloads were the Tracking and of mission 41-C in April, 1984. Mr. Scobee, a
Data Relay Satellite (a NASA communications native of Auburn, Washington, received his
satellite) and the Spartan satellite that would be bachelor's degree in aerospace engineering from
deployed into orbit carrying special instruments the University of Arizona. A former Air Force

10
Space Shuttle 51-L on Pad 39B of Kennedy Space Center's launch complex.

11
test pilot with 7,000 hours in 45 aircraft types, an astronaut in 1978 and flew on the first military
he became an astronaut in 1978. mission (51-C) in January, 1985, aboard the
The mission pilot, Captain Michael J. Smith, Space Shuttle Discovery.
USN, was on his first Shuttle flight after being Mission specialist Judith A. Resnik, Ph.D.,
selected as an astronaut in 1980. A native of flew on the first flight of the Orbiter Discovery
Beaufort, North Carolina, Captain Smith, a 1967 on mission 41-D in August, 1984. Born in Akron,
graduate of the United States Naval Academy, Ohio, Dr. Resnik received her doctorate in elec-
received a master's degree from the Naval trical engineering from the University of
Postgraduate School. He was a Navy test pilot Maryland in 1976. After working for several in-
with extensive experience in a variety of aircraft. dustrial firms, she became an astronaut in 1978.
Mission specialist Lieutenant Colonel Ellison Mission specialist Ronald E. McNair, Ph.D.,
S. Onizuka, USAF, from Kealakekua, Kona, a native of Lake City, South Carolina, received
Hawaii, received his master's degree in aerospace his doctorate in physics from the Massachusetts
engineering at the University of Colorado. A Institute of Technology in 1976. After working
flight test engineer in the Air Force, he became as a research physicist in civilian industry, he

Mission 51-L Major Milestone Summary

Launch Minus
(months) 8 7 6 5 4 3
H -\ H
Date Jun85 Jul85 Aug 85 Sep85 Oct85 Nov85 Dec 85 Jan 86 Feb86
H 1 1 1 H +

Final Crew
Basic Crew Activity Plan
Activity Plan

Standalone Shuttle Mission


Simulator Crew Training

_L
Standard
Production Integrated Simulations
Concept
Launch v
Flight Design Cycle 1 Flight Design Cycle 2

I
Configure Mission
r-| Control Center &
Shuttle Simulator
T
Facility & Flight
Facility & Vehicle Software Software
Final Cycle

Launchsite Schedule
Review
I Ii I
1 I
Cargo Launch Minus Flight Flight
Integration 5 Months Operations Readiness
Review Review Review Review
Diagram shows the scheduling of various preparatory
milestones in the months that preceded the launching of the
Mission 51-L Shuttle.

12
became an astronaut in 1978 and first flew on For mission 51-L, the cargo integration review
mission 41-B in February, 1984, aboard the was rescheduled six times, primarily because of
Space Shuttle Challenger. payload changes. All major payload changes were
Payload specialists are members of a Space made, however, before the review eventually took
Shuttle crew who are not career astronauts. Two place on June 18, 1985, seven months before the
such specialists, Christa McAuliffe and Gregory launch. Until the cargo integration review for a
B. Jarvis, were added to the crew of mission 51-L. mission is completed, the development of the final
Ms. McAuliffe was born in Boston and raised flight design products cannot really get underway.
in Framingham, Massachusetts, where she Because the mission 51-L payload changes were
graduated from Framingham State College. After made before the cargo integration review,
teaching a variety of junior high and high school however, changes to the manifest did not seriously
subjects in Maryland and New Hamphire, she disrupt the preparatibn cycle.
was selected as the Teacher in Space. She was Once the principal payload items were deter-
assigned to the 51-L crew in July, 1985. mined and the cargo integration review was com-
Mr. Jarvis was a former Air Force engineer pleted, the flight design process became relatively
who specialized in satellite design. He was born straightforward. The flight design process is the
in Detroit, Michigan, and received his master's central element in flight preparation. The proc-
degree in electrical engineering from North- ess transforms the broad objectives of the flight
eastern University in Boston. He was assigned into a detailed sequence of events from launch
to the 51-L crew in October, 1985, as a represent- to landing. For mission 51-L, the objectives con-
ative of the Hughes Aircraft Company. sisted of placing one satellite in orbit, deploying
The payload specialists each had respon- and retrieving Spartan, and conducting the six
sibilities for mission 51-L. Ms. McAuliffe was to experiments. From that base, the flight design
conduct a series of classroom lessons from orbit process produced a detailed schedule of events,
and conduct several basic classroom experiments. trajectory data, requirements for consumable
Mr. Jarvis was to perform a series of fluid items, communications requirements and the
dynamics experiments that would support satellite necessary computer programing for the Orbiter,
redesign. the Mission Control Center, and the Shuttle
simulator used to train the crew for this particular
Preparations for Flight mission.
The launch minus five months Flight Plan-
Planning for mission 51-L began in 1984, but ning and Stowage Review was conducted on
10 major change documents adding or deleting August 20, 1985, to address any unresolved issues
payload items caused some disruption in the and any changes to the plan that had developed
preparation process. Because the 12- to 18-month to that point. Ideally, the mission events are firm-
process is a series of repetitive cycles that define ly determined before the review takes place. For
a flight design in progressively more specific mission 51-L, however, Mr. Jarvis was not added
detail, significant changes can require extensive to the crew until October 25, 1985, and his ac-
time and effort to incorporate. The closer to the tivities could not be incorporated into mission
planned launch date the changes occur, the more planning until that time. The crew activity plan,
difficult and disruptive it becomes to repeat the the formal flight requirements and the flight
cycles necessary to complete a mission plan. (See design status were reviewed as well as the cur-
the Mission 51-L Milestone Summary chart.) rent status of the engineering integration, the
Although there were several significant changes photo and TV requirements, and crew compart-
to the cargo manifest, most occurred early enough ment stowage. The Flight Planning and Stowage
in the planning cycle to minimize their impact Review did identify the need for further con-
on the flight preparation. sideration of the launch window and of the then
The cargo integration review is one of the undefined requirements for the Teacher-in-Space
crucial coordination meetings in the flight program.
preparation process. At that meeting, re- There were changes to middeck payloads,
quirements for all payloads are examined to en- resulting from the addition of Mr. Jarvis, that
sure that, collectively, they are within the occurred less than three months before launch.
capabilities of the vehicle and crew. The most negative result of the changes was a
13
delay in publishing the crew activity plan. The standard. Thus, mission 51-L did not involve
crew activity plan specifies the in-flight schedule radical departures from previous flight patterns.
for all crew members, which in turn affects other The crew began training 37 weeks before
aspects of flight preparation. Because the NASA launch. Preparation in the Shuttle Mission
communications satellite training requirements Simulator, a fully instrumented mock-up of the
were quite similar to those for a previous flight, Shuttle interior, began at launch minus 36 weeks.
the crew training began using that existing crew Integrated training in the simulator, which allows
activity plan and associated checklists. Con- the crew to train with the flight controllers who
siderable time was saved as a result. The re- will be controlling the flight in both the Mission
quirements unique to Spartan did not involve ma- Control Center and remote centers, began at
jor departures from the standard satellite deploy- launch minus nine weeks. For the crew, Shuttle
ment and rendezvous techniques that had been simulator training included preparation for the
developed on mission 51-G, the experiment use of the robot arm, a rendezvous in space, In-
packages did not require any new Orbiter pro- ertial Upper Stage deployment, ascent and en-
cedures, and the ascent and entry techniques were try procedures, and a variety of other activities

Crew Workload Comparison

so-

so

70

60

50
s^y-
Hours/
week
40

3D

20

ID

9 8 7
Launch Minus Week
51-1 BSI-J A61-A 061-B T61-C DSI-L
Graph compares training workloads of crews for six Shuttle
missions in the nine weeks that preceded the launching of
the space flights.

14
that must be practiced repeatedly if a Shuttle mis- flight can be launched is determined by the re-
sion is to be carried out successfully. quirements of the Orbiter and the payloads. The
All NASA crew members exceeded the number launch period for mission 51-L was limited in
of training hours required and were certified pro- order to provide the best lighting conditions for
ficient in all mission tasks. The two payload Spartan's observations of Halley's Comet. The
specialists also fulfilled their training re- resulting "launch window" was a topic of some
quirements. All mission 51-L astronauts and discussion at the Flight Readiness Review. The
flight controllers were certified ready for flight. Challenger launch originally had been scheduled
From a flight design process point of view, mis- for a morning lift off. When Spartan was added
sion 51-L was a fairly typical mission. The most to the mission, the launch window was changed
noticeable effect of the delays in the production to the afternoon. This change would have re-
process was a delay in the start of Shuttle Mis- quired a landing at night if a transatlantic abort
sion Simulator training specific to the flight. That landing had become necessary. Because the alter-
training began at launch minus nine weeks for nate transatlantic site, Casablanca, was not
the crew of 51-L, two weeks later than the original equipped for a night landing, the afternoon
schedule required. launch eliminated that back-up site. As January
Compressed training time was becoming a con- drew to a close, however, the conditions for op-
cern in late 1985. The crew of mission 51-L train- timum telescopic viewing of the comet could not
ed for an average of 48.7 hours per week during be met. The launch window was shifted back to
those nine weeks before launch, with peaks the morning hours so that the transatlantic abort
reaching 65 to 70 hours per week. Much more site would be in daylight and a back-up site
compression in their training schedule would not (Casablanca) would be available.
have been possible. (See the Crew Workload The results of the flight design process were
Comparisons graph.) summarized at the Flight Readiness Review. The
Launch date delays for mission 61-C also predicted ascent performance, including expected
became a scheduling factor for the integrated trajectory, main engine throttling profile, ex-
simulations for mission 51-L. Originally sched- pected dynamic pressure and the amount of pro-
uled for the third week in December, the 61-C pellant reserve expected at main engine cutoff,
launch was delayed until January 12, 1986. Dur- were presented and discussed. The expected land-
ing the last six weeks before the Challenger ing parameters, weight and center of gravity
launch, the 51-L schedule was changed several figures were also presented for a variety of con-
times as a result of launch delays of 61-C. The tingencies. It should be noted that a waiver was
final impact on the Challenger crew training was required because the weight of the Orbiter ex-
reduced spacing between the ascent and entry ceeded the allowable limits for an abort landing.
simulations during the last two weeks before The flight design data presented at the Flight
launch, but no training time was lost. Readiness Review are available in the Appendix
in the NASA Mission Planning and Operations
Team Report. No outstanding concerns were
identified in the discussion of flight design.
Flight Readiness Review The detailed flight plan and schedule of crew
activities also were presented at the Flight
The Level I Flight Readiness Review for mis- Readiness Review. The Challenger was to circle
sion 51-L took place on January 15, 1986. The the Earth for six days at an orbital altitude of ap-
Flight Readiness Review should address all proximately 153 nautical miles, landing early on
aspects of flight preparation about which any the seventh day at Kennedy in Florida.
questions have arisen. In addition, attendees con- The major activities were to include deploy-
firm that all equipment and operational plans ment of the tracking and data relay satellite 10
have been certified ready by the responsible hours after launch, deployment of the Spartan
manager within NASA. Solid Rocket Booster satellite on the third day of the flight and subse-
joints were not discussed during the review on quent retrieval of the Spartan two days later. A
January 15. summary of the planned activities is provided in
The period during the day when a particular the table that follows.

15
Mission 51-L Orbital Activity Schedule

Day One After arriving in orbit, the crew had two periods of scheduled high activity. First,
they were to check the readiness of the NASA satellite prior to planned deploy-
ment. After a lunch break, they were to deploy the satellite and Inertial Upper
Stage and to perform a series of separation maneuvers. The first sleep period was
scheduled to be eight hours long starting about 18 hours after crew wake-up on
launch morning.

Day Two The Comet Halley Active Monitoring Program experiment was scheduled to begin
on the second day. Also scheduled were the initial teacher-in-space video taping
and a firing of the orbital maneuvering engines to place the Orbiter at the 152-mile
orbital altitude from which the Spartan would be deployed.

Day Three The third day was to start with the crew programing the Spartan satellite with
data sent from Johnson. The satellite was to be deployed using the remote
manipulator system (the robot arm), and then the Orbiter would be maneuvered
to produce, by day four, a 90-mile separation from Spartan.

Day Four The Orbiter was to begin closing on Spartan while Jarvis continued the fluid
dynamics experiments started on day two and day three. In addition, two lessons
telecast live were to be conducted by Ms. McAuliffe.

Day Five After rendezvous with Spartan, the crew was to use the robot arm to capture the
satellite and re-stow it in the payload bay.

Day Six Entry preparations were to dominate the last full day in space: flight control system
checks, test firing of maneuvering jets needed for entry, and cabin stowage. A
crew news conference also was scheduled following the lunch period, if requested
by the NASA Public Affairs Office.

Day Seven The seventh day would have been spent preparing the Space Shuttle for deorbit
and entry into the atmosphere. The Challenger was scheduled to land at Ken-
nedy 144 hours and 34 minutes after launch.

16
Launch Delays during the night and it caused considerable con-
cern for the launch team. In reaction, the ice in-
spection team was sent to the launch pad at 01:35
a.m., January 28, and returned to the Launch
The launch of mission 51-L was postponed Control Center at 03:00 a.m. After a meeting to
three times and scrubbed once from the planned consider the team's report, the Space Shuttle pro-
date of January 22, 1986. The first postponement gram manager decided to continue the count-
was announced on December 23, 1985. That down. Another ice inspection was scheduled at
change established the launch date as January 23, launch minus three hours.
1986, in order to accommodate the final in- Also, during the night, prior to fueling, a prob-
tegrated simulation schedule that resulted from lem developed with a fire detector in the ground
the slip in the launch date of mission 61-C. liquid hydrogen storage tank. Though it was
On January 22, 1986, the Program Re- ultimately tracked to a hardware fault and
quirements Change Board first slipped the launch repaired, fueling was delayed by two and one-
from January 23 to January 25. That date subse- half hours. By continuing past a planned hold at
quently was changed to January 26, 1986, launch minus three hours, however, the launch
primarily because of Kennedy work requirements delay was reduced to one hour. Crew wake-up
produced by the late launch of mission 61-C. was rescheduled for 06:18 a.m., January 28, but
The third postponement of the launch date oc- by that time the crew was already up.
curred during an evening management con- Because of forecast rain and low ceilings at
ference on January 25, 1986, to review the Casablanca, the alternate abort site, that site was
weather forecast for the Kennedy area. Because declared a "no-go" at 07:30 a.m. The change had
the forecast was for unacceptable weather no mission impact, however, because the weather
throughout the launch window on January 26, at the primary transatlantic abort landing site at
early countdown activities that had already Dakar, Senegal, was acceptable. The abort-once-
started were terminated. around site was Edwards Air Force Base,
The launch attempt of January 27 began the California.
day before as the complex sequence of events With an extra hour, the crew had more than
leading to lift off commenced. Fueling of the Ex- sufficient time to eat breakfast, get a weather
ternal Tank began at 12:30 a.m. Eastern Stand- briefing and put on flight gear. At the weather
ard Time. The crew was awakened at 05:07 a.m., briefing, the temperature and ice on the pad were
and events proceeded normally with the crew discussed, but neither then nor in earlier weather
strapped into the Shuttle at 07:56 a.m. At 09:10, discussions was the crew told of any concern
however, the countdown was halted when the about the effects of low temperature on the Shuttle
ground crew reported a problem with an exterior System. The seven crew members left the crew
hatch handle. By the time the hatch handle prob- quarters and rode the astronaut van to launch pad
lem was solved at 10:30 a.m., winds at the Ken- B, arriving at 08:03. They were in their seats in
nedy runway designated for a return-to-launch- the Challenger at 08:36 a.m.
site abort had increased and exceeded the At 08:44 a.m. the ice team completed its sec-
allowable velocity for crosswinds. The launch at- ond inspection. After hearing the team's report,
tempt for January 27 was canceled at 12:35 p.m. the program manager decided to allow additional
Eastern Standard Time; the Challenger count- time for ice to melt on the pad. He also decided
down was rescheduled for January 28. to send the ice team to perform one final ice
The weather was forecast to be clear and very assessment at launch minus 20 minutes. When
cold, with temperatures dropping into the low the count was resumed, launch had been delayed
twenties overnight. The management team a second hour beyond the original lift off time of
directed engineers to assess the possible effects of 09:38 a.m.. Eastern Standard Time.
temperature on the launch. No critical issues were At 11:15 the ice inspection was completed, and
identified to management officials, and while during the hold at launch minus nine minutes,
evaluation continued, it was decided to proceed the mission 51-L crew and all members of the
with the countdown and the fueling of the Ex- launch team gave their "go" for launch. The final
ternal Tank. flight of the Challenger began at 11:38:00.010
Ice had accumulated in the launch pad area a.m., Eastern Standard Time, January 28, 1986.
17
The Flight of the Challenger pected. Voice communications with the crew
were normal. The crew called to indicate the
The events that followed lift off were brief: Shuttle had begun its roll to head due east and
to establish communication after launch. Fifty-
Launch Time Event seven seconds later. Mission Control informed
- 6.6 sec. Space Shuttle engines ignition the crew that the engines had successfully throt-
0 sec. Solid Rocket Booster ignition tled up and all other systems were satisfactory.
+ 7 sec. "Roll program." (Challenger) The commander's acknowledgment of this call
"Roger, roll, Challenger." was the last voice communication from the
(Houston) Challenger.
+ 24 sec. Main engines throttled down to There were no alarms sounded in the cockpit.
94%
The crew apparently had no indication of a prob-
+ 42 sec. Main engines throttled down to
lem before the rapid break-up of the Space Shuttle
65%
system. The first evidence of an accident came
+ 59 sec. Main engines throttled up to
104% from live video coverage. Radar then began to
+ 65 sec. "Challenger, go at throttle up." track multiple objects. The flight dynamics of-
(Houston) "Roger. Go at throttle ficer in Houston confirmed to the flight director
up." (Challenger) that "RSO [range safety officer] reports vehicle
+ 73 sec. Loss of signal from Challenger exploded," and 30 seconds later he added that the
range safety officer had sent the destruct signal
to the Solid Rocket Boosters.
From lift off until the signal from the Shuttle During the period of the flight when the Solid
was lost, no flight controller observed any indica- Rocket Boosters are thrusting, there are no sur-
tion of a problem. The Shuttle's main engines vivable abort options. There was nothing that
throttled down to limit the maximum dynamic either the crew or the ground controllers could
pressure, then throttled up to full thrust as ex- have done to avert the catastrophe.

18
Chapter III

The Accident

Flight of the Space Shuttle Challenger on 3 cycles per second. The maximum structural
Mission 51-L began at 11:38 a.m. loads on the aft field joints of the Solid Rocket
Eastern Standard Time on January 28, Boosters occur during the "twang," exceeding
1986. It ended 73 seconds later in even those of the maximum dynamic pressure
an explosive burn of hydrogen and oxygen pro- period experienced later in flight.
pellants that destroyed the External Tank and ex- Just after liftoff at .678 seconds into the flight,
posed the Orbiter to severe aerodynamic loads photographic data show a strong puff of gray
that caused complete structural breakup. All smoke was spurting from the vicinity of the aft
seven crew members perished. The two Solid field joint on the right Solid Rocket Booster. The
Rocket Boosters flew out of the fireball and were two pad 39B cameras that would have recorded
destroyed by the Air Force range safety officer the precise location of the puff were inoperative.
110 seconds after launch. Computer graphic analysis of film from other
The ambient air temperature at launch was 36 cameras indicated the initial smoke came from
degrees Fahrenheit measured at ground level ap- the 270 to 310-degree sector of the circumference
proximately 1,000 feet from the 51-L mission of the aft field joint of the right Solid Rocket
launch pad 39B. This temperature was 15 degrees Booster. This area of the solid booster faces the
colder than that of any previous launch. External Tank. The vaporized material stream-
The following description of the flight events ing from the joint indicated there was not com-
is based on visual examination and image plete sealing action within the joint.
enhancement of film from NASA operated Eight more distinctive puffs of increasingly
cameras and telemetry data transmitted from the blacker smoke were recorded between .836 and
Space Shuttle to ground stations. The last 2.500 seconds. The smoke appeared to puff up-
telemetry data from the Challenger was received wards from the joint. While each smoke puff was
73.618 seconds after launch. being left behind by the upward flight of the Shut-
At 6.6 seconds before launch, the Challenger's tle, the next fresh puff could be seen near the level
liquid fueled main engines were ignited in se- of the joint. The multiple smoke puffs in this se-
quence and run up to full thrust while the entire quence occurred at about four times per second,
Shuttle structure was bolted to the launch pad. approximating the frequency of the structural
Thrust of the main engines bends the Shuttle load dynamics and resultant joint flexing. Com-
assembly forward from the bolts anchoring it to puter graphics applied to NASA photos from a
the pad. When the Shuttle assembly springs back variety of cameras in this sequence again placed
to the vertical, the Solid Rocket Boosters' restrain- the smoke puffs' origin in the 270-to 310-degree
ing bolts are explosively released. During this pre- sector of the original smoke spurt.
release "twang'' motion, structural loads are stored As the Shuttle increased its upward velocity,
in the assembled structure. These loads are re- it flew past the emerging and expanding smoke
leased during the first few seconds of flight in a puffs. The last smoke was seen above the field
structural vibration mode at a frequency of about joint at 2.733 seconds. At 3.375 seconds the last

19
smoke was visible below the Solid Rocket dynamic pressure of 720 pounds per square foot.
Boosters and became indiscernible as it mixed Main engines had been throttled up to 104 per-
with rocket plumes and surrounding atmosphere. cent thrust and the Solid Rocket Boosters were
The black color and dense composition of the increasing their thrust when the first flickering
smoke puffs suggest that the grease, joint insula- flame appeared on the right Solid Rocket Booster
tion and rubber O-rings in the joint seal were be- in the area of the aft field joint. This first very
ing burned and eroded by the hot propellant small flame was detected on image enhanced film
gases. at 58.788 seconds into the flight. It appeared to
Launch sequence films from previous missions originate at about 305 degrees around the booster
were examined in detail to determine if there were circumference at or near the aft field joint.
any prior indications of smoke of the color and One film frame later from the same camera,
composition that appeared during the first few the flame was visible without image enhance-
seconds of the 51-L mission. None were found. ment. It grew into a continuous, well-defined
Other vapors in this area were determined to be plume at 59.262 seconds. At about the same time
melting frost from the bottom of the External (60 seconds), telemetry showed a pressure dif-
Tank or steam from the rocket exhaust in the ferential between the chamber pressures in the
pad's sound suppression water trays. right and left boosters. The right booster chamber
Shuttle main engines were throttled up to 104 pressure was lower, confirming the growing leak
percent of their rated thrust level, the Challenger in the area of the field joint.
executed a programmed roll maneuver and the As the flame plume increased in size, it was
engines were throttled back to 94 percent. deflected rearward by the aerodynamic slipstream
At approximately 37 seconds. Challenger en- and circumferentially by the protruding structure
countered the first of several high-altitude wind of the upper ring attaching the booster to the Ex-
shear conditions, which lasted until about 64 ternal Tank. These deflections directed the flame
seconds. The wind shear created forces on the plume onto the surface of the External Tank. This
vehicle with relatively large fluctuations. These sequence of flame spreading is confirmed by
were immediately sensed and countered by the analysis of the recovered wreckage. The grow-
guidance, navigation and control system. ing flame also impinged on the strut attaching
Although flight 51-L loads exceeded prior ex- the Solid Rocket Booster to the External Tank.
perience in both yaw and pitch planes at certain At about 62 seconds into the flight, the con-
instants, the maxima had been encountered on trol system began to react to counter the forces
previous flights and were within design limits. caused by the plume and its effects. The left Solid
The steering system (thrust vector control) of Rocket Booster thrust vector control moved to
the Solid Rocket Booster responded to all com- counter the yaw caused by reduced thrust from
mands and wind shear effects. The wind shear the leaking right Solid Rocket Booster. During
caused the steering system to be more active than the next nine seconds. Space Shuttle control
on any previous flight. systems worked to correct anomalies in pitch and
At 45 seconds into the flight, three bright yaw rates.
flashes appeared downstream of the Challenger's The first visual indication that swirling flame
right wing. Each flash lasted less than one- from the right Solid Rocket Booster breached the
thirtieth of a second. Similar flashes have been External Tank was at 64.660 seconds when there
seen on other flights. Another appearance of a was an abrupt change in the shape and color of
separate bright spot was diagnosed by film the plume. This indicated that it was mixing with
analysis to be a reflection of main engine exhaust leaking hydrogen from the External Tank. Tele-
on the Orbital Maneuvering System pods located metered changes in the hydrogen tank pressuriza-
at the upper rear section of the Orbiter. The tion confirmed the leak. Within 45 milliseconds
flashes were unrelated to the later appearance of of the breach of the External Tank, a bright sus-
the flame plume from the right Solid Rocket tained glow developed on the black-tiled under-
Booster. side of the Challenger between it and the Exter-
Both the Shuttle main engines and the solid nal Tank.
rockets operated at reduced thrust approaching Beginning at about 72 seconds, a series of
and passing through the area of maximum events occurred extremely rapidly that terminated

20
the flight. Telemetered data indicate a wide varie- failed at 73.137 seconds as evidenced by the white
ty of flight system actions that support the visual vapors appearing in the intertank region.
evidence of the photos as the Shuttle struggled Within milliseconds there was massive, almost
futilely against the forces that were destroying it. explosive, burning of the hydrogen streaming
At about 72.20 seconds the lower strut linking from the failed tank bottom and the liquid oxy-
the Solid Rocket Booster and the External Tank gen breach in the area of the intertank.
was severed or pulled away from the weakened At this point in its trajectory, while traveling
hydrogen tank permitting the right Solid Rocket at a Mach number of 1.92 at an altitude of 46,000
Booster to rotate around the upper attachment feet, the Challenger was totally enveloped in the
strut. This rotation is indicated by divergent yaw explosive burn. The Challenger's reaction con-
and pitch rates between the left and right Solid trol system ruptured and a hypergolic burn of its
Rocket Boosters. propellants occurred as it exited the oxygen-
At 73.124 seconds, a circumferential white hydrogen flames. The reddish brown colors of the
vapor pattern was observed blooming from the hypergolic fuel burn are visible on the edge of the
side of the External Tank bottom dome. This was main fireball. The Orbiter, under severe
the beginning of the structural failure of the aerodynamic loads, broke into several large sec-
hydrogen tank that culminated in the entire aft tions which emerged from the fireball. Separate
dome dropping away. This released massive sections that can be identified on film include the
amounts of liquid hydrogen from the tank and main engine/tail section with the engines still'
created a sudden forward thrust of about 2.8 burning, one wing of the Orbiter, and the for-
million pounds, pushing the hydrogen tank up- ward fuselage trailing a mass of umbilical lines
ward into the intertank structure. At about the pulled loose from the payload bay.
same time, the rotating right Solid Rocket Booster Evidence in the recovered wreckage from the
impacted the intertank structure and the lower 51-L mission hardware supports this final se-
part of the liquid oxygen tank. These structures quence of events.

21
Immediately after solid rocket
motor ignition, dark smoke
arrows) swirled out between
the right hand booster and
the External Tank. The
smoke's origin, behavior and
duration was approximated
by visual analysis and com-
puter enhancement of film
from five camera locations.
Consensus: smoke was first
discernible at .678 seconds
Mission Elapsed Time in the
vicinity of the right booster's
aft field joint.

22
Multiple smoke puffs are visible in the photo above
(arrows). They began at .836 seconds and continued
through 2.500 seconds, occurring about 4 times a
second. Upward motion of the vehicle caused the
smoke to drift downward and blur into a single cloud
Smoke source is shown in the computer generated
drawing (far right).

24
At 58.788 seconds, the first
flicker of flame appeared. Barely
visible above, it grew into a
large plume and began to im-
pinge on the External Tank at
about 60 seconds. Flame is pin-
pointed in the computer drawing
between the right booster and
the tank, as in the case of earlier
smoke puffs. At far right (arrow),
vapor is seen escaping from the
apparently breached External
Tank.

26
Camera views indicate the beginning of rupture of attributed to rupture of the liquid oxygen tank,
the liquid hydrogen and liquid oxygen tanks within occurred above the booster/tank forward attachment
the External Tank. A small flash (arrows above) (below left) and grew in milliseconds to the maximum
intensified rapidly, then diminished, A second flash. size indicated in the computer drawing.
^
Structural breakup of the vehicle began at
approximately 73 seconds. Fire spread very
rapidly. Above, a bright flash (arrow) is evi-
dent near the nose of the Orbiter, suggesting
spillage and ignition of the spacecraft's re-
action control system propellants. At left, the
two Solid Rocket Boosters thrust away from
the fire, crisscrossing to form a "V." The right
boosteridentifiable by its failure plume-
now to the left of its counterpart. At right, the
boosters diverge farther; the External Tank
wreckage is obscured by smoke and vapor.
The Orbiter engines still firing, is visible at
bottom center.
;;:;

mm
mi
i'ili-':.'--

*?;;

At about 76 seconds, unidentifiable fragments of the Shut- soars away, still thrusting. The reddish-brown cloud envel-
tle vehicle can be seen tumbling against a background of ops the disintegrating Orbiter. The color is characteristic
fire, smoke and vaporized propellants from the External of the nitrogen tetroxide oxidizer in the Orbiter Reaction
Tank (left). In the photo at right, the left booster (far right) Control System propellent.

33
34
At 11;44 a.m. Eastern Standard Time, a GOES environment-
monitoring satellite operated by the National Oceanic and
Atmospheric Administration acquired this image of the
smoke and vapor cloud from the 51-L accident. The coast
of Florida is outlined in red.
STS 51-L Sequence of Major Events
Mission Time Elapsed
(GMT, in hr:min:sec) Event Time (sees.) Source

16:37:53.444 ME - 3 Ignition Command -6.566 GPC


37:53.564 ME - 2 Ignition Command -6.446 GPC
37:53.684 ME - 1 Ignition Command -6.326 GPC
38:00.010 SRM Ignition Command (T = 0) 0.000 GPC
38:00.018 Holddown Post 2 PIC firing 0.008 E8 Camera
38:00.260 First Continuous Vertical Motion 0.250 E9 Camera
38:00.688 Confirmed smoke above field joint on
RH SRM 0.678 E60 Camera
38:00.846 Eight puffs of smoke (from 0.836 thru
2.500 sec MET) 0.836 E63 Camera
38:02.743 Last positive evidence of smoke above
right aft SRB/ET attach ring 2.733 CZR-1 Camera
38:03.385 Last positive visual indication of smoke 3.375 E60 Camera
38:04.349 SSME 104% Command 4.339 E41M2076D
38:05.684 RH SRM pressure 11.8 psi above
nominal 5.674 B47P2302C
38:07.734 Roll maneuver initiated 7.724 V90R5301C
38:19.869 SSME 94% Command 19.859 E41M2076D
38:21.134 Roll maneuver completed 21.124 V90R5301C
38:35.389 SSME 65% Command 35.379 E41M2076D
38:37.000 Roll and Yaw Attitude Response to Wind
(36.990 to 62.990 sec) 36.990 V95H352nC
38:51.870 SSME 104% Command 51.860 E41M2076D
38:58.798 First evidence of flame on RH SRM 58.788 E207 Camera
38:59.010 Reconstructed Max Q (720 psf) 59.000 BET
38:59.272 Continuous well defined plume on RH
SRM 59.262 E207 Camera
38:59.763 Flame from RH SRM in + Z direction
(seen from south side of vehicle) 59.753 E204 Camera
39:00.014 SRM pressure divergence (RH vs. LH) 60.004 B47P2302
39:00.248 First evidence of plume deflection,
intermittent 60.238 E207 Camera
39:00.258 First evidence of SRB plume attaching
to ET ring frame 60.248 E203 Camera
39:00.998 First evidence of plume deflection,
continuous 60.988 E207 Camera
39:01.734 Peak roll rate response to wind 61.724 V90R5301C

ACT POSActuator Position MEG Main Engine Controller NOTE: The Shuttle coordinate system used in Chapter
APU Auxiliary Power Unit MET -Mission Elapsed Time 3 is, relative to the Orbiter, as follows:
BET -Best Estimated Trajectory MPS Main Propulsion System + X direction = forward {tail to nose)
CH Channel PC Chamber Pressure - X direction = rearward (nose to tail)
DISC -Discharge PIC - Pyrotechnics Initiator Controller + Y direction = right (toward the right wing tip)
ET -External Tank psf -Pounds per square foot - Y direction = left (toward the left wing lip)
GG -Gas Generator RCS - Reaction Control System + Z direction = down
GPC. General Purpose Computer RGA - Rate Gyro Assembly - V. direction = up
GMT -Greenwich Mean Time RH -Righthand
HPFT -High Pressure Fuel Turbopump RSS - Range Safety System
LH -Lcfthand SRB -Solid Rocket Booster
LHj Liquid Hydrogen SRM -Solid Rocket Motor
LO., Liquid Oxygen (same as LOX) SSME Space Shuttle Main Engine
MAX Q Maximum Dynamic Pressure TEMP Temperature
ME -Main Engine (same as SSME) TVC -Thrust Vector Control

37
Mission Time Elapsed
(GMT, in hr:min:sec) Event Time (sees.) Sour

39:02.094 Peak TVC response to wind 62.084 B58H1150C


39:02.414 Peak yaw rate response to wind 62.404 V90R5341C
39:02.494 RH outboard elevon actuator hinge
moment spike 62.484 V58P0966C
39:03.934 RH outboard elevon actuator delta
pressure change 63.924 V58P0966C
39:03.974 Start of planned pitch rate maneuver 63.964 V90R5321C
39:04.670 Change in anomalous plume shape
(LHj tank leak near 2058 ring frame) 64.660 E204 Camera
39:04.715 Bright sustained glow on sides of ET 64.705 E204 Camera
39:04.947 Start SSME gimbal angle large pitch
variations 64.937 V58H1100A
39:05.174 Beginning of transient motion due to
changes in aero forces due to plume 65.164 V90R5321C
39:05.534 LH outboard elevon actuator delta
pressure change 65.524 V58P0866C
39:06.774 Start ET LH2 ullage pressure
deviations 66.764 T41P1700C
39:12.214 Start divergent yaw rates (RH vs. LH
SRB) 72.204 V90R2528C
39:12.294 Start divergent pitch rates (RH vs. LH
SRB) 72.284 V90R2525C
39:12.488 SRB major high-rate actuator command 72.478 V79H2111A
39:12.507 SSME roll gimbal rates 5 deg/sec 72.497 V58H1100A
39:12.535 Vehicle max + Y lateral acceleration
(+227 g) 72.525 V98A1581C
39:12.574 SRB major high-rate actuator motion 72.564 B58H1151C
39:12.574 Start of H2 tank pressure decrease with
2 flow control valves open 72.564 T41P1700C
39:12.634 Last state vector downlinked 72.624 Data reduction
39:12.974 Start of sharp MPS LOX inlet pressure
drop 72.964 V41P1330C
39:13.020 Last full computer frame of TDRS data 73.010 Data reduction
39:13.054 Start of sharp MPS LH2 inlet pressure
drop 73.044 V41P1100C
39:13.055 Vehicle max - Y lateral acceleration
(-.254 g) 73.045 V98A1581C
39:13.134 Circumferential white pattern on ET aft
dome (LH2 tank failure) 73.124 E204 Camera
39:13.134 RH SRM pressure 19 psi lower than
LH SRM 73.124 B47P2302C
39:13.147 First hint of vapor at intertank 73.137 E207 Camera
39:13.153 All engine systems start responding to
loss of fuel and LOX inlet pressure 73.143 SSME team
39:13.172 Sudden cloud along ET between
intertank and aft dome 73.162 E207 Camera
39:13.201 Flash between Orbiter and LH2 tank 73.191 E204 Camera
39:13.221 SSME telemetry data interference from
73.211 to 73.303 73.211

38
Mission Time Elapsed
(GMT, in hr:min:sec) Event Time (sees.) Source

39:13.223 Flash near SRB fwd attach and


brightening of flash between Orbiter
and ET 73.213 E204 Camera
39:13.292 First indication intense white flash at
SRB fwd attach point 73.282 E204 Camera
39:13.337 Greatly increased intensity of white flash 73.327 E204 Camera
39:13.387 Start RCS jet chamber pressure
fluctuations 73.377 V42P1552A
39:13.393 All engines approaching HPFT
discharge temp redline limits 73.383 E41Tn010D
39:13.492 ME-2 HPFT disch. temp Chan. A vote
for shutdown; 2 strikes on Chan. B 73.482 MFC data
39:13.492 ME-2 controller last time word update 73.482 MFC data
39:13.513 ME-3 in shutdown due to HPFT
discharge temperature redline
exceedance 73.503 MFC data
39:13.513 ME-3 controller last time word update 73.503 MFC data
39:13.533 ME-1 in shutdown due to HPFT
discharge temperature redline
exceedance 73.523 Calculation
39:13.553 ME-1 last telemetered data point 73.543 Calculation
39:13.628 Last validated Orbiter telemetry
measurement 73.618 V46P0120A
39:13.641 End of last reconstructed data frame
with valid synchronization and frame
count 73.631 Data reduction
39:14.140 Last radio frequency signal from Orbiter 74.130 Data reduction
39:14.597 Bright flash in vicinity of Orbiter nose 74.587 E204 Camera
39:16.447 RH SRB nose cap sep/chute deployment 76.437 E207 Camera
39:50.260 RH SRB RSS destruct 10.250 E202 Camera
39:50.262 LH SRB RSS destruct 10.252 F230 Camera

Shuttle to Ground Telemetry Channels Shuttle to Ground Telemetry Channels

Channel Sample Rate Sample Description Channel Sample Rate Sample Description
Identifier Period Identifier Period
(Samples/sec) (c) (Samples/sec) (see)
B47P1302C 12.5 .080 LH SRM CHAMBER PRESSURE V58H1100A 25 .040 ME-PITCH ACTUATOR POS
B47P2302C 12.5 .080 RH SRM CHAMBER PRESSURE V58P0866C 12.5 .080 LH OB ELEVON PRI DELTA P
V58P0966C 12.5 .080 RH OB ELEVON PRI DELTA P
B58H11500 25 .040 LH SRB TVC TILT ACT POS
B58H1151C 25 .040 LH SRB TVC ROCK ACT POS V79H2111A 25 .040 LH SRB TILT ACT DRIVER

E41M2076D 25 .040 ME-3 VEHICLE COMMAND V90R2525C 5 .200 SEL LH SRB PITCH RATE
E41T1010D 25 .040 ME-1 HPFT DISC TEMP-CH A V90R2528C 5 .200 SEL RH SRB YAW RATE
E41T2010D 25 .040 ME-2 HPFT DISC TEMP-CH A
E41T3010D 25 .040 ME-3 HPFT DISC TEMP-CH A V90R5301C 5 .200 SELECTED RGA ROLL RATE
V90R5321C 5 .200 SELECTED RGA PITCH RATE
T41P1700C 5 .200 ET LH, ULLAGE PRESSURE V90R5341C 5 .200 SELECTED RGA YAW RATE

V41P1100C 12.5 .080 MPS LH2 INLET PRESS (ME-1) V95H3522C 12.5 .080 BODY YAW ATTITUDE ERROR
V41P1330C 12.5 .080 MPS L02 INLET PRESS (ME-3) V95H3523C 12.5 .080 BODY ROLL ATTITUDE ERROR

V42P1552A 25 .040 RCS THRUSTER PC V98A1581C 25 .040 LATERAL ACCELERATION

V46P0I20A 100 .010 APU-1 GG CHAMBER PRESS

39
Chapter IV

The Cause of
the Accident

The consensus of the Commission and In arriving at this conclusion, the Commission
participating investigative agencies is reviewed in detail all available data, reports and
that the loss of the Space Shuttle records; directed and supervised numerous tests,
Challenger was caused by a failure in analyses, and experiments by NASA, civilian
the joint between the two lower segments of the contractors and various government agencies;
right Solid Rocket Motor. The specific failure was and then developed specific failure scenarios and
the destruction of the seals that are intended to the range of most probable causative factors. The
prevent hot gases from leaking through the joint sections that follow discuss the results of the
during the propellant burn of the rocket motor. investigation.
The evidence assembled by the Commission in-
dicates that no other element of the Space Shut-
tle system contributed to this failure.

Analysis of the Accident


The results of the accident investigation and Commission identified all possible faults that
analysis will be presented in this and the follow- could originate in the respective flight elements
ing sections. Throughout the investigation three of the Space Shuttle which might have the poten-
critical questions were central to the inquiry, tial to lead to loss of the Challenger. Potential con-
namely: tributors to the accident examined by the Com-
What were the circumstances surrounding mission were the launch pad (exonerated in
mission 51-L that contributed to the Chapter IX of this report), the External Tank,
catastrophic termination of that flight in the Space Shuttle Main Engines, the Orbiter and
contrast to 24 successful flights preceding it? related equipment, payload/Orbiter interfaces,
What evidence pointed to the right Solid the payload. Solid Rocket Boosters and Solid
Rocket Booster as the source of the accident Rocket Motors.
as opposed to other elements of the Space In a parallel effort, the question of sabotage was
Shuttle? examined in detail and reviewed by the Commis-
Finally, what was the mechanism of failure? sion in executive session. There is no evidence of
sabotage, either at the launch pad or during other proc-
Using mission data, subsequently completed esses prior to or during launch.
tests and analyses, and recovered wreckage, the

40
External Tank potentially contributing to the Challenger acci-
The External Tank contains propellants used dent. Those potential contributors were:
by the Orbiter's three main engines during Shut-
Premature detonation of the External Tank
tle launch and ascent to orbit. Structurally the range safety system
tank is attached to and serves as the backbone
Structural flaw
of the Orbiter and the two Solid Rocket Boosters. Damage at lift-off
Three primary structures the liquid oxygen Load exceedance
tank, the intertank and the liquid hydrogen
Overheating
tank comprise the configuration. (Figure 1)
The Commission examined the possibility that
The External Tank delivers oxidizer and fuel
the STS 51-L accident could have been triggered
from the propellant tanks to the Orbiter. The
by accidental detonation of the range safety
electrical subsystem includes instrumentation sen-
system explosives. This potential fault was as-
sors, heaters, range safety electronics and ex-
sessed using flight data, observed events, and
plosives, and lightning protection and associated
recovered hardware. Most of the explosive
cabling. All flight instrumentation and electrical
charges for the External Tank emergency destruc-
power are wired directly to the Orbiter. The ther-
tion system were recovered.2 Examination of this
mal protection subsystem is the insulation applied
material established that none of it had exploded
to the tank's exterior. Its function is to prevent
and thus could not have contributed to the acci-
heat leakage into the propellants, to protect the
dent (Photo C & D). Flight data verified that the
External Tank from overheating during flight and
External Tank range safety system was not
to minimize ice formation while the Shuttle is on
activated.
the pad.
The possibility of an imperfection existing in
Approximately 20 percent of the External Tank either the pressurized or nonpressurized Exter-
structure was recovered after the accident and the nal Tank structural elements that could grow to
majority of the pieces were from the intertank and a sufficient size to cause structural failure was ex-
liquid hydrogen tank.1 The Commission initial- amined in detail. All construction history, struc-
ly considered all External Tank systems and sub- tural qualification test data, proof test inspection
systems in identifying possible faults or failures records and x-rays were reviewed. One previously

Figure 1 Propellant Feed,


Pressurization
Lines

ET/Orbiter
Aft Attach "

Integral Stringers

ET/SRB Forward Attach

Liquid Liquid Oxygen Slosh


Oxygen Baffles
Vent
Valve and
Fairing-

Intertank
Intertank
Umbilical
Plate
Partial cutaway drawing of External Tank shows oxygen tank
at left, intertank to its right and hydrogen tank at right.

41
undetected imperfection that was discovered dur- The resultant flame would have ignited the Solid
ing a reexamination of the x-rays was found in Rocket Booster attach ring foam insulation almost
recovered hardware with no propagation in- immediately. Copious quantities of dense black
dicated.3 Other data from the pre-launch ice and smoke and open flames would be evident in such
frost team inspections, film and video coverage, a case and would have continued for as long as
pressurization records and flight data revealed no the leak burned. Smoke and flames in these quan-
evidence of leakage. The Commission conclud- tities were not observed at lift off nor anytime
ed that no structural imperfections existed that throughout the flight. It is therefore concluded
could have grown to a size to create a leak or that an initial liquid hydrogen tank leak was im-
cause catastrophic failure of the External Tank. probable, and that the only possible cause for
Possible damage to the liquid hydrogen tank overheating the tank was the impingement of
at lift off was considered. The ice and frost team leaking Solid Rocket Motor gases. This resulted
observed no vapor or frost that would indicate in the ultimate breakup of the External Tank.
a leak. The liquid hydrogen vent arm retracted The recovered external foam insulation on the
as expected during launch and did not recontact External Tank was scorched and discolored in
the tank or solid booster.4 Photo analysis and various locations.8 Burn patterns across the pieces
television monitoring did not indicate that any of insulation on the External Tank indicate that
debris contacted the tank. Therefore, damage to various areas were subjected to fire both before
the liquid hydrogen tank at lift off was determined and after the External Tank broke up in flight.
to be highly improbable. The Commission reviewed the External Tank's con-
The possibility that abnormally high structural struction records, acceptance testing, pre-launch andflight
loads caused an External Tank failure was ex- data, and recovered hardware andfound nothing relating
amined. Analysis indicated that there were no ex- to the External Tank that caused or contributed to the
cessive loading conditions based on lift off and cause of the accident.
flight data prior to the explosion. The maximum
structural load produced was less than 80 percent
of the allowable design load.5 The structural im-
plications of vent and flow control valve opera- Space Shuttle Main Engines
tion was examined and found not to be a factor. A cluster of three Space Shuttle Main Engines
The possibility of a structural failure due to operates simultaneously with the Solid Rocket
overheating was assessed with several causes Boosters during the initial ascent phase of flight
postulated: high heating due to abnormal trajec- and provides primary propulsion until the Shut-
tory, loss of the thermal protection system, a hot tle has attained orbital velocity. These engines
gas leak from the Solid Rocket Motor and a liq- use liquid hydrogen as the fuel and liquid oxygen
uid hydrogen leak from the External Tank. The as the oxidizer. Both the liquid hydrogen and oxy-
trajectory was normal until well after the Solid gen are stored in the External Tank and are
Rocket Motor leak was observed at 58 seconds. transferred to the engines under pressure. Dur-
Maximum aerodynamic heating would not have ing the mission the engines operate for about 8.5
occurred until approximately 90 seconds.6 At 73 minutes.
seconds, heating was well within tank component Engine thrust is controlled by throttling and
structural capability. Based on careful review of has ranged from 65 to 104 percent of a specified
pre-launch and flight films and data, the Com- thrust level. At sea level, 100 percent equals
mission found no evidence that any thermal pro- 375,000 pounds of thrust per engine.
tection foam was lost during the launch and Pitch, yaw and roll control of the Orbiter is
ascent. provided by gimbals on each engine. Gimbaling
The possibility of a leak from the hydrogen is operated by two hydraulic servoactuators, one
tank resulting in overheating was addressed. for pitch motion and the other for yaw motion,
Tests indicated that small leaks (0.037 lbs/second) with roll controlled by a combination of both pitch
would have been visible. In addition, if there was and yaw. These servoactuators are commanded
a liquid hydrogen leak at lift off, it would have by the Orbiter's computer.
been ignited by either the Solid Rocket Booster An electronic controller is attached to the for-
ignition or Space Shuttle Main Engine ignition.7 ward end of each engine. Each controller is a self-

42
Figure 2 Main Engines Figures
12 in. Feedlines
Position 1
2 S/N 2023

17 in. Feedlines
Orbiter Lower Surface

Liquid
Oxygen L02 ogen

External Tank

Schematic drawing depicts liquid oxygen and liquid Rear view drawing identifies the positions and numbers of
hydrogen tanks and the feedlines connecting them to the the engines mounted on the Orbiter Challenger for the flight
Space Shuttle Main Engines. of Mission 51-L.

contained system that monitors engine checkout, were attached to segments of the Orbiter thrust
control and status, and sends the data to the Or- structure.11
biter. Each of the three engine interface units in Sections of the main propulsion system fuel and
turn sends its data to the Orbiter computers and liquid oxygen feedlines and feedline manifolds
relays commands from the computers to the were recovered, as well as the External Tank/Or-
engines. biter disconnect assembly in the mated configura-
A propellant management subsystem of tion. A portion of the oxidizer inlet duct was at-
manifolds, distribution lines and valves controls tached to the interface of engine 2020. All
the flow of liquids from the External Tank to the preburner valves were recovered.12
engines, and the flow of gaseous hydrogen and
The main engine controllers for both engines
oxygen from the engines into the External Tank
2020 and 2021 were recovered. One controller
to maintain pressurization.
was broken open on one side, and both were
All three main engines from the Challenger,
severely corroded and damaged by marine life.
No. 2020 in position 2, No. 2021 in position 3,
Both units were disassembled and the memory
and No. 2023 in position 1, were recovered in
units flushed with deionized water. After they
large part on February 23, 1986, off the Florida
were dried and vacuum baked, data from these
coast in about 85 feet of water. All parts were
units were retrieved.13
recovered close to one another, and the engines
were still attached to the thrust structure.9 All All engines had burn damage caused by inter-
engine gimbal bearings had failed, apparently nal overtemperature typical of oxygen-rich shut-
because of overload on water impact. down. Thus, the loss of hydrogen fuel appears
All metallic surfaces were damaged by marine to have initiated the shutdown. The Commission
life, except titanium surfaces or those parts that reviewed engine and ground measurements made
were buried under the ocean bottom. The metal while the three engines were prepared for launch.
fractures, examined at 3x magnification, showed Ambient temperature during pre-launch was the
rough texture and shear lips, which appeared to coldest to date, but preflight engine data were
be caused by overloads due to water impact.10 normal.14 These data were also compared with
No pre-accident material defects were noted. Challenger engine data during the flight 61-A
The engine nozzles were sheared at the pre-flight period. All differences seen between the
manifolds. The main combustion chambers, two missions were due either to planned varia-
main injectors and preburners of each engine tions in the pre-launch sequence or the cold am-
were attached to one another. The six hydraulic bient conditions during the preflight period for
servoactuators used to control engine gimbaling flight 51-L. These differences did not affect engine

43
performance during the powered flight phase of Analysis of the engine start data showed all
the mission. three engine starts were normal and no anomalies
Preflight data gave no evidence of any pro- were found.
pellant leaks (fuel or oxidizer) in the aft compart- An assessment of the engine performance in
ment. For the powered flight phase all the the final seconds of the mission before the acci-
parameters of the engine aft compartment that dent was compared with similar periods on all
could give an indication of a leak were selected flights of the Challenger engines. The assessment
from the overall flight 51-L measurement list. showed the engine performance on flight 51-L
The majority of those parameters were either was consistent with previous flights.16
ground measurements or those recorded during The first abnormal engine indication was a
the flight but not telemetered to the ground.15 drop in engine fuel tank pressure at 72.564
Among parameters that were telemetered during seconds. As fuel pressure dropped, the control
the flight were skin temperature measurements system automatically responded by opening the
that gave no indication of a hot gas or other leak fuel flowrate valve. The turbine temperatures
in the engine compartment. then increased because of the leaner fuel mixture.

Figure 4

1Low-Pressure Fuel Turbopump


2High-Pressure Fuel Turbopump
3Main Fuel Valve
4Coolant Control Valve
5Nozzle Tube
6Main Combustion Chamber
7Fuel Preburner Valve
8Fuel Preburner
9Hot-Gas Manifold
10Main Injector
11 Low-Pressure Oxidizer Turbopump
12High-Pressure Oxidizer Turbopump
Drawing identifies principai elements in Space Shuttle Main 13Main Oxidizer Valve
Engines, three of which are mounted on the aft of each Or- 14Oxidizer Preburner Valve
biter. 15Oxidizer Preburner

44
The increased temperature caused an increase in and interface, and other government furnished
pump speed. This could not, however, increase essential equipment. Onboard government fur-
the fuel pressure because of a decrease in fuel tank nished equipment for STS 51-L included the
top (ullage) pressure resulting from the burned remote manipulator arm system, extravehicular
through hydrogen tank leakage. When the fuel mobility units, extravehicular activity hardware,
pump pressures dropped below 140 pounds per television, equipment worn by the crew, storage
square inch, the programed control system dis- provisions and communication equipment.
qualified the measured data because it was past The significant pieces of Orbiter structure
reasonable limits. This caused the fuel flowrate recovered included all three Space Shuttle Main
and high-pressure fuel pump discharge pressure Engines, the forward fuselage including the crew
to decrease, while the lack of load allowed the module, the right inboard and outboard elevons,
pump's speed to increase. The decreased fuel flow a large portion of the right wing, a lower portion
caused a drop in fuel preburner chamber of the vertical stabilizer, three rudder speed brake
pressure, though the fuel preburner oxygen valve panels and portions of mid-fuselage side walls
was then advancing toward a more open position. from both the left and right sides.19 This
The mixture ratio in the fuel preburner became represents about 30 percent of the Orbiter but
leaner, which raised high-pressure fuel turbine does not provide sufficient evidence to establish
discharge temperatures above the redline limits. conclusively the complete failure sequence of the
This caused the engine control system to start entire Orbiter spacecraft. However, there was
automatic shutdown of the engine. sufficient evidence to establish some of the struc-
The engine flight history showed that engine tural failure modes that resulted in the Orbiter's
2023 flew four previous times while engines 2020 destruction.
and 2021 had flown five previous missions.17 The All fractures and material failures examined on
flight data from flight 51-L compared well with the Orbiter, with the exception of the main
flight data from all previous flights. engines, were the result of overload forces, and
The analysis of flight data confirmed that the they exhibited no evidence of internal burn
Space Shuttle Main Engines operated properly damage or exposure to explosive forces. This in-
while reacting to changing external conditions. dicated that the destruction of the Orbiter oc-
Previous engine tests suggest that the high- curred predominantly from aerodynamic and in-
pressure pumps are the most likely components ertial forces that exceeded design limits. There
to fail, because of either bearing or turbine blade was evidence that during the breakup sequence,
failure. There was no evidence of either in flight the right Solid Rocket Booster struck the out-
51-L. Engine operation was normal until the fuel board end of the Orbiter's right wing and right
inlet pressure dropped. As the pressure decreased, outboard elevon. Additionally, chemical analysis
the engine responded in a predictable manner. indicated that the right side of the Orbiter was
Automatic shutdown of engine 2023 was verified sprayed by hot propellant gases exhausting from
by telemetry data. Data recovered from the the hole in the inboard circumference of the right
salvaged engine 2021 control computer verify that Solid Rocket Booster. Evaluation of the Orbiter
this engine also had begun shutdown. Salvaged main engines showed extensive internal thermal
control computer data from engine 2020 showed damage to the engines as a consequence of
that this engine was within 20 milliseconds of oxygen-rich shutdown that resulted from a deple-
shutdown when the computer stopped.18 Inspec- tion of the hydrogen fuel supply. The supply of
tion of recovered engine hardware verified that
hydrogen fuel to the main engines would have
all engines were shut down in a fuel-lean or
been abruptly discontinued when the liquid
oxygen-rich condition which resulted in burn
hydrogen tank in the External Tank disinte-
through and erosion of the engine hot gas circuits.
grated.
The Commission concluded that the Space Shuttle
The crew module wreckage was found
Main Engines did not cause or contribute to the cause
of the Challenger accident.
submerged in about 90 feet of ocean water con-
centrated in an area of about 20 feet by 80 feet.
Orbiter and Related Equipment Portions of the forward fuselage outer shell struc-
The Orbiter subsystems include propulsion ture were found among the pieces of crew module
and power, avionics, structures, thermal and en- recovered.20 There was no evidence of an inter-
vironmental control and life support, mechanical nal explosion, heat or fire damage on the forward
45
Figures
1 Orbital Maneuvering System 3 Main Propulsion
Two engines
Thrust levei 6,000 pounds each Three engines
Thrust level = 375,000 pounds each
Propeilants
Monomethyl hydrazine (fuel) and Propeilants
nitrogen tetroxide (oxidizer) Liquid hydrogen (fuel) and
liquid oxygen (oxidizer)
2 Reaction Control System
One forward module, two aft pods
38 primary thrusters (14 forward, 12 per aft pod)
Thrust level = 870 pounds each
Six vernier thrusters (two forward, four aft)
Thrust level = 25 pounds each
Propeilants
Monomethyl hydrazine (fuel) and
nitrogen tetroxide (oxidizer)

Space Shuttle Orbiter drawing identifies location of principal


maneuvering, reaction control and propulsion system
engines.

fuselage/crew module pieces. The crew module were no indications of abnormal behavior. All
was disintegrated, with the heaviest fragmenta- temperature and pressure transducers active dur-
tion and crash damage on the left side. The frac- ing ascent for the reaction control system were
tures examined were typical of overload breaks reviewed, including thruster chamber pressure,
and appeared to be the result of high forces leak temperature, line temperature, propellant
generated by impact with the surface of the water. tank, helium tank and propellant line trans-
The sections of lower forward fuselage outer shell ducers. Nothing was found that could have con-
found floating on the ocean surface were tributed to the accident.
recovered shortly after the accident. They also Auxiliary power unit pressures and
contained crush damage indicative of an impact temperatures were reviewed, and no abnormal
on the left side. The consistency of damage to the conditions were observed during ascent. Selected
left side of the outer fuselage shell and crew hydraulic measurements, including system
module indicates that these structures remained pressures, fluid quantities and most temperatures
attached to each other until impact with the in the aft compartment and in the wing cavity
water. containing the elevon actuator supply lines, were
The Orbiter investigation consisted of a review reviewed by the Commission, and no abnormali-
of all Orbiter data and vehicle parts retrieved. ty was found. All fuel cells and power reactant
Also reviewed were vehicle and equipment proc- storage and distribution subsystem measurements
essing records and pre-mission analyses. were reviewed and found to be normal during all
All orbital maneuvering system measurements phases of ground and flight operation prior to the
such as temperatures, pressures, events, com- accident. All available pyrotechnic firing control
mands, stimuli, and switch positions were re- circuit measurements were reviewed, along with
viewed with all related computer data. There radiography, shear bolt review and debris reports.

46
Figures

Vertical
Stabilizer-

Crew
Cabin

Sketch of Space Shuttle Orbiter in the landing configuration


viewed from -Y position identifies aerodynamic flight surfaces.

and there were no unintentional firing command ground and flight data (loads, temperatures,
indications.21 All available data regarding range pressures and purge flows), hardware changes
safety and recovery system batteries were re- and discrepancy reports since the last Challenger
viewed, and no indications were found that the flight, and wreckage. The Commission found that
batteries were involved in initiating the accident. no Orbiter structural elements contributed to the
Guidance, navigation and control subsystems accident.
data were reviewed, and it appears that the sub- Orbiter structural pre-launch temperature
systems performed properly. All subsystem sen- measurements were evaluated and found to be
sors and software apparently performed as design- within specified limits.
ed until data loss. Inertial measurement unit data Data related to the atmospheric revitalization
from the preflight calibration through signal loss system, which maintains cabin atmosphere, were
were found to be normal. All data processing evaluated.23 During pre-launch, launch and un-
system related data were reviewed, and nothing til signal loss, data indicated that both of the water
significant was found. Data review of the elec- coolant loops were normal, the pressure control
trical power distribution and control subsystem system functioned normally, all fans functioned
indicated that its performance was normal until normally, and all switches and valve positions
the time of the accident.22 All communication and were proper.
tracking system parameters active during launch Active thermal control subsystem data in-
were evaluated and found to be normal. No in- dicated that both of the freon coolant loops func-
strumentation abnormalities were observed dur- tioned normally, the ammonia boiler system was
ing the pre-launch and launch period before normal, and all switch and valve positions were
signal loss. proper. 24
Structures evaluation included analysis of The water management subsystem functioned

47
normally during the flight. The smoke detection biter environment control and life support
and fire suppression subsystem and airlock sup- system.
port subsystem both functioned normally. The Electrical power and avionics were provided
waste collection subsystem is inoperative during to the payload through standard interface panels
the launch phase, and no data were available.25 along both side of the cargo bay. In the aft flight
No mechanical system abnormalities were deck, the control and display panels supplied by
identified. The vent doors remained open the Orbiter provided the avionics and power in-
throughout the launch. The payload bay doors terfaces for TDRS/IUS. The experiments and
remained latched. All landing gear were up and projects constituting the middeck payload had no
locked, all doors remained closed and locked, and interfaces with avionics and power systems.
the remote manipulator system and payload The only direct payload loads data from STS
retention system remained latched. Film and Or- 51-L were accelerometer data recorded through
biter interface data showed that there was no the Orbiter umbilical prior to lift off. Ac-
premature Orbiter/ExternalTank separation. celerometer data from the payload bay and the
Video tapes and photographs indicated the crew cabin compared favorably with previous
crew egress hatch, which caused the launch delay flights. Results indicate that payload loads on
on the preceding day, operated properly. STS 51-L were similar to those of STS-6 and were
The onboard government furnished equipment within design levels and pre-launch predictions.
configuration and pre-launch processing were The Commission found that all payload
reviewed and determined to have been flight- elements had been certified safe for flight, and
ready with no unusual or abnormal conditions. records for integration of hardware met engineer-
Based on this review and assessment, the Commis- ing requirements. Temperatures during pre-
sion concluded that neither the Orbiter nor related equip- launch and ascent were normal. Reconstructed
ment caused or contributed to the cause of the accident. lift off loads were below those used in the flight
readiness certification. The relay satellite's rate
gyro data correlated with those for the Orbiter
Payload/Orbiter Interfaces and boosters during ascent. Fittings attaching the
Interfaces between the Orbiter and the payload
payloads to the Orbiter remained in operation,
serve to attach the cargo to the Orbiter or pro-
as shown by telemetered data from monitoring
vide services from the Orbiter to cargo items. microswitches.
These interfaces are mechanical, thermal,
The Commission found no discrepancies in the Or-
avionics, power and fluid systems.
biter/payload interface performance that might have con-
The Spartan-Halley payload was located in the
tributed to the Challenger accident.
front of the payload bay, attached to the equip-
ment support structure carrier. The Tracking and
Data Relay Satellite (TDRS) was attached to the
Inertial Upper Stage (IUS) booster rocket used
to move the TDRS into geosynchronous orbit. Payloads, Inertial Upper Stage, and
In the aft flight deck, payload interfaces consisted Support Equipment
of a standard switch panel, a payload deployment The payload bay of the Orbiter Challenger
and retention system, and display and control contained a Tracking and Data Relay Satellite
panels for use with the payload. Payloads in the (TDRS) attached to an Inertial Upper Stage
middeck area were in the stowage lockers. These (IUS) booster rocket, and associated airborne
were radiation monitoring, phase partitioning, support equipment. The IUS contained two solid
fluid dynamics experiments, three student ex- rocket motors (SRMs): SRM-1 and SRM-2.
periments, the Teacher in Space Project and the The combined weight of these components was
Comet Halley monitoring program. about 40,000 pounds. About five percent of the
Thermal interfaces between the Orbiter and payload, IUS, and support equipment package
the payload in the aft flight deck and middeck was recovered from the ocean. Components
consisted of the Orbiter's purge, vent and fluid recovered included segments of the cases of both
heat exchanger systems. Thermal interface for IUS SRMs, the ignition safe/arm device for each
TDRS/IUS, Spartan-Halley, and the ex- SRM, the igniter for SRM-2, fragments of un-
periments and projects were provided by the Or- burned propellant from each SRM, five explosive
48
Figure 7
STS 51- L Payload Standard Interface Tracking and Relay Inertial Upper
Configu ration Panel (SIP) Satellite (TDRS) Stage (IUS)
KU-Band 669.27
Antenna 726.80

Provisions
Stowage Remote \- IUS
Assembly (PSA) Spartan Halley Manipulator Damper
Mission-Peculiar
Closed Circuit System (RMS)
Equipment Support
Television (CCTV) Systems (MPESS)
Overhead drawing of the Orbiter shows position of payload
and other elements within the payload bay of the Challenger
51-L mission.

separation bolts that secure the two SRMs power sources and electrical cabling; and airborne
together, the forward support equipment trun- software.
nions, the aft trunnions with spreader beams, and Assessment of possible upper stage contribu-
an undetonated section of explosive fasteners. tion to the accident centered on the elimination
There was no evidence of scorching, burning, of three possible scenarios: Premature upper stage
or melting on any of the components and struc- rocket ignition, explosion/fire in the payload bay,
ture recovered, and all fractures were typical and payload shift in the payload bay.
overload fractures. The safe arm device for each Premature ignition of either the upper stage
IUS SRM was in the safe position, the five ex- stage 1 and/or stage 2 motor while still in the Or-
plosive SRM-l/SRM-2 separation bolts were in- biter bay would have resulted in catastrophic
tact, and pieces of propellant were not burned, failure of the Orbiter. Potential causes for
indicating that the SRMs had not ignited. The premature ignition were electrostatic discharge,
two aft trunnion spreader beams were intact but inadvertent ignition command and auto-ignition.
were bent in the downward direction relative to Each would have caused a rapid increase in the
the Orbiter. The right spreader beam was cracked Orbiter payload bay temperature and pressure,
and deformed about 7.5 inches, and the left and would have been immediately followed by
spreader beam was cracked and deformed about structural damage to the payload bay doors. The
1.5 inches.26 These deformations indicate that the payload bay temperatures remained essentially
payload and upper stage package was intact and constant, and the Orbiter photographic and
secure in the cargo bay while being subjected to telemetry data indicated the payload doors re-
significant inertial flight loads. mained closed and latched from lift off until signal
The inertial upper stage is a two-stage, solid- loss.27 Both indications verified that there was no
rocket-propelled, three-axis controlled, inertial- ignition of the IUS solid rocket motors.
ly navigated upper stage rocket used to deliver An IUS component explosion or fire could
spacecraft weighing up to approximately 5,000 have damaged critical systems in the Orbiter by
pounds from the Shuttle parking orbit to geosyn- overheating or impact. Five sources other than
chronous orbit. It includes the stage structure; an upper stage motor pre-ignition were identified
solid rocket motors; a reaction control sub- as potential origins of a fire or explosion in the
system; avionics for telemetry, tracking and com- payload bay: (1) release and ignition of IUS
mand; guidance, navigation and control; data hydrazine from the reaction control system tanks,
management; thrust vector control; electrical (2) fire or explosion from an IUS battery, (3) im-

49
pact or rupture of a motor case and subsequent through the IUS stage 1/stage 2 and support
ignition of exposed propellant, (4) fire of electrical equipment, were continuous until data loss, verify-
origin due to a short, and (5) fire or inadvertent ing that these elements did not separate.
ignition of pyrotechnic devices due to radio fre- The TDRS spacecraft weighs approximately
quency radiation. Thermal measurements in the 4,905 pounds and is 9.5 feet in diameter and 19.5
propellant tank and in components adjacent to feet long. The forward 11 feet contain six
the propellant tanks indicated no abnormalities. deployable appendages, two solar arrays, one
Pre-launch and thermal measurements in the Or- space-ground link antenna, and two single access
biter payload bay and in TDRS near the reac- antennas. The spacecraft body structure consists
tion control system were stable throughout the of a payload structure and a spacecraft structure.
ascent period. A fire and/or explosion resulting These structures house the tracking and telemetry
in shrapnel from an IUS battery was eliminated and command subsystem, power subsystem, ther-
based on pre-launch monitoring of open circuit mal control subsystem, ordnance subsystem,
voltages on all batteries, except the support equip- reaction control subsystem and attitude control
ment batteries. Location of these batteries made subsystem.
the potential for damage to critical systems very Telemetry data were transmitted from TDRS
small if they burned or exploded. Motor case im- from approximately 48 hours prior to launch
pact or rupture and resulting exposure and pro- through signal loss. The telemetry system was
pellant ignition was determined improbable be- functioning properly, and the data indicated that
cause batteries and reaction control system burn- the telemetry processor was in its normal opera-
ing or explosion were eliminated by flight data tional mode and all power supply voltages and
analysis. They were the only potential sources for calibration voltages were normal. There were no
IUS heating and high velocity shrapnel. Pro- changes through the countdown to the time of
pellant burning was not indicated by payload bay structural breakup, when all telemetry abruptly
thermal measurements. Electrical shorting was halted. The telemetry tracking and control sub-
eliminated as a fire source in the payload bay systems command and tracking elements were in-
because IUS electrical and Orbiter voltage active during the countdown through ascent, and
monitors were normal at launch and during STS no changes were noted, indicating that the TDRS
51-L ascent. Fires initiated by radio frequency was not commanded to alter its launch
radiation due to inadvertent IUS, TDRS, or configuration.
ground emittance were eliminated because data The TDRS power subsystem had a total of 138
showed worst case radio frequency radiation dur- telemetry indications. These were the main data
ing ascent was less than ground-emitted radia- source used to determine the power subsystem
tion to the payload bay during pre-launch check- activity. Analyzing this telemetry showed all sub-
out. The ground-emitted radiation was within system elements performed normally.
specified limits. The TDRS thermal control subsystem was
IUS/TDRS payload shifting or breaking free designed to maintain proper temperatures
within the Orbiter due to structural failure or primarily by passive means. Also, there is a ther-
premature separation was investigated. Such a mostatically controlled heater system to ensure
shift could have resulted in severe Orbiter damage minimum required temperatures are maintain-
from a direct impact, or could have induced a ed. The thermal subsystem was monitored by 82
significant shift in the Challenger vehicle center configuration status indicators and 137 analog
of gravity and possibly affected flight control.28 temperature channels. This telemetry showed
Four possible faults that could have led to Or- that the TDRS remained in its normal thermal
biter damage or substantial payload shift were configuration and experienced normal
considered: IUS stage 2/TDRS separation, IUS temperatures until signal loss.
stage 1/stage 2 separation, IUS/TDRS separa- No data indicated that the IUS separated from
tion from the airborne support equipment and TDRS, that any deployable appendage ordnance
lUS/airborne support equipment separation from had been fired or that any appendage motion had
Orbiter. All were eliminated because dynamic begun.
response data conclusively showed that The TDRS reaction control system was inac-
IUS/TDRS responded normally until the final tive at launch and required an IUS command and
loss of data. Further, TDRS data, which pass two ground commands to activate any propellant.
50
Telemetry indicated no valve actuation, changes findings that revealed unsafe conditions or that
in tank pressures or temperatures, or propellant any safety requirements had been violated or
line temperature violations. Further, there was compromised.
no telemetry that would suggest a hydrazine A review and assessment of Spartan Halley
leakage or abnormality and no indications that performance was conducted to establish any
the TDRS reaction control system contributed possible contributions to the STS 51-L accident.
to the accident. The Spartan Halley was unpowered except for
During the launch phase, the attitude control the release/engage mechanism latch monitor. Its
subsystem was disabled except for the gyros and electrical current was in the order of milliamps
associated electronics necessary to provide the and the telemetry records obtained from the Or-
telemetry. All telemetry parameters reflecting at- biter indicated that the latches were in the prop-
titude control subsystem configuration remain- er configuration and thus Spartan Halley re-
ed normal and unchanged during the STS 51-L mained firmly attached during flight. In addition,
pre-launch and post-launch periods. the TDRS spacecraft data indicated there was no
The TDRS was mounted in a cantilevered interaction from Spartan. Therefore, the Spar-
fashion to the IUS by an adapter ring that pro- tan Halley and its support structure remained in-
vided structural, communications and power in- tact. The payload bay temperature in the vicini-
terfaces. Structural integrity loss indications ty of Spartan was 55 degrees Fahrenheit in-
would have been observed by interruptions in dicating no abnormal thermal conditions.
telemetry or electrical power. TDRS telemetry As a result of detailed analyses of the STS 51-L
during the launch phase was transmitted by elec- Orbiter, the payload flight data, payload
trical cable to the IUS and interleaved with up- recovered hardware, flight film, available payload
per stage data. If separation had occurred at pre-launch data and applicable hardware process-
either the TDRS/IUS interface or the lUS/sup- ing documentation, the Commission concluded that
port equipment interface, TDRS data would have the payload did not cause or contribute to the cause of
stopped. There was no abnormal telemetry until the accident.
signal loss of all vehicle telemetry. TDRS also
received power from the Shuttle via the IUS
through the same interfaces. There were no in-
dications of TDRS batteries coming on line. This Solid Rocket Booster
indicates that structural integrity at the TDRS The Solid Rocket Booster comprises seven sub-
and IUS interfaces was maintained until the systems: structures, thrust vector control, range
structural breakup. Additionally, an inspection safety, separation, electrical and instrumentation,
of the recovered debris gives the following indica- recovery, and the Solid Rocket Motor.
tions that the TDRS/IUS remained intact until All recovered Solid Rocket Booster pieces were
the structural breakup. First, the separation bank visually examined, and selected areas were ex-
lanyards frayed at the end where they attached tracted for chemical and metallurgical analysis.
to the band, indicating that the spacecraft was The exterior surfaces of the Solid Rocket
pulled forcefully from the adapter. Second, the Boosters are normally protected from corrosion
V-groove ring structure at the top of the adapter by an epoxy resin compound. There were several
was torn from its riveted connection to the small areas where this protective coating was
adapter, indicating that a strong shear existed be- gouged or missing on the pieces recovered and,
tween the spacecraft and IUS which would only as a result, the exposed metallic surfaces in the
be generated if the two were still attached. Final- areas were corroded. The damage to the protec-
ly, the adapter base was torn where it attached tive coating was most likely the result of detona-
to the IUS, again indicating high tension and tion of the linear shaped charges and water im-
shear forces. There were no indications from pact. There was no obvious evidence of major ex-
telemetry or recovered debris that showed that ternal flame impingement or molten metal found
the structural integrity of the satellite or the on any of the pieces recovered. All fracture sur-
satellite/stage interface had been compromised. faces exhibited either the characteristic markings
The TDRS records at Kennedy were review- of rapid tensile overload, a complete bending
ed for technical correctness and to verify that no failure due to overload, or a separation fracture
open safety related issues existed. There were no due to the detonation of the linear shaped charges.
51
Other pieces of the right Solid Rocket Motor aft of O-ring seal tracks on the tang of the field joint.
field joint showed extensive burn damage, The tracks were cleaned with hexane to remove
centered at the 307 degree position. the grease preservative that had been applied after
Most of the Solid Rocket Motor case material recovery of the piece, and samples of the track
recovered contained pieces of residual unburned material were removed for analysis. Chemical
propellant still attached to the inner lining of the analysis of the track material showed that the
case structure.29 The severed propellant edges tracks were not composed of degraded O-ring seal
were sharp, with no unusual burn patterns. Pro- material.
pellant recovered with a forward segment of the The possible Solid Rocket Booster faults or
booster exhibited the star pattern associated with failures assessed were: structural overload. Solid
the receding shape of the propellant at the front Rocket Motor pressure integrity violation, and
end of the Solid Rocket Motor. There was no premature linear shaped charge detonation.
evidence found of propellant grain cracking or Reconstructed lift off and flight loads were
debonding on the pieces recovered. Casting flow compared with design loads to determine if a
lines could be distinguished on the propellant sur- structural failure may have caused the accident.
faces in several areas. This is a normal occurrence The STS 51-L loads were within the bounds of
due to minor differences in the propellant cast design and capability and were not a factor.
during the installation of the propellant in the Photographic and video imagery confirmed that
motor case structure. both Solid Rocket Boosters remained structural-
Hardness tests of each piece of the steel casing ly intact until the time of the explosion except for
material were taken before the propellant was the leak observed on right Solid Rocket Motor.
burned from the piece. All of the tests showed The possibility that the range safety system
normal hardness values. prematurely operated, detonating the linear
One of the pieces of casing showed evidence shaped charges was investigated. The linear

roraun scuuucm
MTM MNU IOUTKN
( It0 -Z AXIS 10

moi
MMM
cmm rmcmms
Mconir fOUl lOOSIII
lUCM HOIMKJWK POST!

Figure 8
Solid Rocket Booster drawing at top is exploded in lower
drawings to show motor segments and other elements at for-
ward and aft ends of booster.

52
Reconstructed STS 51-L Loads Compared to Measure and Design Loads Figure9

Recon- Design
Measured Net Load
structed Loads

Aft ET/SRB STS1 STS 2 STS 3 STS 5 STS 6 STS 7 STS 51-L
Struts (LBfXlO3) (LB(x10"3) (LBfXlO3) (LBfx10"3) (LBfXlO3) (LBfx10"3) (LBfXlO3) (LBfXlO3)

P8 -86 -93 - 78 - 55 -76 -76 -139 -306


P9 142 126 141 120 122 120 138 393
P10 -150 -128 -105 -94 -105 -116 -108 -306
P11 -93 -75 -71 -58 -85 -71 -141 -306
P12* 137 138 124 116 116 121 140 393
PI 3 -172 -108 -111 -111 -102 -106 -94 -306

'Strut Nearest Point of Failure Aft External Tank/Solid Rocket Booster Liftoff Strut Loads
LB, = Pounds Force
Table compares External Tank/Solid Rocket Booster strut
loads for first seven Shuttle flights with those for the mission
51-L launch and the strut design loads for the vehicle.

shaped charges were photographically observed tion. This process of elimination brought focus
to destroy both Solid Rocket Boosters at 110 to the right Solid Rocket Motor. As a result, four
seconds after launch when commanded to do so areas related to the functioning of that motor
by the Range Safety Officer and therefore could received detailed analysis to determine their part
not have discharged at 73 seconds after launch in the accident:
causing the accident. The possibilities of the Solid Structural Loads Evaluation
Rocket Boosters separating prematurely from the Failure of the Case Wall (Case Membrane)
External Tank, the nozzle exit cone premature- Propellant Anomalies
ly separating or early deployment of the recovery Loss of the Pressure Seal at the Case Joint
system were examined. Premature activation of
the separation system was eliminated as a cause Where appropriate, the investigation considered
of failure based on telemetry that showed no the potential for interaction between the areas.
separation commands. There were no indications
that the nozzle exit cone separated. The recovery
system was observed photographically to activate Structural Loads Evaluation
only after the Solid Rocket Boosters had exited Structural loads for all STS 51-L launch and
the explosion. flight phases were reconstructed using test-
In addition to the possible faults or failures, verified models to determine if any loading con-
STS 51-L Solid Rocket Booster hardware dition exceeded design limits.
manufacturing records were examined in detail Seconds prior to lift off, the Space Shuttle Main
to identify and evaluate any deviations from the Engines start while the Solid Rocket Boosters are
design, any handling abnormalities or incidents, still bolted to the launch pad. The resultant thrust
any material usage issues, and/or other indica- loads on the Solid Rocket Boosters prior to lift
tion of problems that might have importance in off were derived in two ways: (1) through strain
the investigation. Based on these observations, the gauges on the hold-down posts, and (2) from
Commission concluded that the left Solid Rocket Booster, photographic coverage of Solid Rocket Booster
and all components of the right Solid Rocket Booster, ex- and External Tank tip deflections. These show-
cept the right Solid Rocket Motor, did not contribute to ed that the hold-down post strain data were within
or cause the accident. design limits. The Solid Rocket Booster tip deflec-
tion ("twang") was about four inches less than seen
The Right Solid Rocket Motor on a previous flight, STS-6, which carried the
As the investigation progressed, elements same general payload weight and distribution as
assessed as being improbable contributors to the STS 51-L. The period of oscillation was normal.
accident were eliminated from further considera- These data indicate that the Space Shuttle Main
53
Shuttle Strut Identification

Forward External Tank/Orbiter attachment Aft External Tank/Orbiter attach ment

Forward External Tank/ Aft External Tank/


Solid Rocket Booster Solid Rocket Booster "Nearest to
area of attachment area of attachment Point of Failure

Figure 10
Drawing of transparent External Tank, with right Solid
Rocket Booster on far side, shows location of struts
measured in table of strut loads. (Figure 9)

Engine thrust buildup, the resulting forces and 13.9 x 106 pounds, while the aft joint showed
moments, vehicle and pad stiffness, and 13.8 x 106 pounds load.
clearances were as expected. The resultant total Loads were constructed for all in-flight events,
bending moment experienced by STS 51-L was including the roll maneuver and the region of
291 x 106 inch-pounds, which is within the maximum dynamic pressure. A representative
design allowable limit of 347 x 106 inch-pounds. measure of these loads is the product of dynamic
The STS 51-L lift offloads were compared to pressure (q) and the angle of attack (a). Since the
design loads and flight measured loads for STS-1 Shuttle is designed to climb out at a negative
through STS-7 (Figure 9). The Shuttle strut iden- angle of attack, the product is a negative number.
tification is shown in Figure 10. The loads The loads in the q x a pitch plane are shown
measured on the struts are good indicators of in Figure 11. Although the q x a variations in
stress since all loads between Shuttle elements are loads due to wind shear were larger than ex-
carried through the struts. The STS 51-L lift off pected, they were well within the design limit
loads were within the design limit. loads.
Because the Solid Rocket Motor field joints The Solid Rocket Motor field joint axial ten-
were the major concern, the reconstructed joint sion loads were substantially lower at maximum
loads were compared to design loads. Most of the dynamic pressure than at lift off: 11.6 x 106
joint load is due to the booster's internal pressure, pounds for the forward field joint and 10.6 x 106
but external loads and the effects of inertia pounds for the aft field joint. Compared to the
(dynamics) also contribute. The Solid Rocket internal pressure loads, the dynamic variations
Motor field joint axial tension loads at lift off were due to wind shear were small about '/u those
within the design load limit (17.2 x 106 pounds). of the pressure loads. These loads were well below
The highest load occurred at the forward field the design limit loads and were not considered the cause
joint, 15.2 x 106 pounds. The mid-joint load was of the accident.
54
1000-

Flight Envelope
STS-1 Thru 61-B

-1000-

LLI
Q STS51-L
-2000- Predicted
CO

-3000
STS51-L
Reconst.
(4/8/86)
- 4000
ET/SRB IVBC 2
Design Envelope -ET/SRB Cap. Assessment
-5000 -Limit Line

Q-Max
-6000,
0.6 0.8 1.0 1.2 1.4 1.6 2.0 2.2

Mach Number

37
+
54
+-
60 67 72 74 75
29 46
Time
Figure 11
The loads in the pitch plane are shown by the solid line 102/099 WING LIMIT" above, and "ET/SRB CAP, ASSESS-
marked "STS 51-L RECONST." The curve "STS 51-L MENT LIMIT LINE" below. (After STS-6, the wing was
PREDICTED" give the loads expected before the flight. The strengthenedThe previous design limits were "ET/SRB IVBC 2
dashed lines show the limit of experience from STS-1 through DESIGN ENVELOPE" below, and a curve in the positive
61-B. The present design limits are the two lines marked "OV region of q x a above)

Assumed Inhibitor Flaw Case Membrane Failure


The case membrane is the half-inch thick steel
wall of the rocket between the joints. The
possibility that the failure was initiated by
anomalies associated with the case membrane was
evaluated by analysis of design and test criteria.
Potential failure modes were constrained by the
following flight data and photographic observa-
tions:
(1) A burn through the membrane would have
to occur at or near the aft field joint.
(2) The failure could have little or no influence
on motor internal pressure since no devia-
tion in pressure occurred prior to 60
seconds.
(3) The failure must cause a burn through the
membrane in 58 seconds.
The hypothesis of a membrane failure requires
that the initial smoke observed at 0.678 seconds
Figure 12 was an independent occurrence. It is an unlikely
Sketch shows location of assumed inhibitor flaw used hypothesis for initiation of the accident. Fracture
eliminating such a problem as a possible cause.
mechanics analysis indicates that a hole in the

55
Cutaway view of the Solid Rocket Booster showing Solid Nozzle and Thrust Vector
Rocket Motor propellant and aft field joint Control System
Figure 13
y3.8m (12.4 ft)
4 Separation Motors Outside Diameter
22,050 lb thrust each

Solid Rocket Motor


Aft Field Joint Aft Skirt and
Launch Support

Booster-External Tank Attachment


Solid Propellant Ring, Aft Avionics and Sway Braces

Dimensions

Main Parachutes (3) Length . . 149.16 ft (45.46 m)


Diameter . 12.17ft (3.70 m)
4 Separation Motors
22,050 lb thrust each SRB-External Tank
Thrust Attachment
Drogue Chute
Rate Gyro Assemblies (3),
\ Forward Separation Avionics, Operational
Skirt Flight Instrumentation, Recovery
Frustum Avionics, and Range Safety System
Nose Fairing

case larger than one inch would cause the entire ture mechanics analysis indicates that a flaw 0.1
case to rupture in a few milliseconds. This would inch long and 0.050 inch deep would grow to only
give rise to the appearance of a large longitudinal 0.122 inches long and 0.061 inches deep in 80
flame, an event that is contrary to the flight films. uses of the segment. This flaw would be less than
Evaluation of potential insulation or inhibitor the critical size required to cause case rupture.
(see Figure 12) flaws against the three criteria Furthermore, as noted previously, a failure
above resulted in elimination of all candidates ex- resulting in a case rupture is not consistent with
cept a defect in the forward-facing inhibitor. This photographic observations.
potential failure mode was evaluated by assum- Subsequent to these evaluations, sections of the
ing a 1-inch-diameter hole in the inhibitor. right Solid Rocket Motor case containing holes
Analysis indicated that the change in motor in- burned through in the area of the aft field joint
ternal pressure resulting from this failure would were recovered. Assessments of the sections do not sup-
probably not be detected. However, an erosion port a failure that started in the membrane and progress-
rate substantially higher than the observed values ed slowly to the joint; or one that started in the mem-
would be required to burn through the membrane brane and grew rapidly the length of the Solid Rocket
by 58 seconds. In addition, the assumed flaw is Motor segment.
unlikely since the inhibitor is constructed by
vulcanizing eight individual plies of the material. Propellant
Subsequent damage of the magnitude required An examination of propellant characteristics
is improbable and would be easily detected. and flight data was accomplished to determine
A review of the segment inspection and of proof if any anomalous conditions were present in the
tests was conducted. Prior to vehicle assembly, STS 51-L right Solid Rocket Motor. Propellant
each segment was pressurized to 112 percent of cracking and propellant mean bulk temperatures
the maximum design operational pressure. A were evaluated.
magnetic particle inspection of each membrane Historically, the propellant family used in the
was then conducted. These procedures are Solid Rocket Motor (TP-H1148) has exhibited
designed to screen critical flaws, and are capable good mechanical properties and an absence of
of detecting cracks greater than 0.1 inches. Frac- grain structural problems. Should a crack occur.

56
however, the effects would be evident by changes between the tang and the inside leg of the clevis.
in chamber pressure. Shortly after lift off, the STS This gap between the tang and clevis at any loca-
51-L right Solid Rocket Motor chamber pressure tion after assembly is influenced by the size and
was 22 pounds per square inch higher than that shape (concentricity) of the segments as well as
of the left solid. This would correlate to a the loads on the segments. Zinc chromate putty
postulated radial crack through the grain span- is applied to the composition rubber (NBR) in-
ning a 90-degree, pie-shaped wedge of the solid. sulation face prior to assembly. In the assembled
However, with a crack of this nature, the configuration the putty was intended to act as a
chamber pressure would have remained high for thermal barrier to prevent direct contact of com-
approximately 60 seconds. Telemetry shows that bustion gas with the O-rings. It was also intended
the right Solid Rocket Motor chamber pressure that the O-rings be actuated and sealed by com-
did not remain high past 20-24 seconds and, bustion gas pressure displacing the putty in the
therefore, the existence of a propellant crack was space between the motor segments (Figure 14).
ruled out. The displacement of the putty would act like a
Propellant mean bulk temperature calculations piston and compress the air ahead of the primary
were made using the ambient temperature over O-ring, and force it into the gap between the tang
the two-week period prior to launch. The lowest and clevis. This process is known as pressure ac-
bulk temperature experienced was 57 degrees tuation of the O-ring seal. This pressure actuated
Fahrenheit on the day of the launch. This was sealing is required to occur very early during the
17 degrees Fahrenheit above the minimum Solid Rocket Motor ignition transient, because
specified. the gap between the tang and clevis increases as
Based on this assessment and subscale lot-
acceptance motor-firing evaluations, it is im-
probable that propellant anomalies contributed to the STS
Propellant
51-L accident.

Segment Tang
Joint Seal Failure
Enhanced photographic and computer-graphic nsulation
positioning determined that the flame from the Primary O-Ring
right Solid Rocket Booster near the aft field joint Leak Test Port
Secondary
emanated at about the 305-degree circumferen- Plug and Packin
O-Ring
tial position. The smoke at lift off appeared in Propellant
the same general location. Thus, early in the in- Grease Bead Relief Flap
vestigation the right Solid Rocket Booster aft field AFT Facing
Pin Inhibitor
joint seal became the prime failure suspect. This Retainer Clip
supposition was confirmed when the Salvage
Team recovered portions of both sides of the aft Zinc Chromate
joint containing large holes extending from 291 Pin Putty
degrees to 318 degrees. Several possible causes Retainer Band \ ^ Insulation
could have resulted in this failure. These possi-
ble causes are treated in the following paragraphs Clevis Pin
of this report.
During stacking operations at the launch site, Forward Facing
nhibitor
four segments are assembled to form the Solid
Rocket Motor. The resulting joints are referred Pin Retainer Insulation
Cork Insulatio
to as field joints, located as depicted in Figures
8. and 13. Joint sealing is provided by two rub- Segment Cl
ber O-rings with diameters of 0.280 inches Propellant
( + 0.005, -0.003), which are installed, as re- Figure 14
ceived from Morton Thiokol, during motor Solid Rocket Motor cross section shows positions of tang,
clevis and O-rings. Putty lines the joint on the side toward the
assembly. O-ring static compression during and propellant.
after assembly is dictated by the width of the gap

57
pressure loads are applied to the joint during
ignition. Should pressure actuation be delayed to SRB Joint Tang/Clevis Interference
the extent that the gap has opened considerably,
the possibility exists that the rocket's combustion Premate Measurements of the Tang and Clevis
gases will blow by the O-ring and damage or (Not to Scale)
destroy the seals. The principal factor influenc-
ing the size of the gap opening is motor pressure;
but, gap opening is also influenced by external
loads and other joint dynamics. The investiga-
tion has shown that the joint sealing performance
is sensitive to the following factors, either in-
dependently or in combination:
u DT

Represents a "Positive"
Difference (DT-De)
u
(a) Damage to the joints/seals or generation
of contaminants as joints are assembled as
influenced by:
(1) Manufacturing tolerances.
150
(2) Out of round due to handling.
(3) Effects of reuse.
(b) Tang/clevis gap opening due to motor
pressure and other loads.
(c) Static O-ring compression.
(d) Joint temperature as it affects O-ring
response under dynamic conditions
(resiliency) and hardness.
(e) Joint temperature as it relates to forming
ice from water intrusion in the joint.
(f) Putty performance effects on:
(1) O-ring pressure actuation timing.
(2) O-ring erosion.

The sensitivity of the O-ring sealing perform-


ance to these factors has been investigated in ex-
tensive tests and analyses. The sensitivity to each Represents A "Negative" i
factor was evaluated independently and in ap- Difference (DT-De)
propriate combinations to assess the potential to n r\
cause or contribute to the 51-L aft field joint
failure. Most of the testing was done on either
laboratory or subscale equipment. In many cases,
the data from these tests are considered to be
directly applicable to the seal performance in full Measurements Made on Both Segments
(Tang & Clevis) at Six Locations
scale. However, in some cases there is con-
siderable uncertainty in extrapolating the data to DT = Outside Diameter of Tang
full-scale seal performance. Where such is the
De = Inside Diameter of
case, it is noted in the following discussions. Clevis Outer Leg

Assembly Damage/Contamination
It is possible that the assembly operation could
influence joint sealing performance by damaging
the O-rings or by generating contamination. The
Figure 15
shapes of the solid rocket segments which include Sketch shows how diameters of tang and clevis are measured
the tang and clevis, are not perfect circles because to assure proper fit of two Solid Rocket Motor segments.
of dimensional tolerances, stresses, distortions

58
from previous use, and the effects of shipping and Testing was conducted during the investiga-
handling. The most important effect is from the tion to evaluate the potential for assembly damage
load of propellant, a plastic and rubbery material, and contaminant generation, and its effect on seal
which can take a set that relaxes very slowly. For performance. A sub-scale section of a field joint
example, since the segments are shipped in a was configured in a test fixture and simulated
horizontal position on railroad cars, their weight assembly operations were conducted. This sec-
can make them somewhat elliptical a shape they tion was much stiffer than the full-scale booster
can maintain for some time. At assembly, after segments and did not fully simulate actual
the lower segment (with the clevis on top) is assembly conditions. However, under these test
placed vertically, the tang of the next segment is circumstances, metal slivers were generated dur-
lowered into it. To make the fit easier, the up- ing situations wherein the tang flat overlapped
per segment is purposely reshaped by connecting the flat end of the clevis leg by 0.005 to 0.010
the lifting crane in an appropriate position and, inches. The metal slivers in turn were carried into
on occasion (51-L was one of these), directly the joint and deposited on and around the O-
squeezing the tang section with a special tool. To rings. A second finding from this test series was
monitor the fit, the diameters of the clevis, Dc, that the O-ring section increased in length as the
and the tang, DT (Figure 15) are measured at tang entered the clevis and compressed the O-
six positions 30 degrees apart, and difference of ring diameter. The implication of this finding is
these measurements (DT - Dc) are noted. that canted tang entry in a full diameter segment,
When these differences are such that the tang en- while unlikely, could chase the O-ring around the
croaches somewhat into the outer clevis, slanted circumference, resulting in gathering (bulging
edges (chamfers) permit the pieces to slide from the groove) on the opposite side. This could
together. If the difference is too great, flat areas make the O-ring more vulnerable to damage.
of the tang meet flat areas of the clevis. What real- There is no known experience of such bulging
ly counts, of course, are differences of radii, which during previous assemblies.
diameter measurements alone do not determine, To understand the effects of potential con-
for one does not know during the assembly how taminants on sealing performance, tests were con-
far off the centers are. This is a circumstance to ducted employing metal contaminants simulating
be avoided, but one that can be detected during those generated in the segment assembly tests.
assembly. Experience has shown that a diameter The tests were to determine if joints with metal
difference of less than + 0.25 inches usually per- shavings positioned between the O-ring and seal-
mits assembly without a flat-on-flat condition aris- ing surface could pass a static leak check but fail
ing. A negative diameter difference means the under dynamic conditions. The contaminants
tang encroaches on the inside of the clevis. The that passed the 50 pounds per square inch leak
possibility was noted that contaminants from check were between 0.001 and 0.003 inches thick.
sliding metal and direct O-ring pinching might Testing to determine seal performance under
occur if this overlap is large. If it is too great, a dynamic conditions with these representative con-
flat-on-flat condition can arise inside the joint taminations is not complete. However, the
where it is very difficult to see. These dimensions possibility cannot be dismissed that contamina-
shift as the pieces slide together and they change tion generated under some assembly conditions
further as the propellant stresses relax during the could pass a leak check and yet cause the seal to
period between assembly and launch. Therefore, leak under dynamic conditions.
a condition such as that which occurred during A second concern was structural damage to the
assembly of the aft segment for flight 51-L, clevis due to abnormal loading during assembly.
wherein the maximum interference between tang An analysis was made to determine the deflec-
and clevis at the O-rings was at approximately tions and stresses experienced during assembly
300 degrees, may or may not have persisted un- of the right Solid Rocket Motor aft center seg-
til launch seven weeks after assembly. ment to the aft segment. These stresses were then
The O-rings are heavily greased to prevent used in a fracture mechanics analysis of the O-
damage. This grease adds another element of ring groove to detemine the maximum flaw size
uncertainty to the configuration and action of the that would not fail under the 51-L case segment
seal under pressurization, especially at low life cycle history. Included in this analysis was
temperatures. the single point load needed to deflect a suspended
59
Summary of Dynamic Test Results

Figure 19
Table plots results of tests of .004 and .020 inch initial gap
openings over the range of temperatures in left hand vertical
column.

the O-rings at a specific initial gap and squeeze joint in Figures 20 and 21. These data are
condition uniformly around the circumference. representative of other joints on the respective
It is not certain what the effect of differences in Solid Rocket Motors.
circumferential gaps might be in full size joints. The investigation has shown that the low
Such effects could not be simulated in the sub- launch temperatures had two effects that could
scale test results reported above. potentially affect the seal performance: (1) O-ring
resiliency degradation, the effects of which are
Joint Temperature explained above; and (2) the potential for ice in
Analyses were conducted to establish STS 51-L the joints. O-ring hardness is also a function of
joint temperatures at launch. Some differences temperature and may have been another factor
existed among the six 51-L field joints. The joints in joint performance.
on the right Solid Rocket Motor had larger cir- Consistent results from numerous O-ring tests
cumferential gradients than those on the left have shown a resiliency degradation with reduced
motor at launch. It is possible that the aft field temperatures. Figure 23 provides O-ring recovery
joint of the right Solid Rocket Booster was at the from 0.040 inches of initial compression versus
lowest temperature at launch, although all joints time. This shows how quickly an O-ring will
had calculated local temperatures as low as 28 5 move back towards its uncompressed shape at
degrees Fahrenheit. Estimated transient temperatures ranging from 10 to 75 degrees
temperature for several circumferential locations Fahrenheit. When these data are compared with
on the joints are shown for the right Solid Rocket the gap openings versus time from Figure 17, it
Motor aft field joint and the left motor aft field can be seen that the O-rings will not track or
62
Aft Right Segment Temperatures for STS 51-L

Q
6.
E

Figure 20
Temperature model for 51-L right solid booster aft segment
circumferential positions from 16.5 hours prior to launch to 3.5
hours after launch.

Aft Left Segment Temperatures for STS 51-L


1105
1104
1103 1108 v
1102 1107 } Thermal Model Nodes
1101 1106 >

Figure 21
Temperature model for 51-L left solid booster aft segment cir-
cumferential positions from 16,5 hours prior to launch until 3.5
hours after launch.

63
Field Joint Distress

SRB
(right Previous
or A ngular Joint Use of Type of
Flight Joint left) location Temp (F) Segments (2) Distress
STS-2 AFT RH 090 70 none/none Erosion
41-B FWD LH 351 57 1/none Erosion
41-C AFT LH N/A 63 1/1 O-ring heat
41-D FWD RH 275/110 70 2/none Erosion
51-C FWD LH 163 53 1/none Erosion
51-C (3) MID RH 354 53 1/1 Erosion
61-A MID LH 36-66 75 none/none Blow-by
61-A AFT LH 338/018 75 none/none Blow-by
61-C AFT LH 154 58 1/none Erosion
51-L AFT RH 307 28 1/2 Flame
(1) Mean calculated ( 50F)
(2) Refurbished after recovery
(3) Both primary and secondary O-rings affected

Examination of the records shows that if one defines any sort


of damage around the O-ring as "distress", then there have
been 10 "distressed" field joints, including the aft field joint on
the right-hand booster of 51-L. These data, which are
tabulated above, show 10 instances of distress in a total of 150
flight exposures. One-half of the instances occurred in the aft
joint, one-third in the forward joint, and one-fifth in the mid-
joint. Sixty percent of the distress occurred in the left Solid
Rocket Motor.

recover to the gap opening by 600 milliseconds Putty Performance


(gap full open) at low to moderate temperatures. The significance of the possibility that putty
These data show the importance of timely O-ring could keep the motor pressure from promptly
pressure actuation to achieve proper sealing. reaching the O-rings to pressure actuate and seal
It is possible that water got into some, if not them was apparently not fully appreciated prior
all STS 51-L field joints. Subsequent to the to the Challenger accident. During the investiga-
Challenger accident, it was learned that water had tion, it became evident that several variables may
been observed in the STS-9 joints during restack- affect the putty performance and, in turn, seal
ing operations following exposure to less rain than performance. However, limited test data and lack
that experienced by STS 51-L. It was reported of fidelity in full scale joint simulation prevented
that water had drained from the STS-9 joint when a complete engineering assessment of putty per-
the pins were removed and that approximately formance. Tests were conducted over a range of
0.5 inch of water was present in the clevis well. putty conditions, including temperature at igni-
While on the pad for 38 days, STS 51-L was ex- tion, pretest conditioning to simulate the en-
posed to approximately seven inches of rain. vironmental effects, and dimensional variations
Analyses and tests conducted show that water will within the joint. These test results demonstrated
freeze under the environmental conditions ex- that putty performance as a pressure seal is highly
perienced prior to the 51-L launch and could variable. The results may be interpreted to in-
unseat the secondary O-ring. To determine the dicate that the putty can maintain pressure dur-
effects of unseating, tests were conducted on the ing the ignition transient and prevent O-ring seal-
sub-scale dynamic test fixture at Thiokol to fur- ing. For example, one test conducted with put-
ther evaluate seal performance. For these tests, ty, which had been conditioned for 10 hours at
water was frozen downstream of the secondary 80 percent relative humidity and 75 degrees
O-ring. With ice present, there were conditions Fahrenheit, delayed the pressure rise at the
under which the O-ring failed to seal. primary O-ring for 530 milliseconds at a

64
O-Ring Recovery vs. Time

0.060

0.050-

0.040-

i
o
CD
0.030 - Temperature
75 F

6
0.020-

0.010-

0.000

Time (Sec)

Figure 23 Note: Average O-Ring Recovery at Various Test Tempera-


Graph plots O-ring shape recovery in inches against time in tures During First Second After Load Release. Initial
seconds for a variety of temperatures. Compression of 40 Mils Was Maintained for 2 Hours.

temperature of 75 degrees. Tests at 20 degrees i.e., a 0.004-inch gap, at 50 degrees Fahrenheit


Fahrenheit with similarly conditioned putty with a pressure delay of 500 milliseconds. For the
delayed the pressurization time by 1.9 seconds. temperature and O-ring squeeze conditions that
Such delays would allow full joint gap opening existed for several of the STS 51-L field joints,
before a seal could pressure actuate. O-ring sealing was not achieved in these tests with
To evaluate this effect, a sub-scale test fixture simulated putty rupture times delayed to 250 to
was fabricated that effectively simulated gap 500 milliseconds.
opening at the time of putty rupture and pressure
application. The tests simulate the O-ring Note that the sub-scale tests do not faithfully
reproduce what happens in the real joint. These
pressure actuation delay due to the putty tem-
data do indicate, however, that the potential ex-
porarily holding the motor pressure. They were
ists for O-rings not to seal as a result of variables
conducted over a range of temperatures, putty
rupture time and initial O-ring squeeze. Test related to the putty.
results (Appendix L, Fig. 6.5.1) demonstrated The seal is checked by pressurizing the volume
that sealing performance is dependent on between the primary and secondary O-rings. This
temperature and initial squeeze, both of which action seats the secondary seal and drives the
affect the pressure actuation capability of the O- primary seal upstream into its groove. Because
rings. The tests indicate that sealing capability of concern that the putty could mask a leaking
is marginal for maximum squeeze conditions, primary seal, the pressure was first increased from

65
50 psi to 100 psi and then to 200 psi. The conse- place in the right side. The dynamic effects cause
quence of increasing the pressure is shown below. an increase in the joint rotation, and, hence, in-
crease the gap between the tang and clevis by
Stabilization N umber Of Percentage of about 10 percent. Another dynamic load results
Pressure, psi Flights Flights With from the geometry of the struts which attach the
O-ring booster to the external tank. Strut PI2 is at-
Anomalies
tached to the booster at about the 314 degree
Field Joint 50 7 14 point and imposes additional inertial forces on
100 2 0
200 15 56
the booster which tend to additionally increase
Nozzle Joint 50 8 12 the gap by 10 to 21 percent.
100 8 56
200 8 88
Analysis of the Wreckage
Clearly the increased pressure used in the leak The investigation of the sequence of events that
check increased the likelihood of a gas path led to the final breakup of the Challenger rests
through the putty to the primary seal. That is, upon three primary sources of data: launch
with increased pressure, blow holes in the putty photographs, telemetry and tracking data, and
are more likely with a resulting greater potential the recovered pieces of the Shuttle wreckage. The
for erosion damage to the O-ring. On the positive third source of data is presented here, which is
side the blow holes tend to prevent the delay in largely descriptive. It provides support for the
pressurization discussed in the previous conclusions reached through use of the data from
paragraphs. This further illustrates the influence the other two sources. A more detailed analysis
of putty variables on the performance of the Solid that provides technical details to be used for
Rocket Motor seals. subsequent redesign or accident analysis is
available in the appendix.
The Dynamic Characteristics of Figure 24 shows an overview of the search areas
the Field Joint Seal with the general location of parts of both the left
The discussion of static factors which affect and the right Solid Rocket Boosters indicated.
joint performance is based on the assumption that The area is at the edge of the Gulf Stream in
motor segments remain perfectly round, and that water depth that ranged from 100 to 1,200 feet.
stacked segments are always a perfectly straight Pertinent pieces were examined by use of a
column. At launch the boosters are subjected to remotely controlled submarine containing a flood
forces which bend and twist them. These forces light and a television camera. The television pic-
cause physical changes in the shape of the ture was available on ship board and was
boosters, actually squashing them out-of-round transmitted to Kennedy and to Marshall. The ar-
and bending them along their entire length. The rangement allowed a number of people who were
dynamic effects of this out-of-roundness are most familiar with the Solid Rocket Booster to com-
significant just after booster ignition when the ment upon the merit of recovering a particular
hold-down bolts have been released because in piece.
the previous 6.6 seconds the boosters have actual- The aft left side of the Orbiter contained its
ly been bent forward by the thrust from the main original paint markings and showed no apparent
engines. The elastic energy stored in the entire sign of heat damage (photo A. All photo
system is then released, inducing a bending vibra- references are to color section, pp. 74-81). Ther-
tion in the boosters. This bending causes the case mal distress, however, was apparent on the right
to change its shape from circular to elliptical, the rudder speed brake panel and elevon (photo B).
maximum out-of-roundness occurring on the The paint was scorched and blackened on the
045-315 degree line on the outside of the right right side panels of the aft part of the fuselage and
booster. This deflection is a consequence of a vertical fin. The remaining recovered parts of the
vibration and occurs at a frequency of about 3 Orbiter did not seem to be affected by a hydrogen
cycles per second. The same occurs in the left fire. The bottom side of the right wing showed
booster, only the deflection axis is oriented dif- some indentation on the tiles that make up the
ferently, being a mirror image of that which takes Thermal Protection System. This indentation was

66
Expanded Search Area
Figure 24

Right SRB
f
2o\
Launch Pad 39B

Inner Edge
of Gulf Stream Axis of
1-1.5 KTS Gulf Stream
4-5 KTS

1200 1800
Map shows ocean areas searched for Shuttle wreckage in
relation to Cape Canaveral and Launch Pad 39B. Wavy ver-
tical lines indicate water depths.

consistent with impact with the right booster as thrust. Similarly, the right side of the intertank
it rotated following loss of restraint of one or more showed signs of crushing. This crushing is con-
of its lower struts. sistent with the rotational impact of the frustum
The frustum of the nose cone of the right Solid of the right Solid Rocket Booster with the Exter-
Rocket Booster was damaged (photo E) as if it nal Tank following complete loss of restraint at
had struck the External Tank, but there were no the aft lower strut attachment area.
signs of thermal distress. The frustum of the nose The telemetered signals from the rate gyros in
cone of the left Solid Rocket Booster (photo F) the right Solid Rocket Booster clearly show a
was essentially undamaged. change in angular velocity of the booster with
A substantial part of the External Tank was respect to the Orbiter. It is believed that this
recovered. Analysis of this recovered structure velocity change was initiated by a failure at or
showed some interesting features. Interpretation near the PI2 strut connecting the booster to the
of the photographs suggests that the flame from External Tank. Photographs of the flight could
the right hand Solid Rocket Booster encircled the not define the failure point and none of the con-
External Tank. A short time later the dome at necting struts to the right Solid Rocket Booster
the base of the External Tank was thought to or the corresponding area on the External Tank
break free. Since the internal pressure of the liq- in this region were recovered. Therefore the ex-
uid hydrogen tank is at approximately 33 pounds act location of initial separation could not be
per square inch, a sudden venting at the aft sec- determined by the evidence. At the time of
tion will produce a large initial thrust that tails relative booster movement, the hole in the shell
off as the pressure drops. The intertank region of the right Solid Rocket Booster was calculated
of the wreckage contained buckling in the fore to be six to eight inches in diameter located 12
and aft direction consistent with this impulsive to 15 inches forward and adjacent to the PI2

67
RH SRB Recovered Debris
Aft Segment

AFT CTR/AFT Joint


STA. 1491.5 rrmr-
STA. 1504.9
".^ET Attach Stubs
STA. 1517.3
>
/

STA. 1577.5 i''i;iiJj?WM.i.M. _XFWDStiff/ET


Attach Joint

STA. 1613.6 FWD Stiff. Stub

STA. 1657.6 FWD Stiff. Ring

STA. 1697.5 Stiff./Stiff. Joint

STA. 1733.4 Mid Stiff. Ring

STA. 1774.4 AFT Stiff. Ring

Aft Dome/Aft
STA. 1817.6 Stiff. Joint
Stub Skirt
270 315
Inside View

Figure 25
Drawing depicts pieces of right Solid Rocket Booster aft seg-
ment recovered. At top is piece of aft center segment.

strut. This location was within the center of the parts 131, the upper segment tang region, and
burned out zone on the right Solid Rocket Booster part 712, the lower clevis region of the joint. This
(photo G). As a matter of interest, the PI 2 strut burned area extends roughly from station 1476,
is located close to the point on the circumference in the upper section, to 1517 on the lower region.
where the booster case experiences maximum In a circumferential direction (see figure 26) the
radial deflection due to flight loads. It seems likely lower end of the eroded region extends from
that the plume from the hole in the booster would roughly 291 degrees to 320 degrees and the up-
impact near the location of the P12 strut connec- per eroded section extends between 296 and 318
tion and the External Tank. Using geometric con- degrees. Note that the region at about 314 degrees
siderations alone suggests this strut separated includes the attachment region of the strut to the
from the External Tank before it separated from attachment ring on the right Solid Rocket
the right hand Solid Rocket Booster. Booster.
Figure 25 shows a sketch of an interior unroll- Some observations were made from a detailed
ed view of the aft part of the right hand Solid examination of the aft center section of the joint,
Rocket Booster with the recovered burned pieces contact 131. This piece (photo I) shows a large
131 and 712 noted. The critical region is between hole that is approximately centered on the

68
Angular Coordinate System
tang O-ring sealing surface next to either side of
For Solid Rocket Boosters/Motors the hole showed distinct erosion grooves starting
Figure 26 from the O-ring locations (photo J). These ero-
sion grooves indicate the O-rings were sealing the
joint away from the central area during the later
stages of the trajectory. No other evidence of ther-
mal distress, melting or burning was noted in the
tang section of the joint.
The part of the aft section of the right Solid
Rocket Booster in the circumferential position of
the hole was recovered (photos L and N). This
piece, contact 712, showed evidence of a burned
hole edge extending from 291 degrees to 318
degrees, approximately 33 inches long (see
bracket, photo L). The burned surface extended
into the aft attach stub region of the case adja-
cent to the P 12 strut attach point. The box struc-
090 ture of the aft attachment ring was missing from
the attach stubs. The piece displayed fractures
which led circumferentially or aft from the hole
180 360/0 and the burned surface. Booster pieces on either
side have not been recovered. Thus in the burn
area no portion of the clevis or attachment ring
LEFT EXTERNAL RIGHT other than the stubs was available for
SRB TANK SRB examination.
The exterior surface of the aft case piece also
(1) View Is Forward (Direction of Flight) contained a large heat affected area (photo M).
or "Up" When Vehicle Is On Launch Pad
The shape and location of this area indicates a
(2) Angles Increase Counterclockwise plume impingement from the escaping gases. The
light colored material at the downstream edge of
the area is probably asbestos from the insulator.
The rust colored line more or less parallel to the
stubs may be a stagnation line produced in the
gas flow when the gases passed around the attach-
ment ring. Secondary flow of metal from the aft
attach stub ring also shows this feature. There
was a small burn hole in the case wall (arrow,
photo O) which appeared to have penetrated the
case from the exterior toward the interior. This
may also have been due to a swirling flow of hot
307-degree circumferential position. Although ir- gases within the attachment ring box structure.
regular, the hole is roughly rectangular in shape, The shadow of the insulation downstream of the
extending approximately 27 inches circumferen- attach box can also be seen. This evidence sug-
tially along the tang (296 to 318 degrees) with gests strongly that a hot gas plume impinged
total burnout extension approximately 15 inches against the attachment ring, passed around and
forward of the tang. At either side in the interior through it, and ultimately destroyed its structural
of the hole (photo K) the insulation and steel case integrity, probably late in the flight of the Solid
material showed evidence of hot gas erosion that Rocket Booster.
beveled these surfaces (indicative of combustion The photographs L, M, N, and O view the
products flowing through the hole from the in- lower case piece in the inverted position. A cor-
terior of the Solid Rocket Motor). The top sur- rect orientation of this piece is shown in a com-
face of the hole was hardly beveled at all. The posite view of the burn area located in photo P.

69
Findings was such that the smallest tang-to-clevis
clearance occurred at the initiation of
1. A combustion gas leak through the right the assembly operation at positions of
Solid Rocket Motor aft field joint initiated 120 degrees and 300 degrees around the
at or shortly after ignition eventually weaken- circumference of the aft field joint. It
ed and/or penetrated the External Tank ini- is uncertain if this tight condition and
tiating vehicle structural breakup and loss of the resultant greater compression of the
the Space Shuttle Challenger during STS O-rings at these points persisted to the
Mission 51-L. time of launch.
2. The evidence shows that no other STS 51-L 6. The ambient temperature at time of launch
Shuttle element or the payload contributed was 36 degrees Fahrenheit, or 15 degrees
to the causes of the right Solid Rocket Motor lower than the next coldest previous launch.
aft field joint combustion gas leak. Sabotage a. The temperature at the 300 degree
was not a factor. position on the right aft field joint cir-
3. Evidence examined in the review of Space cumference was estimated to be 28
Shuttle material, manufacturing, assembly, degrees 5 degrees Fahrenheit. This
quality control, and processing of non- was the coldest point on the joint.
conformance reports found no flight hard- b. Temperature on the opposite side of the
ware shipped to the launch site that fell out- right Solid Rocket Booster facing the
side the limits of Shuttle design specifications. sun was estimated to be about 50
4. Launch site activities, including assembly degrees Fahrenheit.
and preparation, from receipt of the flight 7. Other joints on the left and right Solid
hardware to launch were generally in accord Rocket Boosters experienced similar com-
with established procedures and were not binations of tang-to-clevis gap clearance and
considered a factor in the accident. temperature. It is not known whether these
5. Launch site records show that the right Solid joints experienced distress during the flight
Rocket Motor segments were assembled us- of 51-L.
ing approved procedures. However, signifi- 8. Experimental evidence indicates that due to
cant out-of-round conditions existed between several effects associated with the Solid
the two segments joined at the right Solid Rocket Booster's ignition and combustion
Rocket Motor aft field joint (the joint that pressures and associated vehicle motions, the
failed). gap between the tang and the clevis will open
a. While the assembly conditions had the as much as .017 and .029 inches at the sec-
potential of generating debris or dam- ondary and primary O-rings, respectively.
age that could cause O-ring seal failure, a. This opening begins upon ignition,
these were not considered factors in this reaches its maximum rate of opening
accident. at about 200-300 milliseconds, and is
b. The diameters of the two Solid Rocket essentially complete at 600 milliseconds
Motor segments had grown as a result when the Solid Rocket Booster reaches
of prior use. its operating pressure.
c. The growth resulted in a condition at b. The External Tank and right Solid
time of launch wherein the maximum Rocket Booster are connected by
gap between the tang and clevis in the several struts, including one at 310
region of the joint's O-rings was no degrees near the aft field joint that fail-
more than .008 inches and the average ed. This strut's effect on the joint
gap would have been .004 inches. dynamics is to enhance the opening of
d. With a tang-to-clevis gap of .004 the gap between the tang and clevis by
inches, the O-ring in the joint would about 10-20 percent in the region of
be compressed to the extent that it 300-320 degrees.
pressed against all three walls of the O- 9. O-ring resiliency is directly related to its
ring retaining channel. temperature.
e. The lack of roundness of the segments a. A warm O-ring that has been com-

70
pressed will return to its original shape tang-to-clevis gap (100 to 200 milli-
much quicker than will a cold O-ring seconds after motor ignition).
when compression is relieved. Thus, a b. Experimental evidence indicates that
warm O-ring will follow the opening of temperature, humidity and other
the tang-to-clevis gap. A cold O-ring variables in the putty compound used
may not. to seal the joint can delay pressure ap-
b. A compressed O-ring at 75 degrees plication to the joint by 500 milli-
Fahrenheit is five times more respon- seconds or more.
sive in returning to its uncompressed c. This delay in pressure could be a fac-
shape than a cold O-ring at 30 degrees tor in initial joint failure.
Fahrenheit. 12. Of 21 launches with ambient temperatures
c. As a result it is probable that the O- of 61 degrees Fahrenheit or greater, only four
rings in the right solid booster aft field showed signs of O-ring thermal distress; i.e.,
joint were not following the opening of erosion or blow-by and soot. Each of the
the gap between the tang and clevis at launches below 61 degrees Fahrenheit
time of ignition. resulted in one or more O-rings showing
10. Experiments indicate that the primary signs of thermal distress.
mechanism that actuates O-ring sealing is the a. Of these improper joint sealing actions,
application of gas pressure to the upstream one-half occurred in the aft field joints,
(high-pressure) side of the O-ring as it sits 20 percent in the center field joints, and
in its groove or channel. 30 percent in the upper field joints. The
a. For this pressure actuation to work division between left and right Solid
most effectively, a space between the Rockter Boosters was roughly equal.
O-ring and its upstream channel wall b. Each instance of thermal O-ring
should exist during pressurization. distress was accompanied by a leak
b. A tang-to-clevis gap of .004 inches, as path in the insulating putty. The leak
probably existed in the failed joint, path connects the rocket's combustion
would have initially compressed the O- chamber with the O-ring region of the
ring to the degree that no clearance ex- tang and clevis. Joints that actuated
isted between the O-ring and its without incident may also have had
upstream channel wall and the other these leak paths.
two surfaces of the channel. 13. There is a possibility that there was water in
c. At the cold launch temperature ex- the clevis of the STS 51-L joints since water
perienced, the O-ring would be very was found in the STS-9 joints during a
slow in returning to its normal round- destack operation after exposure to less rain-
ed shape. It would not follow the open- fall than STS 51-L. At time of launch, it was
ing of the tang-to-clevis gap. It would cold enough that water present in the joint
remain in its compressed position in the would freeze. Tests show that ice in the joint
O-ring channel and not provide a space can inhibit proper secondary seal
between itself and the upstream chan- performance.
nel wall. Thus, it is probable the O-ring 14. A series of puffs of smoke were observed
would not be pressure actuated to seal emanating from the 51-L aft field joint area
the gap in time to preclude joint failure of the right Solid Rocket Booster between
due to blow-by and erosion from hot 0.678 and 2.500 seconds after ignition of the
combustion gases. Shuttle Solid Rocket Motors.
11. The sealing characteristics of the Solid a. The puffs appeared at a frequency of
Rocket Booster O-rings are enhanced by about three puffs per second. This
timely application of motor pressure. roughly matches the natural structural
a. Ideally, motor pressure should be ap- frequency of the solids at lift off and is
plied to actuate the O-ring and seal the reflected in slight cyclic changes of the
joint prior to significant opening of the tang-to-clevis gap opening.

71
b. The puffs were seen to be moving up- Conclusion
ward along the surface of the booster
above the aft field joint.
In view of the findings, the Commission concluded
c. The smoke was estimated to originate
that the cause of the Challenger accident was the failure
at a circumferential position of between
of the pressure seal in the aft fieldjoint of the right Solid
270 degrees and 315 degrees on the
Rocket Motor. The failure was due to a faulty
booster aft field joint, emerging from
design unacceptably sensitive to a number of fac-
the top of the joint.
tors. These factors were the effects of tempera-
15. This smoke from the aft field joint at Shut-
ture, physical dimensions, the character of
tle lift off was the first sign of the failure of
materials, the effects of reusability, processing,
the Solid Rocket Booster O-ring seals on STS
and the reaction of the joint to dynamic
51-L.
loading.
16. The leak was again clearly evident as a flame
at approximately 58 seconds into the flight.
It is possible that the leak was continuous but
unobservable or non-existent in portions of
the intervening period. It is possible in either
case that thrust vectoring and normal vehi-
cle response to wind shear as well as planned
maneuvers reinitiated or magnified the
leakage from a degraded seal in the period
preceding the observed flames. The esti-
mated position of the flame, centered at a
point 307 degrees around the circumference
of the aft field joint, was confirmed by the
recovery of two fragments of the right Solid
Rocket Booster.
a. A small leak could have been present
that may have grown to breach the
joint in flame at a time on the order of
58 to 60 seconds after lift off.
b. Alternatively, the O-ring gap could
have been resealed by deposition of a
fragile buildup of aluminum oxide and
other combustion debris. This resealed
section of the joint could have been
disturbed by thrust vectoring. Space
Shuttle motion and flight loads induc-
ed by changing winds aloft.
c. The winds aloft caused control actions
in the time interval of 32 seconds to 62
seconds into the flight that were typical
of the largest values experienced on
previous missions.

72
References
1
51-L Structural Reconstruction and Evaluation Report, Na-
tional Transportation Safety Board, page 55. This document is
subsequently referred to as reference A.
2
51-L Data and Design Analysis Task Force (DDATF) Ex-
ternal Tank Working Group Final Report, NASA, page 65. This
document is subsequently referred to as reference B.
3
Reference B, page 20, 21
4
Reference B, page 66
5
Reference B. page 66
6
Reference B, page 65
7
DDATF Accident Analysis Team Report, NASA, page 23.
This document is subsequently referred to as reference C.
8
Reference A, page 60
9
DDATF Space Shuttle Main Engine (SSME) Working Group
Final Report, NASA, page 77. This document is subsequently
referred to as reference D.
10
Reference D, page 77, 81
11
Reference D, page 77, 81
12
Reference D, page 81
13
Reference D, page 81
14
Reference D, page 19
15
Reference D, page 30
16
Reference D, page 38
17
Reference D, page 91
18
Reference D, page 77, 91
19
Reference A, page 16
20
Reference A, page 38
21
DDAFT Orbiter and Government Furnished Equipment
(GFE) Working Group Final Report, NASA, page 6. This docu-
ment is subsequently referred to as reference E.
22
Reference E, page 7, 8
23
Reference E, page 13
24
Reference E, page 13
25
Reference E, page 14
26
Reference E, page 50
27
DDATF JUS/TDRS Systems Working Group Report,
NASA, page 52. This document is subsequently referred to as
reference F.
28
Reference F, page 53
29
Reference A, page 68

73
The upper photos show, from left to right, the left side of right side of the Shuttle stack. The lower photos show
the Orbiter (unburned), the right lower and upper rudder the range safety destruct charges in the External Tank.
speed brake (both burn damaged) and left upper speed These charges were exonerated when they were
brake (unburned), confirmation that the fire was on the recovered intact and undetonated.

74
75
The frustums on the left page are parts of
the Solid Rocket Booster forward
assemblies that contain recovery
parachutes, location aids and flotation
devices. The frustum of the left hand
booster (lower left) is virtually undamaged.
The right frustum shows impact damage at
top and burns along the base of the cone;
evidence indicates it was damaged when it
impacted with the External Tank. Shown at
right above is another Solid Rocket Motor
stack crosshatched to show the burned
area of the right booster's aft joint
(diagram at right). The flame from the hole
impinged on the External Tank and caused
a failure at the aft connection at the Exter-
nal Tank.
AFT SEGMENT/AFT CENTER SEGMENT FIELD JOINT CONFIGURATION

SRM^
INHIBITOR (CASTABLE)
INHIBITOR (MOLDED)

41.52"
O-RINGS _
(0.281 DIA)
STRESS
RELIEF FLAP"

EPOM
INSULATION

CASE ^ .479"

O-RING (.072" DIA)-

LEAK CHECK PORT-


INSULATION
HO-2 GREASE (CORK)
BEAD
PIN RETAINER BAND 77
J K
m
:

Examined at Kennedy Space


Center after their recovery
from the ocean, these frag-
ments show the extent of
burn through the right hand
booster's aft field joint. On
the left page are sections of
the aft center motor seg-
ment above the joint. On the
right page are sections (in-
verted) of the aft motor seg-
ment showing burn-hole
below the joint (bracket). Ex-
cept for the interior views on
lower left, the camera is
viewing the parts from out-
side the casing.
V 1

At upper left is the aft seg-


ment burn viewed from inside
the casing; the lower photo is
a closeup of the same sec-
tion. The latter photo shows a
hole (arrow) where the flame
plume may have burned
through the casing from the
outside. At right is a compos-
ite view of the burn above
and below the aft field joint.
Chapter V

The Contributing
Cause Of
The Accident

The decision to launch the Challenger and management judgments, and a NASA man-
was flawed. Those who made that agement structure that permitted internal flight
decision were unaware of the recent safety problems to bypass key Shuttle managers.
history of problems concerning the The Shuttle Flight Readiness Review is a care-
O-rings and the joint and were unaware of the fully planned, step-by-step activity, established
initial written recommendation of the contractor by NASA program directive SPO-PD 710.5A,1
advising against the launch at temperatures below designed to certify the readiness of all components
53 degrees Fahrenheit and the continuing opposi- of the Space Shuttle assembly. The process is
tion of the engineers at Thiokol after the manage- focused upon the Level I Flight Readiness
ment reversed its position. They did not have a Review, held approximately two weeks before a
clear understanding of Rockwell's concern that launch. The Level I review is a conference
it was not safe to launch because of ice on the chaired by the NASA Associate Administrator for
pad. If the decisionmakers had known all of the Space Flight and supported by the NASA Chief
facts, it is highly unlikely that they would have Engineer, the Program Manager, the center
decided to launch 51-L on January 28, 1986. directors and project managers from Johnson,
Marshall and Kennedy, along with senior con-
tractor representatives.
Flaws In The Decision The formal portion of the process is initiated
Making Process by directive from the Associate Administrator for
Space Flight. The directive outlines the schedule
In addition to analyzing all available evidence for the Level I Flight Readiness Review and for
concerning the material causes of the accident on the steps that precede it. The process begins at
January 28, the Commission examined the chain Level IV with the contractors formally cer-
of decisions that culminated in approval of the tifyingin writing the flight readiness of the
launch. It concluded that the decision making elements for which they are responsible. Certifica-
process was flawed in several ways. The actual tion is made to the appropriate Level III NASA
events that produced the information upon which project managers at Johnson and Marshall. Ad-
the approval of launch was based are recounted ditionally, at Marshall the review is followed by
and appraised in the sections of this chapter. The a presentation directly to the Center Director. At
discussion that follows relies heavily on excerpts Kennedy the Level III review, chaired by the
from the testimony of those involved in the Center Director, verifies readiness of the launch
management judgments that led to the launch of support elements.
the Challenger under conditions described. The next step in the process is the Certifica-
That testimony reveals failures in communica- tion of Flight Readiness to the Level II Program
tion that resulted in a decision to launch 51-L Manager at Johnson. In this review each Space
based on incomplete and sometimes misleading Shuttle program element endorses that it has
information, a conflict between engineering data satisfactorily completed the manufacture.

82
assembly, test and checkout of the pertinent ele- A structured Mission Management Team
ment, including the contractors' certification that meeting called L-l is held 24 hours, or one
design and performance are up to standard. The day, prior to each scheduled launch. Its agenda
Flight Readiness Review process culminates in includes closeout of any open work, a closeout
the Level I review. of any Flight Readiness Review action items, a
In the initial notice of the review, the Level I discussion of new or continuing anomalies, and
directive establishes a Mission Management an updated briefing on anticipated weather con-
Team for the particular mission. The team ditions at the launch site and at the abort land-
assumes responsibility for each Shuttle's readiness ing sites in different parts of the world. It is stand-
for a period commencing 48 hours before launch ard practice of Level I and II officials to en-
and continuing through post-landing crew egress courage the reporting of new problems or con-
and the safing of the Orbiter. On call throughout cerns that might develop in the interval between
the entire period, the Mission Management the Flight Readiness Review and and the L-l
Team supports the Associate Administrator for meeting, and between the L-l and launch.
Space Flight and the Program Manager. In a procedural sense, the process described

Readiness Reviews

Mission
Management
Team

Level 1
Flight
Readiness
Review

Level 2
Pre-Flight
Readiness v.
Review
^^ ^S^

Level 3 ^^^"^ \^
Marshall Space Kennedy Space Center Johnson Space
Flight Center Flight Launch Readiness Review Center
Readiness Review

Level 4 ^s^
^^ ^''^^ /v
""- \^
/ \
Space Shuttle Solid Rocket External Tank Shuttle Orbiter System
Main Engine Booster Processing Integration
Contractor
Contractor Contr actor Contractor SP C Cc ntractor Contrac tor

Readiness reviews for both the launch and the flight of a Shut-
tle mission are conducted at ascending levels that begin with
contractors.

NOTE: See Chart on page 102 for description of management


"levels" and organization chain of command.

83
was followed in the case of flight 51-L. However,
in the launch preparation for 51-L relevant con- mtotAmic MUSAM
cerns of Level III NASA personnel and element
UKCLA*iriED
contractors were not, in the following crucial Bu IT 1 33 n '55
areas, adequately communicated to the NASA
Level I and II management responsible for the t li>Miimow CM!

launch: EDCAR L. BARKLEROAO


i M* imm ar rmMMUcm
353
The objections to launch voiced by Morton
Thiokol engineers about the detrimental ef-
fect of cold temperatures on the performance DISTHIJUTION

of the Solid Rocket Motor joint seal.


The degree of concern of Thiokol and Mar-
SUBJECT: STS Sl-L FLIGHT UADUIISS MVIIV

shall about the erosion of the joint seals in THt STS 51-L rLIGHT MIAOINBSS RBVIBK (Mil) IS 3CHBDULED
FOR JANUARY 15, m6 FROM J:00-4:30 FH BST. THB LBYBL II
prior Shuttle flights, notably 51-C (January, NSTS OFFICB IS RBSFONSIBLB FOR INrLBMBNTING THIS RIVIBK.
1985) and 51-B (April, 1985). HBAOqUAATBRS 4-WIRB NUMBER 211 WILL BE U3ED FOR THIS
TBLBCON. TBLBVISIOH (ILL >B USED AS BEFORE.
On December 13, 1985, the Associate Ad-
THE INITIAL MEETING OF THB MISSION MANAGEMENT TEAM (MKT)
ministrator for Space flight, Jesse Moore, sent WILL SERVE THB FUNCTION OF THE L-l BAT REVIBW.
out a message distributed among NASA Head-
quarters, NASA field centers, and U.S. Air Force
units, that scheduled the Flight Readiness Review ESSE . MOORE
ASSOCIATE ASMINISTIATOR
for January 15, 1986, and prescribed the dates FOR SPACE FLIGHT
for the other steps in the standard procedure.
The message was followed by directives from
James A. (Gene) Thomas, Deputy Director of
Launch and Landing Operations at Kennedy on
January 2, 1986; by the National Space DMCLASSXriCO

Transportation System Program Manager, Ar-


nold Aldrich, on January 3; by William R. The NASA Associate Administrator for Space Flight
Lucas, the Marshall Center Director, on January issued this notice of scheduling of the Flight Readiness
Review for mission 51-L.
7; and by the Marshall Shuttle Projects Office on
January 8. Each of these implementing directives
prescribed for Level III the preparatory steps for
the Flight Readiness Review. Rocket Booster design, a term denoting a failure
The Flight Readiness Review was held, as point without back-up that could cause a loss
scheduled, on January 15. On the following day, oflife or vehicle if the component fails. In July,
Aldrich issued the schedule for the combined 1985, after a nozzle joint on STS 51-B showed
Level I/Mission Management Team meetings; erosion of a secondary O-ring, indicating that the
he also announced plans for the Mission Manage- primary seal failed, a launch constraint was
ment Team meetings continuing throughout the placed on flight 51-F and subsequent launches.
mission and included the schedule for the L-l These constraints had been imposed and regular-
review. ly waived by the Solid Rocket Booster Project
On January 23, Moore issued a directive Manager at Marshall, Lawrence B. Mulloy.
stating that the Flight Readiness Review had been Neither the launch constraint, the reason for
conducted on the 15th and that 51-L was ready it, or the six consecutive waivers prior to 51-L
to fly pending closeout of open work, satisfactory were known to Moore (Level I) or Aldrich (Level
countdown, and completion of remaining Flight II) or Thomas at the time of the Flight Readiness
Readiness Review action items, which were to Review process for 51-L.
be closed out during the L-l meeting. No prob- It should be noted that there were other and
lems with the Solid Rocket Booster were independent paths of system reporting that were
identified. designed to bring forward information about the
Since December, 1982, the O-rings had been Solid Rocket Booster joint anomalies. One path
designated a "Criticality 1" feature of the Solid was the task force of Thiokol engineers and Mar-
84
shall engineers who had been conducting subscale Chairman Rogers: And they all knew about
pressure tests at Wasatch during 1985, a source it at the time of 51-L?
of documented rising concern and frustration on
Mr. Mulloy: Yes, sir. You will find in the
the part of some of the Thiokol participants and Flight Readiness Review record that went
a few of the Marshall participants. But Level II all the way to the L-l review.
was not in the line of reporting for this activity.
Another path was the examination at each Flight It is disturbing to the Commission that con-
Readiness Review of evidence of earlier flight trary to the testimony of the Solid Rocket Booster
anomalies. For 51-L, the data presented in this Project Manager, the seriousness of concern was
latter path, while it reached Levels I and II, never not conveyed in Flight Readiness Review to Level
referred to either test anomalies or flight I and the 51-L readiness review was silent.
anomalies with O-rings. The only remaining issue facing the Mission
In any event, no mention of the O-ring prob- Management Team at the L-l review was the ap-
lems in the Solid Rocket Booster joint appeared proaching cold front, with forecasts of rain
in the Certification of Flight Readiness, signed showers and temperatures in the mid-sixties.
for Thiokol on January 9, 1986, by Joseph There had also been heavy rain since 51-L had
Kilminster, for the Solid Rocket Booster set been rolled out to the launch pad, approximate-
designated BI026.2 ly seven inches compared with the 2.5 inches that
Similarly, no mention appeared in the certifica- would have been normal for that season and*
tion endorsement, signed on January 15, 1986, length of exposure (35 days).
by Kilminster and by Mulloy,3 No mention ap- At 12:36 p.m. on the 27th, the Mission
pears in several inches of paper comprising the Management Team scrubbed the launch for that
entire chain of readiness reviews for 51-L.4 day due to high cross winds at the launch site.
In the 51-L readiness reviews, it appears that In the accompanying discussion that ran for about
neither Thiokol management nor the Marshall half an hour, all appropriate personnel were
Level III project managers believed that the O- polled as to the feasibility of a launch within 24
ring blow-by and erosion risk was critical. The hours. Participants were requested to identify any
testimony and contemporary correspondence constraints. This meeting, aimed at launch at
show that Level III believed there was ample 9:38 a.m. on January 28, produced no constraints
margin to fly with O-ring erosion, provided the or concerns about the performance of the Solid
leak check was performed at 200 pounds per Rocket Boosters.
square inch. At 2:00 p.m. on the 27th, the Mission Manage-
Following the January 15 Flight Readiness ment Team met again. At that time, the weather
Review each element of the Shuttle was certified was expected to clear, but it appeared that
as flight-ready. temperatures would be in the low twenties for
The L-l Mission Management Team meeting about 11 hours. Issues were raised with regard
took place as scheduled at 11:00 a.m. Eastern to the cold weather effects on the launch facility,
Standard Time January 25. No technical issues including the water drains, the eye wash and
appeared at this meeting or in the documenta- shower water, fire suppression system, and over-
tion and all Flight Readiness Review actions were pressure water trays. It was decided to activate
reported closed out. heaters in the Orbiter, but no concerns were ex-
Mr. Mulloy testified as follows regarding the pressed about the O-rings in the Solid Rocket
Flight Readiness Review record about O-ring Boosters. The decision was to proceed with the
concerns .5 countdown and with fueling, but all members of
the team were asked to review the situation and
Chairman Rogers: . . . Why wasn't that a call if any problems arose.
cause for concern on the part of the whole At approximately 2:30 p.m. EST, at Thiokol's
NASA organization? Wasatch plant, Robert Ebeling, after learning of
the predicted low temperature for launch, con-
Mr. Mulloy: It was cause for concern, sir.
vened a meeting with Roger Boisjoly and with
Chairman Rogers: Who did you tell about other Thiokol engineers. A brief chronology of
this?
the subsequent chain of events begins on page
Mr. Mulloy: Everyone, sir. 104. Ebeling was concerned about predicted cold
85
temperatures at Kennedy Space Center. In a predicted temperatures from pad B, as well
post-accident interview, Mr. Ebeling recalled the as what the temperature history had been
substance of the meeting.6 during the day up until that time.
. . . He obtained those temperatures from
"The meeting lasted one hour, but the
the launch operations center, and they
conclusion of that meeting was Engineer-
basically said that they felt it was going to
ingespecially Arnie, Roger Boisjoly, Brian
get near freezing or freezing before mid-
Russell, myself, Jerry Burns, they come to
night. It would get as low as 22 degrees as
mind were very adamant about their con-
a minimum in the early morning hours,
cerns on this lower temperature, because we
probably around 6:00 o'clock, and that they
were way below our data base and we were
were predicting a temperature of about 26
way below what we qualified for."
degrees at the intended time, about 9:38 the
Later in the afternoon on the same day, Allan next morning.
McDonald Thiokol's liaison for the Solid Rocket I took that data and called back to the
Booster project at Kennedy Space Center plant and sent it to Bob Ebeling and relayed
received a telephone call from Ebeling, express- that to him, and told him he ought to use
ing concern about the performance of the Solid this temperature data for his predictions, but
Rocket Booster field joints at low temperatures. I thought this was very serious and to make
During testimony before the Commission on sure that he had the vice president, engineer-
February 27, McDonald recounted that ing, involved in this and all of his people;
conversation:7 that I wanted them to put together some
calculations and a presentation of material.
Mr. McDonald: Well, I had first become
Chairman Rogers: Who's the Vice Presi-
aware of the concern of the low temperatures dent, Engineering?
that were projected for the Cape, it was late
Mr. McDonald: Mr. Bob Lund is our Vice
in the afternoon of the 27th. I was at Carver
President, Engineering, at our Morton
Kennedy's house. He is a vice president of,
Thiokol facility in Utah.
as I mentioned, our space operations center
To make sure he was involved in this, and
at the Cape, and supports the stacking of the
that this decision should be an engineering
SRMs [Solid Rocket Motors].
decision, not a program management deci-
And I had a call from Bob Ebeling. He
sion. And I told him that I would like him
is the manager of our ignition system and
to make sure they prepared some charts and
final assembly, and he worked for me as pro- were in a position to recommend the launch
gram manager at Thiokol in Utah. And he temperature and to have the rationale for
called me and said that they had just received supporting that launch temperature.
some word earlier that the weatherman was I then hung up and I called Mr. Mulloy.
projecting temperatures as low as 18 degrees He was staying at the Holiday Inn in Mer-
Fahrenheit some time in the early morning ritt Island and they couldn't reach him, and
hours of the 28th, and that they had some so I called Cecil Houston Cecil Houston
meetings with some of the engineering peo- is the resident manager for the Marshall
ple and had some concerns about the O-rings Space Flight Center office at KSC [Kennedy
getting to those kinds of temperatures. Space Center] and told him about our con-
And he wanted to make me aware of that cerns with the low temperatures and the
and also wanted to get some more updated potential problem with the O-rings.
and better information on what the actual And he said that he would set up a
temperature was going to be depicted, so teleconference. He had a four-wire system
that they could make some calculations on next to his office. His office is right across
what they expected the real temperature the from the VAB [Vehicle Assembly Building]
O-rings may see. . . . in the trailer complex C over there. And he
I told him that I would get that would set up a four-wire teleconference in-
temperature data for him and call him back. volving the engineering people at Marshall
Carver Kennedy then, when I hung up, call- Space Flight Center at Huntsville, our peo-
ed the launch operations center to get the ple back at Thiokol in Utah; and that I

86
should come down to his office and par- Dr. Keel: So as early as after that first after-
ticipate at Kennedy from there, and that he noon conference at 5:45, it appeared that
would get back with me and let me know Thiokol was basically saying delay. Is that
when that time would be. right?
Soon thereafter Cecil Houston called Dr. Jud- Dr. Lovingood: That is the way it came
son Lovingood, Deputy Shuttle Project Manager across to me. I don't know how other peo-
at Marshall Space Flight Center, to inform him ple perceived it, but that's the way it came
of the concerns about the O-rings and asked Lov- across to me.
ingood to set up a teleconference with senior proj- Dr. Keel: Mr. Reinartz, how did you
ect management personnel, with George Hardy, perceive it?
Marshall's Deputy Director of Science and Mr. Reinartz: I did not perceive it that way.
Engineering, and with Morton Thiokol person- I perceived that they were raising some ques-
nel. Lovingood called Stanley Reinartz, Shuttle tions and issues which required looking in-
Project Manager, a few minutes later and in- to by all the right parties, but I did not
formed him of the planned telecon. perceive it as a recommendation delay.
The first phase of the teleconference began at
Dr. Keel: Some prospects for delay?
5:45 p.m. Eastern Standard Time; participants
included Reinartz, Lovingood, Hardy, and Mr. Reinartz: Yes, sir, that possibility is
numerous people at Kennedy, Marshall and always there.
Thiokol-Wasatch. (Allan McDonald missed this Dr. Keel: Did you convey that to Mr.
phase; he did not arrive at Kennedy until after Mulloy and Mr. Hardy before the 8:15
8:00 p.m.) Concerns for the effect of low conference?
temperature on the O-rings and the joint seal Mr. Reinartz: Yes, I did. And as a matter
were presented by Morton Thiokol, along with of fact, we had a discussion. Mr. Mulloy was
an opinion that launch should be delayed. A just out of communication for about an
recommendation was also made that Aldrich, hour, and then after that I got in contact with
Program Manager at Johnson (Level II), be in- him, and we both had a short discussion
formed of these concerns. relating to the general nature of the concerns
The following are excerpts from testimony with Dr. Lucas and Mr. Kingsbury at the
before the Commission relating to the motel before we both departed for the telecon
teleconference:8 that we had set up out at the Cape.
Dr. Keel: You just indicated earlier that, Dr. Keel: But based upon that, Mr. Lov-
based upon that teleconference, you thought ingood, that impression, you thought it was
there was a good possibility of delay. Is that a significant enough possibility that Mr.
what Thiokol was recommending then, was Aldrich should have been contacted?
delay? Dr. Lovingood: Yes.
Dr. Lovingood: That is the way I heard it, Dr. Keel: In addition, did you recommend
and they were talking about the 51-C ex- that Mr. Lucas, who is director of Marshall,
perience and the fact that they had ex- of course, and Mr. Kingsbury, who is Mr.
perienced the worst case blow-by as far as Hardy's boss, participate in the 8:15
the arc and the soot and so forth. And also, conference?
they talked about the resiliency data that
they had. Dr. Lovingood: Yes, I did.
So it appeared to me and we didn't have Dr. Keel: And you recommended that to
all of the proper people there. That was whom?
another aspect of this. It appeared to me that Dr. Lovingood: I believe I said that over
we had better sit down and get the data so the net. I said that I thought we ought to
that we could understand exactly what they have an inter-center meeting involving Dr.
were talking about and assess that data. Lucas and Mr. Kingsbury, and then plan
And that is why I suggested that we go to go on up the line to Level II and Level I.
ahead and have a telecon within the center, And then it was after we broke off that first
so that we could review that. telecon I called Stan at the motel and told
87
him that he ought to go ahead and alert Mr. Boisjoly: I expressed deep concern
Arnie to that possibility. about launching at low temperature. I
Dr. Keel: And Mr. Reinartz, you then presented Chart 2-1 with emphasis now,
visited the motel room of Mr. Lucas with 2-1, if you want to see it, I have it, but
Mr. Kingsbury, and also was Mr. Mulloy basically that was the chart that summariz-
with you then? ed the primary concerns, and that was the
chart that I pulled right out of the
Mr. Reinartz: Yes, sir, he was. In the first Washington presentation without changing
couple of minutes I believe I was there by one word of it because it was still applicable,
myself, and then Mr. Mulloy joined us. and it addresses the highest concern of the
Dr. Keel: And did you discuss with them field joint in both the ignition transient con-
Mr. Lovingood's recommendation that the dition and the steady state condition, and it
two of them, Lucas and Kingsbury, really sets down the rationale for why we
participate? were continuing to fly. Basically, if erosion
Mr. Reinartz: No, sir. I don't recall discuss- penetrates the primary O-ring seal, there is
ing Mr. Lovingood's recommendations. I a higher probability of no secondary seal
discussed with them the nature of the capability in the steady state condition. And
telecon, the nature of the concerns raised by I had two sub-bullets under that which stated
Thiokol, and the plans to gather the proper bench testing showed O-ring not capable of
technical support people at Marshall for ex- maintaining contact with metal parts, gap,
amination of the data. And I believe that was opening rate to maximum operating
the essence of the discussion. pressure. I had another bullet which stated
bench testing showed capability to maintain
Chairman Rogers: But you didn't recom-
mend that the information be given to Level O-ring contact during initial phase (0 to 170
II or Level I? milliseconds of transient). That was my com-
fort basis of continuing to fly under normal
Mr. Reinartz: I don't recall that I raised that circumstances, normal being within the data
issue with Dr. Lucas. I told him what the base we had.
plans were for proceeding. I don't recall, Mr. I emphasized, when I presented that chart
Chairman, making any statement regarding about the changing of the timing function
that. of the O-ring as it attempted to seal. I was
Mr. Hotz: Mr. Reinartz, are you telling us concerned that we may go from that first
that you in fact are the person who made the beginning region into that intermediate
decision not to escalate this to a Level II region, from 0 to 170 being the first region,
item? and 170 to 330 being the intermediate region
Mr. Reinartz: That is correct, sir. where we didn't have a high probability of
sealing or seating.
At approximately 8:45 p.m. Eastern Standard I then presented Chart 2-2 with added
Time, Phase 2 of the teleconference commenc- concerns related to the timing function. And
ed, the Thiokol charts and written data having basically on that chart, I started off talking
arrived at Kennedy Space Center by telefax. (A about a lower temperature than current data
table of teleconference participants is included base results in changing the primary O-ring
with Chronology of Events.) The charts presented sealing timing function, and I discussed the
a history of the O-ring erosion and blow-by in SRM-15 [Flight 51-C, January, 1985] obser-
the Solid Rocket Booster joints of previous flights, vations, namely, the 15A [Left SRM, Flight
presented the results of subscale testing at Thiokol 51-C] motor had 80 degrees arc black grease
and the results of static tests of Solid Rocket between the O-rings, and make no mistake
Motors. In the following testimony, Roger Bois- about it, when I say black, I mean black just
joly, Allan McDonald and Larry Mulloy ex- like coal. It was jet black. And SRM-15B
pressed their recollections of this teleconference [Right SRM, Flight 51-C] had a 110 degree
up to the point when an off-net caucus was arc of black grease between the O-rings. We
requested:9 would have low O-ring squeeze due to low

88
PRimilY COIICEP.NS Joint Primary Concerns SRM 25
A Temperature Lower Than Current Data Base
FIELD JOINT - HIGHEST COtlCEP-H
Results in Changing Primary O-Ring Sealing Timing
Function
o EHQSION PENETRATIOH OF PIMIVWY SEAL DEQUIRES RELIABLE SECONDARY SEAL
FOR PRESSURE INTEGRITY SRM 15A-800 ARC Black Grease Between
o IGNITION TRANSIENT - (0-600 MS) O-Rings
o (0-170 IKIHIGH PROBABILITY OF RELIABLE SECONDARY SEAL
SRM 15B-1100 ARC Black Grease Between
o (170-330 (IS) REDUCED PRODABILIH OF RELIABLE SECONDARY SEAL
O-Rings
o (330-600 US) HIGH PROBABILITY OF NO SECONDARY SEAL CAPABILITY
Lower O-Ring squeeze due to lower temp.
o STEADY STATH - (600 MS - 2 MINUTES)
o IF EROSION PENETRATES PRIMARY 0-R1NG SEAL - HIGH PROBABILITY OF Higher O-Ring shore hardness
NO SECONDARY SEAL CAPABILITY
Thicker grease viscosity
o DEHCH TESTING SHOWED O-RING NOT CAPABLE OF MAINTAINING CONTACT
WITH METAL PARTS GAP OPENING RATE TO IEOP Higher O-Ring pressure actuation time
o BENCH TESTING SHOWED CAPABILITY TO MAINTAIN O-RING CONTACT DURING
INITIAL PHASE (0-170 IIS) OF TPJWSIEHT
If actuation time increases, threshold of secondary
seal pressurization capability is approached
Chart 2-1 presented by Thiokol's Roger Boisjoly summarizing If threshold is reached then secondary seal may not
primary concerns with the field joint and its O-ring seals on the be capable of being pressurized
boosters.
Boisjoly's Chart 2-2 indicating concern about temperature ef-
fect on seal actuation time (handwritten).

temperature which I calculated earlier in the lifted off, which has been shown to
day. We should have higher O-ring Shore everybody. I was asked, yes, at that point
hardness. . . . in time I was asked to quantify my concerns,
Now, that would be harder. And what and I said I couldn't. I couldn't quantify it.
that material really is, it would be likened I had no data to quantify it, but I did say
to trying to shove a brick into a crack ver- I knew that it was away from goodness in
sus a sponge. That is a good analogy for pur- the current data base. Someone on the net
poses of this discussion. I also mentioned commented that we had soot blow-by on
that thicker grease, as a result of lower SRM-22 [Flight 61-A, October, 1985]
temperatures, would have a higher viscosi- which was launched at 75 degrees. I don't
ty. It wouldn't be as slick and slippery as it remember who made the comment, but that
would be at room temperature. And so it is where the first comment came in about
would be a little bit more difficult to move the disparity between my conclusion and the
across it. observed data because SRM-22 [Flight
We would have higher O-ring pressure ac- 61-A, October, 1985] had blow-by at essen-
tuation time, in my opinion, and that is what tially a room temperature launch.
I presented. . . . These are the sum and I then said that SRM-15 [Flight 51-C,
substance of what I just presented. If action January, 1985] had much more blow-by in-
time increases, then the threshold of second- dication and that it was indeed telling us that
ary seal pressurization capability is ap- lower temperature was a factor. This was
proached. That was my fear. If the threshold supported by inspection of flown hardware
is reached, then secondary seal may not be by myself. I was asked again for data to sup-
capable of being pressurized, and that was port my claim, and I said I have none other
the bottom line of everything that had been than what is being presented, and I had been
presented up to that point. trying to get resilience data, Arnie and I
Chairman Rogers: Did anybody take issue both, since last October, and that statement
with you? was mentioned on the net.
Mr. Boisjoly: Well, I am coming to that. Others in the room presented their charts,
I also showed a chart of the joint with an and the main telecon session concluded with
exaggerated cross section to show the seal Bob Lund, who is our Vice President of

89
RECOKO^ENiPA-TiOMS S

0
O-RlNO- -T-EV^P MUiTr BE > 53 * p
AT LAUNJCH

PEV/EUOpMEM-r ^OT-ORS AT 4-7 " -To Sa0F- WITH


Pu-rTY PACONJG. HAD NO BLOW- Br
SCfv\ is (THE BEST- 5.N^UI_ATON ) WORKED AT S3 "F
0
PROJECT AMBJENJT" COKJDI-T-IOMS ^-TEfvnp ^ WiND^
T~c I>E.T-E^NOlME LAUNCH "T-! fvn E

Initial Thiokol recommendation Chart presented by Robert K. Then MTI management then asked for
Lund at second teleconference prior to Thiokol caucus. a five-minute caucus. I'm not sure exactly
who asked for that, but it was asked in such
Engineering, presenting his conclusions and a manner that I remember it was asked for,
recommendations charts which were based a five-minute caucus, which we put on
on our data input up to that point. Listeners the line on mute and went off-line with the
on the telecon were not pleased with the con- rest of the net.
clusions and the recommendations. Chairman Rogers: Mr. Boisjoly, at the time
Chairman Rogers: What was the that you made the that Thiokol made the
conclusion? recommendation not to launch, was that the
Mr. Boisjoly: The conclusion was we unanimous recommendation as far as you
should not fly outside of our data base, which knew?
was 53 degrees. Those were the conclusions. Mr. Boisjoly: Yes. I have to make
And we were quite pleased because we knew something clear. I have been distressed by
in advance, having participated in the the things that have been appearing in the
preparation, what the conclusions were, and paper and things that have been said in
we felt very comfortable with that. general, and there was never one positive,
Mr. Acheson: Who presented that pro-launch statement ever made by any-
conclusion? body. There have been some feelings since
Mr. Boisjoly: Mr. Bob Lund. He had then that folks have expressed that they
prepared those charts. He had input from would support the decision, but there was
other people. He had actually physically not one positive statement for launch ever
prepared the charts. It was about that time made in that room.
that Mr. Hardy from Marshall was asked
Mr. McDonald's testimony:10
what he thought about the MTI [Morton
Thiokol] recommendation, and he said he Mr. McDonald: I arrived at the Kennedy
was appalled at the MTI decision. Mr. Har- Space Center at about 8:15 [p.m.], and
dy was also asked about launching, and he when I arrived there at the Kennedy Space
said no, not if the contractor recommended Center the others that had already arrived
not launching, he would not go against the were Larry Mulloy, who was there he is
contractor and launch. the manager, the project manager for the
There was a short discussion that ensued SRB for Marshall. Stan Reinartz was there
about temperature not being a discriminator and he is the manager of the Shuttle Project
between SRM-15 [Flight 51-C] and Office. He's Larry Mulloy's boss.
SRM-22 [Flight 61-A], and shortly after, I Cecil Houston was there, the resident
believe it was Mr. Kilminster asked if manager for Marshall. And Jack Buchanan
excuse me. I'm getting confused here. Mr. was there. He happens to be our manager,
Kilminster was asked by NASA if he would Morton Thiokol's manager of our launch
launch, and he said no because the engineer- support services office at Kennedy.
ing recommendation was not to launch. The telecon hadn't started yet. It came on

90
the network shortly after I got there. . . . . . . and the telecon was begun at 8:45.
Chairman Rogers: Was it essentially a And Thiokol will then present to you to-
telephone conference or was there actually day the data that they presented to us in that
a network of pictures? telecon. I will not do that. The bottom line
Mr. McDonald: It was a telephone con- of that, though, initially was that Thiokol
ference. . . . engineering. Bob Lund, who is the Vice
But I will relay . . . what I heard at the President and Director of Engineering, who
conference as best I can. The teleconference is here today, recommended that 51-L not
started I guess close to 9:00 o'clock and, even be launched if the O-ring temperatures
though all the charts weren't there, we were predicted at launch time would be lower than
told to begin and that Morton Thiokol any previous launch, and that was 53
should take the lead and go through the degrees.
charts that they had sent to both centers. Dr. Walker: May I ask a question? I wish
The charts were presented by the you would distinguish between the predicted
engineering people from Thiokol, in fact by bulk temperatures and the O-ring
the people that had made those particular temperatures. In fact, as I understand it, you
charts. Some of them were typed, some of really don't have any official O-ring
them were handwritten. And they discuss- temperature prediction in your models, and
ed their concerns with the low temperatures it seems that the assumption has been that
relative to the possible effects on the O-rings, the O-ring temperature is the same as the
primarily the timing function to seal the O- bulk temperature, which we know is not the
rings. case.
They presented a history of some of the
data that we had accumulated both in static Mr. Mulloy: You will see, sir, in the
test and in flight tests relative to Thiokol presentation today that that is not
temperatures and the performance of the O- the case. This was a specific calculation of
rings, and reviewed the history of all of our what the O-ring temperature was on the day
erosion studies of the O-rings, in the field of the January 1985 launch. It is not the bulk
joints, any blow-by of the primary O-ring temperature of the propellant, nor is it the
with soot or products of combustion or ambient temperature of the air.
decomposition that we had noted, and the It was Thiokol's calculation of what the
performance of the secondary O-rings. lowest temperature an O-ring had seen in
And there was an exchange amongst the previous flights, and the engineering recom-
technical people on that data as to what it mendation was that we should not move out-
meant . . . But the real exchange never real- side of that experience base.
ly came until the conclusions and recommen- I asked Joe Kilminster, who is the pro-
dations came in. gram manager for the booster program at
At that point in time, our vice president, Thiokol, what his recommendation was,
Mr. Bob Lund, presented those charts and because he is the gentleman that I get my
he presented the charts on the conclusions recommendations from in the program of-
and recommendations. And the bottom line fice. He stated that, based on that engineer-
was that the engineering people would not ing recommendation, that he could not
recommend a launch below 53 degrees recommend launch.
Fahrenheit. The basis for that recommen- At that point I restated, as I have testified
dation was primarily our concern with the to, the rationale that was essentially
launch that had occurred about a year documented in the 1982 Critical Items List,
earlier, in January of 1985, I believe it was that stated that the rationale had been that
51-C. we were flying with a simplex joint seal. And
Mr. Mulloy's testimony:11 you will see in the Thiokol presentation that
the context of their presentation is that the
Mr. Mulloy: That telecon was a little late primary ring, with the reduced temperatures
starting. It was intended to be set up at 8:15 and reduced resiliency, may not function as

91
a primary seal and we would be relying on could go to 125 thousandths of a cut out of
secondary. the O-ring and it would still seal.
And without getting into their rationale Approximately 10 engineers participated in the
and getting ahead, the point, the bottom caucus, along with Mason, Kilminster, C. G.
line, is that we were continuing the assess- Wiggins (Vice President, Space Division), and
ment was, my assessment at that time was, Lund. Arnold Thompson and Boisjoly voiced
that we would have an effective simplex seal, very strong objections to launch, and the sugges-
based upon the engineering data that tion in their testimony was that Lund was also
Thiokol had presented, and that none of reluctant to launch:13
those engineering data seemed to change
that basic rationale. Mr. Boisjoly: Okay, the caucus started by
Stan Reinartz then asked George Hardy, Mr. Mason stating a management decision
the Deputy Director of Science and was necessary. Those of us who opposed the
Engineering at Marshall, what his opinion launch continued to speak out, and I am
was. George stated that he agreed that the specifically speaking of Mr. Thompson and
engineering data did not seem to change this myself because in my recollection he and I
basic rationale, but also stated on the telecon were the only ones that vigorously continued
that he certainly would not recommend to oppose the launch. And we were attempt-
launching if Thiokol did not. ing to go back and rereview and try to make
At that time Joe Kilminster requested a clear what we were trying to get across, and
five minute off-net caucus, and that caucus we couldn't understand why it was going to
lasted approximately 30 minutes. be reversed. So we spoke out and tried to
explain once again the effects of low
The teleconference was recessed at approx- temperature. Arnie actually got up from his
imately 10:30 p.m. Eastern Standard Time. The position which was down the table, and
off-net caucus of Thiokol personnel started and walked up the table and put a quarter pad
continued for about 30 minutes at the Wasatch down in front of the table, in front of the
office. The major issues, according to the management folks, and tried to sketch out
testimony of Jerry Mason, Senior Vice President once again what his concern was with the
for Wasatch Operations, were the effect of joint, and when he realized he wasn't get-
temperature upon the O-rings and the history of ting through, he just stopped.
erosion of the O-rings:12 I tried one more time with the photos. I
Mr. Mason: Now, in the caucus we grabbed the photos, and I went up and
revisited all of our previous discussions, and discussed the photos once again and tried to
the important things that came out of that make the point that it was my opinion from
was that, as we had recognized, we did have actual observations that temperature was in-
the possibility that the primary O-ring might deed a discriminator and we should not ig-
be slower to move into the seating position nore the physical evidence that we had
and that was our concern, and that is what observed.
we had focused on originally. And again, I brought up the point that
The fact that we couldn't show direct cor- SRM-15 [Flight 51-C, January, 1985] had
a 110 degree arc of black grease while
relation with the O-ring temperature was
SRM-22 [Flight 61-A, October, 1985] had
discussed, but we still felt that there was
some concern about it being colder. a relatively different amount, which was less
We then recognized that, if the primary and wasn't quite as black. I also stopped
did move more slowly, that we could get when it was apparent that I couldn't get
some blow-by and erosion on the primary. anybody to listen.
But we had pointed out to us in that caucus Dr. Walker: At this point did anyone else
a point that had not come across clearly in speak up in favor of the launch?
our earlier discussions, and that is that we Mr. Boisjoly: No, sir. No one said
had run tests where we deliberately cut large anything, in my recollection, nobody said
pieces out of the O-rings to see what the a word. It was then being discussed amongst
threshold of sealing was, and we found we the management folks. After Arnie and I had
92
our last say, Mr. Mason said we have to Mr. Boisjoly: Well, the comments made
make a management decision. He turned to over the [net] is what I felt, I can't speak for
Bob Lund and asked him to take off his them, but I felt it I felt the tone of the
engineering hat and put on his management meeting exactly as I summed up, that we
hat. From this point on, management for- were being put in a position to prove that
mulated the points to base their decision on. we should not launch rather than being put
There was never one comment in favor, as in the position and prove that we had enough
I have said, of launching by any engineer data to launch. And I felt that very real.
or other nonmanagement person in the room Dr. Walker: These were the comments from
before or after the caucus. I was not even the NASA people at Marshall and at Ken-
asked to participate in giving any input to nedy Space Center?
the final decision charts. Mr. Boisjoly: Yes.
I went back on the net with the final charts
Dr. Feynman: I take it you were trying to
or final chart, which was the rationale for
find proof that the seal would fail?
launching, and that was presented by Mr.
Kilminster. It was hand written on a Mr. Boisjoly: Yes.
notepad, and he read from that notepad. I Dr. Feynman: And of course, you didn't,
did not agree with some of the statements you couldn't, because five of them didn't,
that were being made to support the deci- and if you had proved that they would have
sion. I was never asked nor polled, and it all failed, you would have found yourself in-
was clearly a management decision from that correct because five of them didn't fail.
point. Mr. Boisjoly: That is right. I was very con-
I must emphasize, I had my say, and I cerned that the cold temperatures would
never [would] take [away] any management change that timing and put us in another
right to take the input of an engineer and regime, and that was the whole basis of my
then make a decision based upon that input, fighting that night.
and I truly believe that. I have worked at As appears from the foregoing, after the discus-
a lot of companies, and that has been done sion between Morton Thiokol management and
from time to time, and I truly believe that, the engineers, a final management review was
and so there was no point in me doing conducted by Mason, Lund, Kilminster, and
anything any further than I had already at- Wiggins. Lund and Mason recall this review as
tempted to do. an unemotional, rational discussion of the
I did not see the final version of the chart engineering facts as they knew them at that time;
until the next day. I just heard it read. I left differences of opinion as to the impact of those
the room feeling badly defeated, but I felt facts, however, had to be resolved as a judgment
I really did all I could to stop the launch. call and therefore a management decision. The
I felt personally that management was testimony of Lund taken by Commission staff in-
under a lot of pressure to launch and that vestigators is as follows:14
they made a very tough decision, but I didn't
agree with it. Mr. Lund: We tried to have the telecon, as
One of my colleagues that was in the I remember it was about 6:00 o'clock
meeting summed it up best. This was a [MST], but we didn't quite get things in
meeting where the determination was to order, and we started transmitting charts
launch, and it was up to us to prove beyond down to Marshall around 6:00 or 6:30
a shadow of a doubt that it was not safe to [MST], something like that, and we were
do so. This is in total reverse to what the making charts in real time and seeing the
position usually is in a preflight conversa- data, and we were discussing them with the
tion or a flight readiness review. It is usual- Marshall folks who went along.
ly exactly opposite that. We finally got the all the charts in, and
when we got all the charts in I stood at the
Dr. Walker: Do you know the source of the board and tried to draw the conclusions that
pressure on management that you alluded we had out of the charts that had been
to? presented, and we came up with a conclu-
93
sions chart and said that we didn't feel like manager of applied mechanics. On the
it was a wise thing to fly. chart.
Question: What were some of the
Before the Commission on February 25, 1986,
conclusions?
Mr. Lund testified as follows regarding why he
Mr. Lund: I had better look at the chart. changed his position on launching Challenger
Well, we were concerned the temperature during the management caucus when he was
was going to be lower than the 50 or the 53 asked by Mr. Mason "To take off his engineer-
that had flown the previous January, and we ing hat and put on his management hat":15
had experienced some blow-by, and so we
were concerned about that, and although the Chairman Rogers: How do you explain the
erosion on the O-rings, and it wasn't critical, fact that you seemed to change your mind
that, you know, there had obviously been when you changed your hat?
some little puff go through. It had been Mr. Lund: I guess we have got to go back
caught. a little further in the conversation than that.
There was no real extensive erosion of that We have dealt with Marshall for a long time
O-ring, so it wasn't a major concern, but we and have always been in the position of
said, gee, you know, we just don't know how defending our position to make sure that we
much further we can go below the 51 or 53 were ready to fly, and I guess I didn't realize
degrees or whatever it was. So we were con- until after that meeting and after several days
cerned with the unknown. And we presented that we had absolutely changed our position
that to Marshall, and that rationale was re- from what we had been before. But that
jected. They said that they didn't accept that evening I guess I had never had those kinds
rationale, and they would like us to consider of things come from the people at Marshall.
some other thoughts that they had had. We had to prove to them that we weren't
. . . Mr. Mulloy said he did not accept ready, and so we got ourselves in the thought
that, and Mr. Hardy said he was appalled process that we were trying to find some way
that we would make such a recommenda- to prove to them it wouldn't work, and we
tion. And that made me ponder of what I'd were unable to do that. We couldn't prove
missed, and so we said, what did we miss, absolutely that that motor wouldn't work.
and Mr. Mulloy said, well, I would like you Chairman Rogers: In other words, you
to consider these other thoughts that we have honestly believed that you had a duty to
had down here. And he presented a very prove that it would not work?
strong and forthright rationale of what they Mr. Lund: Well, that is kind of the mode
thought was going on in that joint and how we got ourselves into that evening. It seems
they thought that the thing was happening, like we have always been in the opposite
and they said, we'd like you to consider that mode. I should have detected that, but I did
when they had some thoughts that we had not, but the roles kind of switched. . . .
not considered.
... So after the discussion with Mr. Supplemental testimony of Mr. Mason ob-
Mulloy, and he presented that, we said, well, tained in a Commission staff interview is as
let's ponder that a little bit, so we went off- follows:16
line to talk about what we Question: Do you recall Mr. Hardy and
Question: Who requested to go off-line? Mr. Mulloy's comments after I think after
Mr. Lund: I guess it was Joe Kil- Mr. Kilminster had got done, or Mr. Lund
minster. . . . got done presenting the charts? They had
And so we went offline on the telecon . . . some comments. Do you recall
so we could have a roundtable discussion Mr. Mason: Oh, yes, it was over and over.
here. Hardy said that, "I'm appalled at your
Question: Who were the management peo- recommendation.". . . .
ple that were there? Question: Well, did Mr. Hardy's "appall-
Mr. Lund: Jerry Mason, Cal Wiggins, Joe, ed" remark and Mr. Mulloy's "can't launch,
I, manager of engineering design, the we won't be able to launch until April"
94
remark, how did that affect your thinking impression that the qualification
and affect your decision? temperature was 40 to 90, and I knew
Mr. Mason: My personal thinking, I just, everything wasn't qualified to that
you know, it didn't make that much dif- temperature, in my opinion. But we were
ference. . . . trying to qualify that case itself at 40 to 90
And the comments that they made, in my degrees for the filament wound case.
view, probably had got more reaction from I then said I may be naive about what
the engineers] at the lower level than they generates launch commit criteria, but it was
would from the managers], because we deal my impression that launch commit criteria
with people, and managers all the time. . . . was based upon whatever the lowest
temperature, or whatever loads, or whatever
Mr. McDonald indicated that during the environment was imposed on any element
period of the internal Morton Thiokol caucus he or subsystem of the Shuttle. And if you are
continued to argue for delay with Mulloy, operating outside of those, no matter which
challenging, among other things, the rationale one it was, then you had violated some
that the rocket motor was qualified down to 40 launch commit criteria.
degrees Farhenheit. Present were Reinartz, Jack That was my impression of what that was.
Buchanan, the manager of Morton Thiokol And I still didn't understand how NASA
Launch Support Services at Kennedy, and Cecil could accept a recommendation to fly below
Houston. McDonald's testimony described that 40 degrees. I could see why they took issue
conversation:17 with the 53, but I could never see why they
Mr. McDonald: . . . while they were off- would ... of accept a recommendation
line, reevaluating or reassessing this data below 40 degrees, even though I didn't agree
... I got into a dialogue with the NASA that the motor was fully qualified to 40. I
people about such things as qualification and made the statement that if we're wrong and
launch commit criteria. something goes wrong on this flight, I
The comment I made was it is my under- wouldn't want to have to be the person to
standing that the motor was supposedly stand up in front of board of inquiry and say
qualified to 40 to 90 degrees. that I went ahead and told them to go ahead
I've only been on the program less than and fly this thing outside what the motor was
three years, but I don't believe it was. I don't qualified to.
believe that all of those systems, elements, I made that very statement.
and subsystems were qualified to that
Mr. Mulloy's recollections of these discussions
temperature.
are as follows:18
And Mr. Mulloy said well, 40 degrees is
propellant mean bulk temperature, and Mr. Mulloy: Mr. Kilminster then requested
we're well within that. That is a requirement. an off-net caucus. It has been suggested, im-
We're at 55 degrees for that and that the plied, or stated that we directed Thiokol to
other elements can be below that . . . that, go reconsider these data. That is not true.
as long as we don't fall out of the propellant Thiokol asked for a caucus so that they could
mean bulk temperature. I told him I thought consider the discussions that had ensued and
that was asinine because you could expose the comments that Mr. Hardy and I and
that large Solid Rocket Motor to extremely others had made.
low temperatures I don't care if it's 100 That caucus, as has been stated, was go-
below zero for several hours with that ing to start at that point, and Mr. McDonald
massive amount of propellant, which is a interjected into the teleconference. At that
great insulator, and not change that pro- point, he made the first comment that he had
pellant mean bulk temperature but only a made during this entire teleconference.
few degrees, and I don't think the spec real- Mr. McDonald testified for quite a while
ly meant that. yesterday about his thoughts on this, but he
But that was my interpretation because I did not say any of them until this point. At
had been working quite a bit on the filament that point, he stated that he thought what
wound case Solid Rocket Motor. It was my George Hardy said was a very important
95
consideration, and that consideration was, April. We need to consider this carefully
and he asked Mr. Kilminster to be sure and before we jump to any conclusions.
consider the comment made by George Har- It is all in the context, again, with
dy during the course of the discussions, that challenging your interpretation of the data,
the concerns expressed were for primary CD- what does it mean and is it logical, is it tru-
ring blow-by and that the secondary O-ring ly logical that we really have a system that
was in a position to seal during the time of has to be 53 degrees to fly?
blow-by and would do so before significant
At approximately 11 p.m. Eastern Standard
joint rotation had occurred.
Time, the Thiokol/NASA teleconference resum-
They then went into their caucus, having
ed, the Thiokol management stating that they had
asked for five minutes
reassessed the problem, that the temperature ef-
Mr. Hotz: ... It figures quite prominent-
fects were a concern, but that the data were ad-
ly in the discussion that you were quoted as
mittedly inconclusive. Kilminster read the ra-
saying, do you expect us to wait till April
tionale recommending launch and stated that that
to launch?
was Morton Thiokol's recommendation. Hardy
Mr. Mulloy: Yes, sir. requested that it be sent in writing by telefax both
Dr. Walker: Is that an accurate statement to Kennedy and to Marshall, and it was. The
or not? testimony of Mulloy and Hardy regarding the re-
Mr. Mulloy: It is certainly a statement that mainder of the teleconference and their rationale
is out of context, and the way I read the for recommending launch follows:19
quote, sir and I have seen it many times, Mr. Mulloy: Okay, sir. At the completion
too many times the quote I read was: My of the caucus, of course, Mr. Kilminster
God, Thiokol, when do you want me to came back on the loop and stated they had
launch, next April? assessed all the data and considered the
Mr. McDonald testified to another quote discussions that had ensued for the past cou-
that says: You guys are generating new ple of hours and the discussions that oc-
Launch Commit Criteria. curred during their caucus.
Now, both of those I think kind of go Chairman Rogers: Was it a couple of
together, and that is what I was saying. I hours?
don't know whether that occurred during the Mr. Mulloy: Yes, sir. We started at 8:45
caucus or subsequent to. I just simply can't and I believe it was probably 11:00 o'clock
remember that. before he came back on the loop. It was a
Mr. Hotz: Well, never mind the timing. long discussion. And I must emphasize that
Mr. Mulloy: Well, yes, sir. I'm going to 1 had no knowledge of what interchange oc-
answer your question now. I think those curred during the caucus at Thiokol, because
quotes derive from a single thought that may all sites were on mute. We were on mute at
have been expressed by me using some of KSC. No communications occurred between
those words. myself and Mr. Hardy at Huntsville, nor did
I have not yet encountered anyone other any communication occur between KSC and
than those at KSC who heard those words, Thiokol during that caucus.
so I don't believe they were transmitted over After Mr. Kilminster made that recom-
the net. The total context I think in which mendation, Mr. Reinartz then asked if there
those words may have been used is, there were any further comments, and to my
are currently no Launch Commit Criteria recollection there were none. There were no
[LCC] for joint temperature. What you are further comments made.
proposing to do is to generate a new Launch I then asked Mr. Kilminster to send me
Commit Criteria on the eve of launch, after a copy of his flight readiness rationale and
we have successfully flown with the existing recommendation. The conference was then
Launch Commit Criteria 24 previous times. terminated at approximately 11:15.
With this LCC, i.e., do not launch with a I have no knowledge of, as has been
temperature greater [sic] than 53 degrees, testified, of Mr. McDonald being asked to
we may not be able to launch until next sign that documentation. That would have
96
KTI ASSESSMENT OF TEMPERATURE CONCERN ON SRfl-25 C51L) LAUNCH

0 CALCULATIONS SHOW THAT SRM-25 O-RINGS WILL BE 20* COLDER THAN SRH-1S O-RINGS
0 TEMPERATURE DATA NOT CONCLUSIVE OH PREDICTING PRIMARY O-RING BLOW-BY
Q ENGINEERING ASSESSMENT IS THAT:
0 COLDER O-RINGS WILL HAVE INCREASED EFFECTIVE DUROMETER {'HARDER")

0 'HARDER' O-RINGS WILL TAKE LONGER TO "SEAT'

0 MORE GAS MAY PASS PRIMARY O-RING BEFORE THE PRIMARY SEAL SEATS
(RELATIVE TO SRM-15)

0 DEMONSTRATED SEALING THRESHOLD IS 3 TIMES GREATER THAN 0.038"


EROSION EXPERIENCED ON SRrt-15

0 IF THE PRIMARY SEAL DOES NOT SEAT/ THE SECONDARY SEAL WILL SEAT

0 PRESSURE WILL GET TO SECONDARY SEAL BEFORE-THE METAL PARTS ROTATE

0 Q-RING PRESSURE LEAK CHECK PUCES SECONDARY SEAL IN OUTBOARD


POSITION WHICH MINIMIZES SEALING TIME

0 Cm RECOMMENDS STS-51L LAUNC'H PROCEED ON 28 JANUARY 1985


0 SRJ1-25 WILL NOT BE SIGNIFICANTLY DIFFERENT FROM SRft-lS

/40E C, KLLMINSTEH. VICE PRESIDENT


-SPACE BOOSTER PROGRAMS

MOKTONTHIOKOLINC
Wasatch Division

Copy of telefax sent Kennedy and Marshall centers by Thiokol


detailing the company's final position on the January 28
launch of mission 51-L.

been unusual, because Mr. Kilminster signs sidered by the Mission Management Team
all flight readiness documentation. before deciding to proceed and that a fur-
Now, after the teleconference was com- ther periodic monitoring of that condition
plete, Mr. McDonald informed Mr. was planned. I further stated that I had been
Reinartz and me that if the Thiokol made aware of the recovery area weather
engineering concern for the effect of cold was previously and planned to place a call to Mr.
not sufficient cause to recommend not Aldrich and advise him that the weather in
launching, there were two other considera- the recovery area exceeded the Launch
tions, launch pad ice and recovery area Commit Criteria.
weather. So I stated earlier, when you asked what
I stated that launch pad ice had been con- were the Launch Commit Criteria, one of
sidered by the Mission Management them was that the recovery area weather has
Team limitations on it. The report we had, that
Chairman Rogers: Excuse me. Could you Mr. McDonald confirmed, was that we were
identify that discussion, where that took outside of those limits.
place? Now, I must point out that that is not a
Mr. Mulloy: That was after the hard Launch Commit Criteria. That is an
teleconference was completed, after Mr. advisory call, and the LCC so states that.
Kilminster made his recommendation, after It does require that we discuss the condition.
Mr. Reinartz asked are there any other com- So at about 11:30 p.m., Mr. Cecil
ments. There were no other comments on Houston established a teleconference with
the telecon from anyone. . . . Mr. Aldrich and Mr. Sestile at KSC. I in-
I stated that launch pad ice had been con- formed Mr. Aldrich that the weather in the

97
recovery area could preclude immediate chart. We had experience everywhere from
recovery of the SRBs, since the ships were 40 to 85 degrees.
in a survival mode and they were moving There then were data presented on two
back toward Cape Kennedy at about three cold gas tests at 30 degrees, where the O-
knots, and the estimate provided to us by ring was pressurized at the motor pressuriza-
Mr. Sestile was that they would be probably tion rate at 30 degrees, which would indicate
40 miles from the SRB impact area at the that an O-ring would operate before joint
time of launch, at 9:38; and then, continu- rotation at 30 degrees.
ing at three knots, it was going to be some Dr. Ride: Was that actually in a joint?
period of time before they could get back and
Mr. Mulloy: No, it is not. It is a full-scale
locate the boosters.
O-ring, full-scale groove, in a scaled test
The concern I had for that was not loss device, where the pressurize rate on that O-
of the total booster, but loss of the main ring is zero to 900 psi [pounds per square
parachutes for the booster, which are inch] in 600 milliseconds at a temperature
separated at water impact, and loss of the of 30 degrees.
frustum of the boosters, which has the
Dr. Walker: You would say, then, the O-
drogue parachute on it, which comes down
ring was qualified to a temperature of 30
separately, because with the 50 knot winds
degrees? Would that be an accurate
we had out there and with the kind of sea
statement?
states we had, by the time the recovery ships
got back out there, there was little probabili- Mr. Mulloy: The day that we were look-
ty of being able to recover those. ing at it, on the 27th, these two tests that
we did indicated that it would perform at 30
I informed Mr. Aldrich of that, and he
degrees under the motor pressurization rate
decided to proceed with the launch after that
before the joint rotated.
information. I did not discuss with Mr.
Aldrich the conversations that we had just Dr. Walker: What about, let's consider the
completed with Morton Thiokol. putty and the O-ring, because that is really
the system that responds to the pressure
Chairman Rogers: Could you explain why? surge. What temperature was the putty/O-
Mr. Mulloy: Yes, sir. At that time, and I ring system qualified to?
still consider today, that was a Level III Mr. Mulloy: The lowest that I'm aware
issue. Level III being an SRB element or an ofand we're still flushing this out, because
external tank element or Space Shuttle main this is kind of what we talked about on the
engine element or an Orbiter. There was no 27th, but the lowest that I'm aware of is the
violation of Launch Commit Criteria. There 40-degree test on one of the development
was no waiver required in my judgment at motors.
that time and still today. Dr. Walker: And, of course, during those
And we work many problems at the Or- tests the putty was modified before the test.
biter and the SRB and the External Tank The putty was not just laid up and then the
level that never get communicated to Mr. seal made. The putty was then smoothed out
Aldrich or Mr. Moore. It was clearly a Level or some attempt was made to remove the
III issue that had been resolved. volcanoes, I think.
. . . There were 27 full-scale seal tests with Mr. Mulloy: Because the horizontal
an O-ring groove damage tolerances, assembly caused that.
damage in the grooves and damage tolerance Now, there's one other significant point
on O-rings. And then there were two cold on this chart that we did discuss, that we
gas tests. didn't have the quantities on on the 27th,
And these data were presented on the and I mentioned this earlier. We have 150
night of the 27th. All of that was at ambient case segment proof tests, with a large
temperature. And then we did discuss what number of joints with a simulation of a cold
is a development qualification motor ex- O-ring. That is the 90 durometer with a
perience range, and that is shown on the .275, and that was at about 35 degrees.

98
So those are the certification data that we Mulloy at KSC summarized his assessment
kind of discussed, all of which we didn't of the data and his rationale with that data,
discuss. The two cold gas tests we did, the and I think he has testified to that.
segment proof tests we did, the development Mr. Reinartz, who was at KSC, asked me
and qualification motor test we did, as a for comment, and I stated I was somewhat
basis for understanding what we could ex- appalled, and that was referring specifically
pect to happen at colder temperatures on the to some of the data or the interpretation of
joints. some of the data that Thiokol had presented
Mr. Hardy testified as follows:20 with respect to its influence on the joint seal
performance relative to the issue under
Mr. Hardy: At the teleconference on the discussion, which specifically was the
evening of January 27, 1986, Thiokol possibility that the primary seal may take
engineering personnel in Utah reviewed longer to actuate and therefore to blow by
charts that had been datafaxed to Huntsville the primary seal. The blow-by of the
and KSC participants just prior to the begin- primary seal may be longer, and I am go-
ning of the conference. Now, I am not go- ing to elaborate on that a little further in this
ing to repeat a lot of what you have already statement.
heard, but I will give you some of my views
Then I went on to say that I supported
on the whole matter.
the assessment of data presented essentially
The presentations were professional in
as summarized by Mr. Mulloy, but I would
nature. There were numerous questions and
not recommend launch over Thiokol's
answers. There was a discussion of various
objections.
data and points raised by individuals at
Thiokol or at Marshall or at Kennedy. I Somewhere about this time, Mr.
think it was a rather full discussion. There Kilminster at Utah stated that he wanted to
were some 14 charts presented, and as has go off the loop to caucus for about five
been mentioned earlier, we spent about two, minutes. I believe at this point Mr.
two and a half hours reviewing this. To my McDonald, the senior Thiokol represen-
knowledge, anyone who desired to make a tative at KSC for this launch suggested to
point, ask a question or express a view was Mr. Kilminster that he consider a point that
in no way restrained from doing so. I think I had made earlier, that the secon-
As others have mentioned, I have heard dary O-ring is in the proper position to seal
this particular teleconference characterized if blow-by of the primary O-ring occurred.
as a heated discussion. I acknowledge that I clearly interpreted this as a somewhat
there were penetrating questions that were positive statement of supporting rationale for
asked, I think, from both, from all people launch. . . . The status of the caucus by
involved. There were various points of view Thiokol lasted some 30, 35 minutes. At
and an interpretation of the data that was Huntsville during this Thiokol caucus, we
exchanged. The discussion was not, in my continued to discuss the data presented. We
view, uncharacteristic of discussions on were off the loop, we were on mute. We were
many flight readiness issues on many around a table in small groups. It was not
previous occasions. Thiokol engineering an organized type discussion. But I did take
concluded their presentation with recom- that opportunity to discuss my assessment
mendation that the launch time be determin- and understanding of the data with several
ed consistent with flight experience to date, of my key advisors, and none of us had any
and that is the launch with the O-ring disagreement or differences in our inter-
temperatures at or greater than 53 degrees pretation of what we believed the data was
Fahrenheit. telling us with regard to the primary issue
Mr. Kilminster at Thiokol stated ... to at hand.
the best of my recollection, that with that When Thiokol came back on line, Mr.
engineering assessment, he recommended Kilminster reviewed rationale that supported
we not launch on Tuesday morning as proceeding with the launch and so
scheduled. After some short discussion, Mr. recommended.
99
Mr. Reinartz asked if anyone in the loop Dr. Lucas' testimony is as follows:22
had a different position or disagreed or
Chairman Rogers: Would you please tell
something to that effect, with the Thiokol
the Commission when you first heard about
recommendation as presented by Mr.
the problem of the O-rings and the seals in-
Kilminster. There were no dissenting
sofar as it involves launch 51-L? And I don't
responses.
want you to go way back, but go back to
The telecon was terminated shortly after,
when you first heard. I guess it was on
and I have no knowledge of any subsequent
January 27th, was it?
events or discussions between personnel at
KSC or at Thiokol on this matter. Dr. Lucas: Yes, sir. It was on the early
evening of the 27th, I think about 7:00 p.m.,
At about 5:00 a.m. on January 28, a discus- when I was in my motel room along with
sion took place among Messrs. Mulloy, Lucas, Mr. Kingsbury. And about that time, Mr.
and Reinartz in which Mulloy reported to Lucas Reinartz and Mr. Mulloy came to my room
only that there had been a discussion with Thiokol and told me that they had heard that some
over their concerns about temperature effects on members of Thiokol had raised a concern
the O-rings, and that it had been resolved in favor about the performance of the Solid Rocket
of launch. The following testimony of Mr. Mulloy Boosters in the low temperature that was an-
and Dr. Lucas recount that discussion:21 ticipated for the next day, specifically on the
General Kutyna: . . . Larry, let me follow seals, and that they were going out to the
through on that, and I am kind of aware of Kennedy Space Center to engage in a
the launch decision process, and you said telecon with the appropriate engineers back
you made the decision at your level on this at Marshall Space Flight Center in Hunts-
thing. ville and with corresponding people back at
the Wasatch division of Thiokol in Utah.
If this were an airplane, an airliner, and And we discussed it a few moments and
I just had a two-hour argument with Boe- I said, fine, keep me informed, let me know
ing on whether the wing was going to fall what happens.
off or not, I think I would tell the pilot, at
Chairman Rogers: And when was the next
least mention it.
time you heard something about that?
Why didn't we escalate a decision of this
Dr. Lucas: The next time was about 5:00
importance?
a.m. on the following morning, when I went
Mr. Mulloy: I did, sir. to the Kennedy Space Center and went to
General Kutyna: You did? the launch control center. I immediately saw
Mr. Mulloy: Yes, sir. Mr. Reinartz and Mr. Mulloy and asked
General Kutyna: Tell me what levels above them how the matter of the previous even-
you. ing was dispositioned.
Mr. Mulloy: As I stated earlier, Mr. Chairman Rogers: You had heard nothing
Reinartz, who is my manager, was at the at all in between?
meeting, and on the morning, about 5:00 Dr. Lucas: No, sir.
o'clock in the operations support room where Chairman Rogers: So from 8:00 o'clock that
we all were I informed Dr. Lucas of the con- evening until 5:00 o'clock in the morning,
tent of the discussion. you had not heard a thing?
General Kutyna: But this is not in the Dr. Lucas: It was about 7:00, I believe, sir.
launch decision chain. But for that period of time, I heard nothing
Mr. Mulloy: No, sir. Mr. Reinartz is in the in the interim. . .
launch decision chain, though. Chairman Rogers: . . . And you heard Mr.
General Kutyna: And is he the highest level Reinartz say he didn't think he had to notify
in that chain? you, or did he notify you?
Mr. Mulloy: No. Normally it would go Dr. Lucas: He told me, as I testified, when
from me to Mr. Reinartz to Mr. Aldrich to I went into the control room, that an issue
Mr. Moore. had been resolved, that there were some peo-
100
pie at Thiokol who had a concern about the Chairman Rogers: In view of the fact that
weather, that that had been discussed very you were running tests to improve the joint,
thoroughly by the Thiokol people and by the didn't the fact that the weather was so bad
Marshall Space Flight Center people, and and Reinartz had told you about the ques-
it had been concluded agreeably that there tions that had been raised by Thiokol, at
was no problem, that he had a recommen- least, didn't that cause you serious concern?
dation by Thiokol to launch and our most Dr. Lucas: I would have been concerned if
knowledgeable people and engineering talent Thiokol had come in and said, we don't think
agreed with that. So from my perspective, you should launch because we've got bad
I didn't have I didn't see that as an issue. weather.
Chairman Rogers: And if you had known Chairman Rogers: Well, that's what they
that Thiokol engineers almost to a man op- did, of course, first. That is exactly what they
posed the flight, would that have changed did. You didn't know that?
your view? Dr. Lucas: I knew only that Thiokol had
Dr. Lucas: I'm certain that it would. raised a concern.
Chairman Rogers: So your testimony is the Chairman Rogers: Did you know they came
same as Mr. Hardy's. Had he known, he and recommended against the launch, is the
would not have recommended the flight be question?
launched on that day. Dr. Lucas: I knew that I was told on the
Dr. Lucas: I didn't make a recommenda- morning of the launch that the initial posi-
tion one way or the other. But had I known tion of some members of Thiokol and I
that, I would have then interposed an ob- don't know who it was had recommended
jection, yes. that one not launch with the temperature less
Chairman Rogers: I gather you didn't tell than 53 degrees Fahrenheit.
Mr. Aldrich or Mr. Moore what Mr. Chairman Rogers: And that didn't cause
Reinartz had told you? you enough concern so you passed that in-
Dr. Lucas: No, sir. That is not the report- formation on to either Mr. Moore or Mr.
ing channel. Mr. Reinartz reports directly Aldrich?
to Mr. Aldrich. In a sense, Mr. Reinartz in- Dr. Lucas: No, sir, because I was shown a
forms me as the institutional manager of the document signed by Mr. Kilminster that in-
progress that he is making in implementing dicated that that would not be significant,
his program, but that I have never on any that the temperature would not be that it
occasion reported to Mr. Aldrich. would be that much lower, as I recall it.
Chairman Rogers: And you had subsequent
conversations with Mr. Moore and Mr. It is clear that crucial information about the
Aldrich prior to the flight and you never O-ring damage in prior flights and about the
mentioned what Mr. Reinartz had told you? Thiokol engineers' argument with the NASA
telecon participants never reached Jesse Moore
Dr. Lucas: I did not mention what Mr.
or Arnold Aldrich, the Levels I and II program
Reinartz told me, because Mr. Reinartz had
officials, or J.A. (Gene) Thomas, the Launch
indicated to me there was not an issue, that
Director for 51-L. The testimony of Aldrich
we had a unanimous position between
describes this failure of the communication system
Thiokol and the Marshall Space Flight
very aptly:23
Center, and there was no issue in his judg-
ment, nor in mine as he explained it to me. Dr. Feynman: . . . have you collected your
Chairman Rogers: But had you known, thoughts yet on what you think is the
your attitude would have been totally cause I wouldn't call it of the accident but
different? the lack of communication which we have
Dr. Lucas: Had I had the advantage at that seen and which everybody is worried about
time of the testimony that I have heard here from one level to another? . . .
this week, I would have had a different at- Mr. Aldrich: Well, there were two specific
titude, certainly. breakdowns at least, in my impression.

101
about that situation. One is the situation that Shuttle Program Management Structure
occurred the night before the launch and
leading up to the launch where there was a Level 1
significant review that has been characteriz-
i
ed in a number of ways before the Commis-
sion and the Commission's Subpanels and
1
the fact that that was not passed forward.
i
And I can only conclude what has been Johnson i Marshall
reported, and that is that the people respon- i

sible for that work in the Solid Rocket i
i
Booster project at Marshall believed that the i

concern was not of a significance that would Level II


be required to be brought forward because i
clearly the program requirements specify r
l
i
i
that critical problems should be brought for-
ward to Level II and not only to Level II Level III Level III
1
but through myself to Level I.
The second breakdown in communica-
tions, however, and one that I personally am
Level IV Level IV
concerned about is the situation of the varie-
ty of reviews that were conducted last sum-
mer between the NASA Headquarters . Institutional Chain
Organization and the Marshall Organiza- Program Chain
Level I: The associate administrator for Space Flight. Over-
tion on the same technical area and the fact sees budgets for Johnson, Marshall and Kennedy.
that that was not brought through my office Responsible for policy, budgetary and top-level
in either direction that is, it was not technical matters for Shuttle program.
Level Manager, National Space Transportation Program.
worked through by the NASA Head- Responsible for Shuttle program baseline and re-
quarters Organization nor when the Mar- quirements. Provides technical oversight on behalf
shall Organization brought these concerns of Level I.
to be reported were we involved. Level III: Program managers for Orbiter, Solid Rocket
Booster, External Tank and Space Shuttle Main
And I believe that is a critical breakdown Engine, Responsible for development, testing and
in process and I think it is also against the delivery of hardware to launch site.
documented reporting channels that the pro- Level IV: Contractors for Shuttle elements. Responsible for
design and production of hardware.
gram is supposed to operate to.
Now, it in fact did occur in that matter.
In fact, there is a third area of concern to
me in the way the program has operated.
There is yet one other way that could have
come to me, given a different program struc-
ture. I'm sure you've had it reported to you
as it has been reported to me that in August
or I think or at least at some time late in the
summer or early fall the Marshall SRB proj-
ect went forward to procure some additional
Solid Rocket Motor casings to be machined
and new configurations for testing of the
joints.
Now it turns out that the budget for that
kind of work does not come through my
Level II office. It is worked directly between
the Marshall Center in NASA Headquarters
and there again had I been responsible for

102
the budget for that sort of work, it would But if the erosion is classified as not an
have to come through me, and it would have anomaly, it then is in some other category
been clear that something was going on here and the system did not force it in that direc-
that I ought to know about. tion. None of those are very focused
And so there are three areas of answers, but they were all factors.
breakdown, and I haven't exactly answered The Commission Chairman, Mr. Rogers,
your question. But I have explained it in the asked four key officials about their knowledge of
way that I best know it and well, I can say the Thiokol objections to launch:24
a fourth thing.
Chairman Rogers: ... By way of a ques-
There was some discussion earlier about
tion, could I ask, did any of your gentlemen
the amount of material that was or was not
prior to launch know about the objections
reported on O-ring erosion in the FRRs
of Thiokol to the launch?
[Flight Readiness Reviews] and I researched
the FRR back reports and also the flight Mr. Smith [Kennedy Space Center Direc-
anomaly reports that were forwarded to my tor]: I did not.
center to my office by the SRB [Solid Mr. Thomas [Launch Director]: No, sir.
Rocket Booster] project and as was in- Mr. Aldrich [Shuttle Program Director]: I
dicated, there is a treatment of the Solid did not.
Rocket Motor O-ring erosion, I believe, for Mr. Moore [Associate Administrator for
the STS 41-C FRR, which quantifies it and Space Flight]: I did not.
indicates some limited amount of concern.
Additionally, in further testimony J.A. (Gene)
The next time that is mentioned, I believe
Thomas commented on the launch.25
it is the STS 51-E, FRR in January 1985
or early in February, and that indicates, Mr. Hotz: . . . Mr. Thomas, you are
again, a reference to it but refers back to the familiar with the testimony that this Com-
41-C as the only technical data. mission has taken in the last several days on
And then from there forward the com- the relationship of temperature to the seals
ment on O-ring erosion only is that there was in the Solid Rocket Booster?
another instance and it is not of concern. Mr. Thomas: Yes, sir, I have been here all
Clearly the amount of reporting in the week.
FRR is of concern to me, but in parallel with Mr. Hotz: Is this the type of information
that, each of the flight anomalies in the STS that you feel that you should have as Launch
program are required to be logged and Director to make a launch decision?
reviewed by each of the projects and then Mr. Thomas: If you refer to the fact that
submitted through the Level II system for the temperature according to the Launch
formal close-out. Commit Criteria should have been 53
And in looking back and reviewing the degrees, as has been testified, rather than 31,
anomaly close-outs that were submitted to yes, I expect that to be in the LCC. That
Level II from the SRB project, you find that is a controlling document that we use in most
O-ring erosion was not considered to be an cases to make a decision for launch.
anomaly and, therefore, it was not logged Mr. Hotz: But you are not really very hap-
and, therefore, there are not anomaly reports py about not having had this information
that progress from one flight to the other. before the launch?
Yet, that is another way that that infor-
Mr. Thomas: No, sir. I can assure you that
mation could have flagged the system, and
if we had had that information, we wouldn't
the system is set up to use that technique for
have launched if it hadn't been 53 degrees.
flagging.

103
Findings 3. The Commission is troubled by what ap-
1. The Commission concluded that there was pears to be a propensity of management at
a serious flaw in the decision making process Marshall to contain potentially serious problems
leading up to the launch of flight 51-L. A well and to attempt to resolve them internally rather
structured and managed system emphasizing than communicate them forward. This tendency
safety would have flagged the rising doubts about is altogether at odds with the need for Marshall
the Solid Rocket Booster joint seal. Had these to function as part of a system working toward
matters been clearly stated and emphasized in the successful flight missions, interfacing and com-
flight readiness process in terms reflecting the municating with the other parts of the system that
views of most of the Thiokol engineers and at least work to the same end.
some of the Marshall engineers, it seems likely 4. The Commission concluded that the
that the launch of 51-L might not have occurred Thiokol Management reversed its position and
when it did. recommended the launch of 51-L, at the urging
2. The waiving of launch constraints appears of Marshall and contrary to the views of its
to have been at the expense of flight safety. There engineers in order to accommodate a major
was no system which made it imperative that customer.
launch constraints and waivers of launch con-
straints be considered by all levels of
management.

Chronology of Events Related to Temperature Concerns Prior to


Launch of Challenger (STS 51-L)
Time Key Participants Event

12:36 PM (EST) NASA Project Managers and Contractor Launch Scrub. Decision is made to
January 27, 1986 Support Personnel (including Morton scrub due to high crosswinds at launch
Thiokol). site.
Approximately Same as above. Post-Scrub Discussion. All appropriate
1:00 PM (EST) personnel are polled as to feasibility to
launch again with 24-hour cycle and it
results in no SRB constraints for
launch at 9:38 AM, 28 January 1986.
Request is made for all participants
to report any constraints.
Approximately Kennedy Space Center Conversation. Wear asks Brinton if
1:00 PM (EST) (1) Boyd C. Brinton, Manager, Thiokol had any concerns about
Space Booster Project, MTI; predicted low temperatures and about
(2) Lawrence O. Wear, Manager, what Thiokol had said about cold
SRM Project Office, Marshall. temperature effects following January
1985 flight 51-C.
Morton Thiokol, Utah Brinton telephones Thompson and
(1) Arnold R. Thompson, Super- other MTI personnel to ask them to
visor, Rocket Motor Cases; determine if there were concerns based
(2) Robert Ebeling, Manager, Igni on predicted weather conditions. Ebel-
tion System and Final Assembly, ing and other engineers are notified
SRM Project. and asked for evaluation.

104
Time Key Participants Event

Approximately NASA Levels I and 11 Management With Mission Management Team Meeting.
2:00 PM (EST) Appropriate Program Managers and Con- Discussion is centered around the
tract Personnel temperature at the launch facility and
(1) Jesse W. Moore, Associate Ad- weather conditions predicted for
ministrator, Space Flight, NASA launch at 9:38 AM on 28 January
HQ, and Director, JSC; 1986.
(2) Arnold D. Aldrich, Manager,
Space Transportation Systems Pro-
gram, JSC;
(3) Lawrence B. Mulloy, Manager,
SRB Project, Marshall Space Flight
Center (MSEC);
(4) Dr. William Lucas, Director,
MSEC.

Approximately At Thiokol, Utah Boisjoly learns of cold temperatures


2:30 PM (EST) (1) R. Boisjoly, Seal Task Force, at Cape at meeting convened by
Morton Thiokol, Utah; Ebeling
(2) Robert Ebeling, Manager, Igni-
tion System and Final Assembly,
SRM Project.

Approximately At Kennedy Space Center Telephone Conversation. McDonald


4:00 PM (EST) (1) Allan J. McDonald, Director, receives call at Carver Kennedy's
SRM Project, Morton Thiokol; residence from Ebeling expressing con-
(2) Carver Kennedy, Director of cern about performance of SRB field
Vehicle Assembly Building Opera- joints at low temperatures.
tions, and Vice President of Space McDonald indicates he will call
Operations at KSC, for Morton back latest temperature predictions up
Thiokol. to launch time.
At Thiokol, Utah Carver Kennedy calls Launch
Robert Ebeling, Department Operations Center and received latest
Manager, Ignition System and Final temperature information.
Assembly, SRM Project. McDonald transmits data to Utah
and indicates will set up telecon and
asks engineering to prepare.
Approximately At Kennedy Space Center Telephone Conversation. McDonald
5:15 PM (EST) (1) Allan J. McDonald, Director, calls Cecil Houston informing him that
SRM Project, Morton Thiokol, Inc.; Morton Thiokol engineering had con-
(2) Cecil Houston, MSEC Resident cerns regarding O-ring temperatures.
Manager, at KSC. Cecil Houston indicates he will set
up teleconference with Marshall Space
Flight Center and Morton Thiokol.

105
Time Key Participants Event

Approximately At Kennedy Space Center Telephone Conversation. Cecil Houston


5:25 PM (EST) Cecil Houston, MSFC Resident calls Lovingood, informing him of the
Manager, at KSC. concerns of temperature on the O-
At Marshall Space Flight Center rings and asks him to establish a
Judson A. Lovingood, Deputy telecon with:
Manager, Shuttle Projects Office, (1) Stanley R. Reinartz, Manager,
MSFC. Shuttle Projects Office, MSFC (at
Kennedy);
(2) Lawrence B. Mulloy, Manager,
SRB Project, MSFC (at Kennedy);
(3) George Hardy, Deputy Director,
Science and Engineering (at Marshall);
(4) Thiokol Wasatch Division
personnel.
Approximately At Kennedy Space Center Telephone Conversation. Lovingood
5:30 PM (EST) Stanley R, Reinartz, Manager, Shut- calls Reinartz to inform him of
tle Projects Office, MSFC planned 5:45 PM (EST)
At Marshall Space Flight Center teleconference.
Judson A. Lovingood, Deputy Lovingood proposes that Kingsbury
Manager, Shuttle Projects Office, (Director of Science and Engineering,
MSFC. MSFC), participate in teleconference.

Approximately At Kennedy Space Center First Teleconference. Concerns regard-


5:45 PM (EST) Stanley R. Reinartz, Manager, Shut- ing temperature effects on the O-rings
tle Projects Office (MSFC). are discussed.
At Marshall Space Flight Center MTI is of the opinion launch
Judson A. Lovingood, Deputy should be delayed until Noon or
Manager, Shuttle Projects Office, afternoon.
MSFC. It is decided that another telecon at
Plus other personnel at Kennedy, Marshall, 8:15 PM will be set up to transmit the
and Thiokol, Utah. data to all of the parties and to have
more personnel involved.
Lovingood recommends to Reinartz
to include Lucas, Director, MSFC and
Kingsbury in 8:45 PM conference and
to plan to go to Level II if MTI
recommends not launching.

Approximately At Marshall Space Flight Center Telephone Conversation. Lovingood


6:30 PM (EST) Judson A. Lovingood, Deputy calls Reinartz and tells him that if
Manager, Shuttle Projects Office, Thiokol persists, they should not
MSFC. launch.
At Kennedy Space Center Lovingood also suggests advising
Stanley R. Reinartz, Manager, Shut- Aldrich, Manager, National Transpor-
tle Projects Office, MSFC. tation System (Level II), of telecon-
ference to prepare him for Level I
meeting to inform of possible recom-
mendation to delay.

106
Time Key Participants Event

Approximately At Kennedy Space Center Conversation. Reinartz and Mulloy


7:00 PM (EST) (1) Lawrence B. Mulloy, Manager, visit Lucas and Kingsbury in their
SRB Project, MSFC. motel rooms to inform them of
(2) Stanley R. Reinartz, Manager, Thiokol concern and planned
Shuttle Projects Office, MSFC; teleconference.
(3) Dr. William Lucas, Director,
MSFC;
(4) Jim Kingsbury, Director of
Science and Engineering, MSFC.

Approximately At Morton Thiokol, Utah Second Teleconference. Charts present


8:45 PM (EST) (1) Jerald Mason, Senior Vice Presi- a history of the O-ring erosion and
dent, Wasatch Operations; blow-by for the primary seal in the
(2) Calvin Wiggins, Vice President field joints, including results of
and General Manager, Space Divi- subscale tests, previous flights and
sion, Wasatch; static tests of Solid Rocket Motors.
(3) Joe C. Kilminster, Vice Presi- The data shows that the timing
dent, Space Booster Programs, function of the O-rings will be slower
Wasatch; due to lower temperatures and that the
(4) Robert K. Lund, Vice President, worst blow-by occurred on SRM 15
Engineering; (STS 51-C) in January 1985 with O-
(5) Roger Boisjoly, Member Seal ring temperatures of 53 degrees
Task Force; Fahrenheit.
(6) Arnold R. Thompson, Super- Recommendation by Thiokol
visor, Rocket Motor Cases. (Lund) is not to fly STS 51-L
At Kennedy Space Center (SRM-25) until the temperature of the
(1) Stanley R. Reinartz, Manager, O-ring reached 53 degrees Fahrenheit,
Shuttle Projects Office, MSFC; which was the lowest temperature of
(2) Lawrence B. Mulloy, Manager, any previous flight.
SRB Project, MSFC; Mulloy asks for recommendation
(3) Allan J. McDonald, Director, from Kilminster.
SRM Project, MTI. Kilminster states that based upon
At Marshall Space Flight Center the engineering recommendation, he
(1) George B. Hardy, Deputy Direc- can not recommend launch.
tor, Science and Engineering; Hardy is reported by both
(2) Judson A. Lovingood, Deputy McDonald and Boisjoly to have said
Manager, Shuttle Project Office; he is "appalled" by Thiokol's
(3) Ben Powers, Engineering Struc- recommendation.
tures and Propulsion. Reinartz comments that he is under
Plus other personnel (see table page 111). the impression that SRM is qualified
from 40 degrees Fahrenheit to 90
degrees Fahrenheit.
NASA personnel challenge conclu-
sions and recommendations.
Kilminster asks for five minutes off-
net to caucus.

107
Time Key Participants Event

Approximately Thiokol Personnel Thiokol Caucus. Caucus continues for


10:30 PM (EST) (1) Jerald Mason, Senior Vice Presi- about 30 minutes at Thiokol,
dent, Wasatch Operations; Wasatch, Utah.
(2) Joe C. Kilminster, Vice Presi- Major issues are (1) temperature ef-
dent, Space Booster Program; fects on O-ring, and (2) erosion of the
(3) Calvin Wiggins, Vice President O-ring.
and General Manager, Space Thompson and Biosjoly voice objec-
Division; tions to launch and indication is that
(4) Robert K. Lund, Vice President, Lund also is reluctant to launch.
Engineering; A final management review is con-
(5) Arnold R. Thompson, Super- ducted with only Mason, Lund,
visor, Rocket Motor Cases; Kilminster, and Wiggins.
(6) Roger Boisjoly, Member, Seal Lund is asked to put on manage-
Task Force; ment hat by Mason.
(7) Brian Russell, Special Projects, Final agreement is: (1) there is a
SRM Program Office; substantial margin to erode the
(8) Robert Ebeling, Manager, Igni- primary O-ring by a factor of three
tion System and Final Assembly, times the previous worst case, and (2)
SRM Project. even if the primary O-ring does not
Plus other personnel seal, the secondary is in position and
will.

Approximately At Kennedy Space Center Conversation at Kennedy. McDonald


10:30 PM to (1) Allan J. McDonald, Manager, continues to argue for delay.
11:00 PM (EST) Space Booster Project, Morton McDonald challenges Reinartz's ra-
Thiokol, Inc. (MTI); tionale that SRM is qualified at 40
(2) Lawrence B. Mulloy, Manager, degrees E. to 90 degrees F., and
SRB Projects, MSEC; Mulloy's explanation that Propellant
(3) Stanley R. Reinartz, Manager, Mean Bulk Temperatures are within
Shuttle Projects, MSEC; specifications.
(4) Jack Buchanan, Manager, KSC
Operations, for MTI;
(5) Cecil Houston, MSEC Resident
manager, at KSC.

Approximately Same participants as 8:45 PM Second Teleconference (Cont'd). Thiokol


11:00 PM (EST) Teleconference. indicates it had reassessed;
temperature effects are concern, but
data is inconclusive.
Kilminster reads the rationale for
recommending launch.
Thiokol recommends launch.
Hardy requests that Thiokol put in
writing their recommendation and
send it by fax to both Kennedy and
Marshall.

108
Time Key Participants Event

Approximately At Kennedy Space Center Conversation at Kennedy. McDonald


11:15 to (1) Allan J. McDonald, Manager, argues again for delay asking how
11:30 PM (EST) Space Booster Project, MTI; NASA could rationalize launching
(2) Lawrence Mulloy, Manager, SRB below qualification temperature.
Projects Office, MSFC; McDonald indicates if anything
(3) Stanley R. Reinartz, Manager, happened, he would not want to have
Shuttle Projects Office, MSFC; to explain to Board of Inquiry.
(4) Jack Buchanan, Manager, KSC McDonald indicates he would
Operations, for MTI; cancel launch since (1) O-ring problem
(5) Cecil Houston, Manager, MSFC at low temperatures; (2) booster
Resident Office at KSC. recovery ships heading into wind
toward shore due to high seas, and (3)
icing conditions on launch pad.
McDonald is told it is not his con-
cern and that his above concerns will
be passed on in advisory capacity.
Approximately Telefax. Kilminster faxes Thiokol's
11:45 PM (EST) recommendation to launch at 9:45
MST, 27 January 1986 (11:45 EST).
Fax is signed by Kilminster.
McDonald retrieves fax at KSC.
Approximately At Kennedy Space Center Teleconference. Discussion centers
11:30 PM to (1) Lawrence B. Mulloy, Manager, around the recovery ships' activities
12:00 AM (EST) SRB Projects Office, MSFC; and brief discussion of the ice issue on
(2) Stanley R. Reinartz, Manager, the launch complex area.
Shuttle Projects, MSFC; Reinartz and Mulloy place call to
(3) Arnold D. Aldrich, Manager, Na- Aldrich.
tional Space Transportation System McDonald delivers fax to Jack
Program Office, JSC. Buchanan's office at Kennedy Space
Center and overhears part of
conversation.
Aldrich is apparently not informed
of the O-ring concerns.
Approximately Kennedy Space Center meeting
12:01 AM (EST) breaks up.
January 28
Approximately At Kennedy Space Center Ice Crew Inspection of Launch Pad B.
1:30 to (1) Charles Stevenson, Supervisor of Ice crew finds large quantity of ice on
3:00 AM (EST) Ice Crew; KSC Fixed Service Structure, mobile launch
(2) B.K. Davis, Ice Team Member, platform, and pad apron; and reports
MSFC conditions.

Approximately At Kennedy Space Center Conversation. Mulloy tells Lucas of


5:00 AM (EST) (1) Lawrence B. Mulloy, Manager, Thiokol's concerns over temperature
SRB Project, MSFC; effects on O-rings and final resolution.
(2) Dr. William Lucas, Director, Lucas is shown copy of Thiokol
(MSFC); telefax.
(3) Jim Kingsbury, Director of
Science and Engineering, MSFC.

109
Time Key Participants Event
Approximately At Kennedy Space Center Ice Crew Inspection of Launch Pad B.
7:00-9:00 AM (EST) (1) Charles Stevenson, Supervisor of Ice crew inspects Launch Pad B and
Ice Crew, KSC; Challenger for ice formation.
(2) B. K. Davis, Ice Team Member, Davis measures temperatures on
MSEC. SRBs, External Tank, Orbiter, and
launch pad with infrared pyrometer.
Left-hand SRB appears to be about
25 degrees E. and right-hand SRB ap-
pears to be about 8 degrees E, near
the aft region.
Ice crew is not concerned since
there is no Launch Commit Criteria
on surface temperatures and does not
report.
Crew reports patches of sheet ice on
lower segment and skirt of left Solid
Rocket Booster
Approximately At Marshall Space Flight Center Conversation. Lovingood informs Lee
8:00 AM (EST) (1) Judson A. Lovingood, Deputy of previous night's discussions.
Manager, Shuttle Projects Office, He indicates that Thiokol had at
MSEC; first recommended not launching, and
(2) Jack Lee, Deputy Director, then after Wasatch conference recom-
MSEC. mended launching.
He also informs Lee that Thiokol is
providing in writing their recommen-
dation for launch.
Approximately NASA Levels I and Level II Management Mission Management Team Meeting.
9:00 AM (EST) With Appropriate Project Managers and Ice conditions at launch complex are
Contract Personnel. discussed. There is no apparent discus-
sion of temperature effects on O-ring
seal.
Approximately At Kennedy Space Center Ice Crew Inspection of Launch Pad B.
10:30 AM (EST) (1) Charles Stevenson, Supervisor of Ice crew inspects Launch Pad B for
Ice Crew; third time.
(2) B.K. Davis, Ice Team Member Crew removes ice from water
troughs, returns to Launch Control
Center at T-20 minutes, reports condi-
tions to Mission Management Team,
including fact that ice is still on left
Solid Rocket Booster.
11:38 AM (EST) Launch. Challenger (STS 51-L) is
launched.

110
Final Teleconference Participants

NASA Marshall Space Flight Center Morton Thiokol Wasatch Division

1. George B. Hardy, Deputy Director, Science 1. Jerald Mason, Senior Vice President,
and Engineering, MSFC Wasatch Operations, MTI
2. Judson A. Lovingood, Deputy Manager, 2. Calvin Wiggins, Vice President and General
Shuttle Projects Office, MSFC Manager, Space Division, MTI
3. Leslie F. Adams, Deputy Manager, SRB 3. Joe C. Kilminster, Vice President, Space
Project, MSFC Booster Programs, MTI
4. Lawrence O. Wear, Manager, SRM Proj- 4. Robert K. Lund, Vice President, Engineer-
ect Office, MSFC ing, MTI
5. John Q. Miller, Technical Assistant, SRM 5. Larry H. Sayer, Director, Engineering and
Project, MSFC Design, MTI
6. J. Wayne Littles, Associate Director for 6. William Macbeth, Manager, Case Projects,
Engineering, MSFC Space Booster Project Engineering, Wasatch
7. Robert J. Schwinghamer, Director, Material Division, MTI
and Processes Laboratory, MSFC 7. Donald M. Ketner, Supervisor, Gas
8. Wilbur A. Riehl, Chief, Nonmetallic Dynamics Section and Head Seal Task
Materials Division, MSFC Force, MTI
9. John P. McCarty, Deputy Director, Struc- 8. Roger Boisjoly, Member, Seal Task Force,
tures and Propulsion Laboratory, MSFC MTI
10. Ben Powers, Engineering Structures and 9. Arnold R. Thompson, Supervisor, Rocket
Propulsion Laboratory, MSFC Motor Cases, MTI
11. James Smith, Chief Engineer, SRB Pro- 10. Jack R. Kapp, Manager, Applied Mechanics
gram, MSFC Department, MTI
12. Keith E. Coates, Chief Engineer, Special 11. Jerry Burn, Associate Engineer, Applied
Projects Office, MSFC Mechanics, MTI
13. John Schell, Retired Engineer, Materials 12. Joel Maw, Associate Scientist, Heat Transfer
Laboratory, MSFC Section, MTI
13. Brian Russell, Manager, Special Projects,
Present at KSC SRM Project, MTI
14. Robert Ebeling, Manager, Ignition System
14. Cecil Houston, MSFC Resident Manager,
and Final Assembly, SRB Project, MTI
at KSC
15. Stanley R. Reinartz, Manager, Shuttle Proj-
Present at MSFC
ects Office, MSFC
16. Lawrence B. Mulloy, Manager, SRB Proj- 15. Boyd C. Brinton, Manager, Space Booster
ect, MSFC Project, MTI
16. Kyle Speas, Ballistics Engineer, MTI

Present at KSC
17. Allan J. McDonald, Director, SRM Project,
MTI
18. Jack Buchanan, Manager, KSC Operations,
MTI

111
;m$

xECS%Zr'.----i^ r ^Miit IS

f;;nfiif
Above, Shuttle 51-L on Kennedy Space Center Pad 39B in
the early morning of launch day. Temperatures were well
below freezing, as indicated by the lower left photo, which
shows thick ice in a water trough despite use of an anti-
freeze solution.
Above, foot long icicles on a lower level of the
Fixed Service Structure frame the attachment
point where the Orbiter is attached to the exter-
nal tank (arrow). Icing was even more extensive
at upper levels of the service structure (upper
right and below). At right below is a ground com
munications box (not used during launch) ren-
dered inoperable by heavy ice.

113
Ambiguities In at 4:00 a.m. Pacific Standard Time. He explained
what followed:26
The Decision Making Process
"I had gotten up and went to the support
During the night and early morning of January room to support this launch. We have peo-
28, another problem was developing due to the ple monitoring consoles, and I checked in,
extreme cold weather, predicted to be in the low and they told me there was a concern, and
20s for approximately 11 hours. Reaction con- when I arrived at about 4:30, 4:40 (PST),
trol system heaters on the Orbiter were activated I was informed we were working the prob-
and the Solid Rocket Booster recovery batteries lem with our aerodynamicist and debris peo-
were checked and found to be functioning within ple, but very importantly, we would have
specifications. There were no serious concerns to make an input to Kennedy for a meeting
regarding the External Tank. The freeze protec- scheduled at 6:00 o'clock our time and 9:00
tion plan for the launch pad was implemented, o'clock Florida time.
but the results were not what had been an- "We had approximately an hour of work
ticipated. The freeze protection plan usually in- to bring together. The work had been under-
volves completely draining the water system. way when I arrived and was continuing.
However, this was not possible because of the im- "At that time I got on the phone with my
minent launch of 51-L. In order to prevent pipes Orbiter program managers just to discuss
from freezing, a decision was made to allow water background of where we were, how things
to run slowly from the system. This had never stood, and what their concerns were local-
been done before, and the combination of freez- ly. They described what they knew in
ing temperatures and stiff winds caused large Florida, and we also in Downey did televi-
amounts of ice to form below the 240-foot level sion input, and we could see some of the ice
of the fixed service structure including the access scenes that were shown here this morning.
to the crew emergency egress slide wire baskets. "We arrived through a series of meetings
Ice also was forming in the water trays beneath to a top level discussion at approximately
the vehicle. 5:30 Pacific Standard Time, from which we
These conditions were first identified by the Ice drew the following conclusions: Ice on the
Team at approximately 2:00 a.m. on January 28 mobile launcher itself, it could be debris. We
and were assessed by management and engineer- were very concerned with debris of any kind
ing throughout the night, culminating with a Mis- at the time of launch. With this particular
sion Management Team meeting at 9:00 a.m. ice, one, could it hit the Orbiter? There was
At this meeting, representatives for the Orbiter wind blowing from the west. That appeared
prime contractor, Rockwell International, ex- not to be so, that it wouldn't hit the Orbiter
pressed their concern about what effects the ice but would land on the mobile launcher. The
might have on the Orbiter during launch. second concern was what happens to that ice
Rockwell had been alerted about the icing con- at the time you light your liquid fuel engines,
ditions during the early morning and was work- the SSMEs, and would it throw it around
ing on the problem at its Downey, California, and ricochet and potentially hit the Orbiter.
facility. "The third aspect is the one that has been
During Commission hearings, the president of discussed here of aspiration, what would
Rockwell's Space Transportation Systems Divi- happen when the large SRM [Solid Rocket
sion, Dr. Rocco Petrone, and two of his vice Motors] motors ignite and in effect suck in
presidents, Robert Glaysher and Martin Ciof- air, referred to as aspiration, and ice addi-
foletti, all described the work done regarding the tionally would come down, how much
ice conditions and the Rockwell position at the unknown.
9:00 a.m. meeting with regard to launch. Dr. "The prime thing we were concerned
Petrone had arrived at Kennedy on Friday, about was the unknown base line. We had
January 24. On Monday the 27th he left to return not launched in conditions of that nature,
to Rockwell's facility in California, but Glaysher and we just felt we had an unknown.
and Cioffoletti remained at Kennedy. Dr. "I then called my program managers over
Petrone testified that he first heard about the ice in Florida at 5:45 (PST) and said we could

114
not recommend launching from here, from cle, freefalling ice carried by the winds. So
what we see. We think the tiles would be en- we felt that ice was not a problem. However,
dangered, and we had a very short conver- it would land on the mobile launch platform.
sation. We had a meeting to go through, and That we considered a problem. We also in-
I said let's make sure that NASA under- vestigated the aspiration data base we had,
stands that Rockwell feels it is not safe and we had seen the aspiration effect on
to launch, and that was the end of my previous launches where things were pulled
conversation." into the SRB [Solid Rocket Booster] hole
Mr. Glaysher, who was at Kennedy, came to after ignition, but we had never seen
the center at approximately 7:45 a.m. EST. He anything out as far as the fixed surface
conferred with Rockwell's Chief Engineer as well tower. So we felt in fact it was an unknown.
as the Vice President of Engineering, Dr. John We did not have the data base to operate
Peller, at Rockwell's Downey plant. At 9:00 a.m., from an aspiration effect.
after the ice debris team had reported back from At the 9:00 o'clock meeting, I was asked
the pad inspection, Glaysher was asked for by Arnie Aldrich, the program manager, to
Rockwell's position on launch. He discussed give him the results of our analysis, and I
aspiration effects, the possible ricochet of ice from essentially told him what I just told you and
the fixed service structure, and what the ice felt that we did not have a sufficient data
resting on the mobile launch platform would do base to absolutely assure that nothing would
at ignition. Glaysher said he told the Mission strike the vehicle, and so we could not lend
Management Team when it met at 9:00 a.m. that our 100 percent credence, if you will, to the
the ice was an unknown condition, and Rockwell fact that it was safe to fly . . .
was unable to predict where the ice would go or I said I could not predict the trajectory
the degree of potential damage to the Orbiter that the ice on the mobile launch platform
thermal protection system if it were struck by the would take at SRB ignition.
ice. He testified that his recommendation to Chairman Rogers: But I think NASA's
NASA was:27 position probably would be that they thought
"[M]y exact quote and it comes in two that you were satisfied with the launch. Did
parts. The first one was, Rockwell could not you convey to them in a way that they were
100 percent assure that it is safe to fly which able to understand that you were not approv-
I quickly changed to Rockwell cannot assure ing the launch from your standpoint?
that it is safe to fly . . ." Mr. Cioffoletti: I felt that by telling them
Rockwell's other vice president at Kennedy, we did not have a sufficient data base and
Martin Cioffoletti, described the concern about could not analyze the trajectory of the ice,
ice in a slightly different manner:28 I felt he understood that Rockwell was not
giving a positive indication that we were for
Mr. Cioffoletti: Similarly, I was called in the launch.
and told about the problem and came into
the 6:00 o'clock meeting which you heard After Cioffoletti's testimony at the Commission
about a few minutes ago, and at the conclu- hearings, Dr. Petrone was pressed for a more de-
sion of that meeting I spoke with Mr. Dick tailed description of Rockwell's launch recom-
Kohrs, the deputy program manager from mendation:29
Johnson Space Flight Center, and he asked General Kutyna: Dr. Petrone, you've got
if we could get the Downey folks to look at a lot more experience than I have in this
the falling ice and how it might reverse business, but the few launch conferences that
toward the vehicle, and also, did we have 1 have been on the question is very simple.
any information on aspiration effects. Are you go or are you no-go for launch, and
So I did call back to Downey and got the " maybe " isn't an answer. I hear all kinds
John Peller folks working on that problem, of qualifications and cautions and considera-
and they did, as you saw from Charlie tions here.
Stevenson's sketches, predict that the ice Did someone ask you are you go or no-
would travel only about halfway to the vehi- go? Was that not asked?

115
Dr. Petrone: At this particular meeting, as stand my concerns. And I just repeated the
far as and I was not in Florida, and so I same concerns. And he asked, "Did I think
cannot answer that. It had been done at that it was likely that the vehicle would take
earlier meetings. This was a technical safety critical damage?"
evaluation of a series of problems, and we And I said, "From the possibility that the
talked about debris hitting the TPS [ther- vehicle would take safety critical damage,"
mal protection system] and the tiles, and the I said, "there's a probability in a sense that
long series of reviews that we had done that it was probably an unlikely event, but I
morning and all led us to a conclusion that could not prove that it wouldn't happen ..."
they were not safe to fly. ... I never used the words "no-go" for
And we transmitted that to program launch. I did use the words that we cannot
managers along with the technical evalua- prove it is safe. And normally that's what we
tion quickly of why we had arrived at that. were asked to do. We were unable to do that
So much of it is how the question gets rais- in this particular case, although it was a
ed because earlier we had aspiration work, strange case, that we normally don't get in-
ricochet work, a number of things which we volved in.
did, and then we came up with our
recommendation. Arnold Aldrich, NASA Mission Management
Team Leader, described NASA's view of the ice
Chairman Rogers: And your recommenda- situation and his recollection of Rockwell's posi-
tion now you say it was, it was unsafe to fly? tion. He said that on Tuesday morning the mis-
sion management team did a detailed analysis of
Dr. Petrone: Correct, sir. the ice on the fixed service structure. Represent-
atives from the ice team, Rockwell, and the direc-
Two things are apparent from the Rockwell
tors of Engineering (Horace Lamberth) and the
testimony. First, Rockwell did not feel it had suf-
Orbiter project (Richard Colonna) all considered
ficient time to research and resolve the ice on the
the problem. Aldrich reported this discussion as
pad problem. Second, even though there was con-
follows:32
siderable discussion about ice, Rockwell's posi-
tion on launch described above was not clearly "Following the discussion of the accept-
communicated to NASA officials in the launch ability of the ice threat to the Orbiter, based
decision chain during the hours preceding 51-L's upon the conditions described in detail of the
launch. fixed service structure and some of that
At a meeting with Commission investigators you've seen here portrayed well this morn-
on March 4, 1986, at Kennedy, Horace ingI asked the NASA managers involved
Lamberth, NASA director of Shuttle Engineer- for their position on what they felt about the
ing, said he did not interpet Rockwell's position threat of that to the Orbiter.
at the 9:00 a.m. Mission Management Team "Mr. Lamberth reported that KSC [Ken-
meeting on January 28 as being "no-go." nedy Space Center] engineering had
Lamberth said the the language used by Rockwell calculated the trajectories, as you've heard,
was "we can't give you 100 percent assurance" but of the falling ice from the fixed service struc-
there was no feeling in his mind that Rockwell ture east side, with current 10-knot winds
was voicing a no-go recommendation. "It just at 300 degrees, and predicted that none of
didn't come across as the normal Rockwell no- this ice would contact the Orbiter during its
go safety of flight issues come across."30 This con- ignition or launch sequence; and that their
clusion is confirmed in part by an interview of calculations even showed that if the winds
Dr. John Peller, Rockwell's Vice President of would increase to 15 knots, we still would
Engineering, who was assigned the ice problem not have contact with the Orbiter.
early Tuesday morning. Dr. Peller, in describ- "Mr. Colonna, Orbiter project manager,
ing a telephone conversation with the Johnson reported that similar calculations had been
Director of Engineering, Tom Moser, stated:31 performed in Houston by the mission
evaluation team there. They concurred in
Dr. Peller: That was a call from Tom Moser this assessment. And further, Mr. Colonna
to me, in which he asked again to under- stated that, even if these calculations were
116
significantly in error, that it was their belief quantifiable, risk. Mr. Glaysher did not ask
that falling ice from the fixed service struc- or insist that we not launch, however.
ture, if it were in fact to make its way to the "At the conclusion of the above review, I
Orbiter, it would only be the most felt reasonably confident that the launch
lightweight ice that was in that falling should proceed."
stream, and it would impact the Orbiter at
In addition to Rockwell's input, Mr. Aldrich
a very oblique angle.
also had reports from other contractors and the
"Impacts of this type would have very low ice, frost and debris team at the 9:00 session. Ice
probability of causing any serious damage on the vehicle assembly appeared to be of no con-
to the Orbiter, and at most would result in cern; sheet ice in the noise suppression trays had
post-flight turnaround repairs. been broken up and removed; as previously noted
"At this point I placed a phone call to Mr. the ice team reported that there was ice on the
Moser that I had previously mentioned, fixed service structure between 95 feet above
director of Engineering at the Johnson Space ground and 215 feet; no ice above 255 feet. The
Center, who was in the mission evaluation north and west sides had large amounts of ice and
room, and he confirmed the detailed agree- icicles. The final assessment was made that the
ment with Mr. Lamberth's and Mr. Colon- ice on the fixed service structure would not strike
na's position. . . . or damage the Orbiter tiles or the vehicle
"And both Mr. Lamberth and Mr. assembly during ignition or ascent, owing to the
Colonna reported that their assessment was considerable horizontal distance between the serv-
that the time it took for the ice to fall, to hit ice structure and the vehicle assembly. The deci-
the Orbiter and to rebound, and the loca- sion was made to launch pending a final ice team
tion of the fixed service structure on the review of the launch complex in order to assess
MLP [mobile launch platform] would not any changes in the situation. This inspection was
cause that ice in their view to be a concern completed following the Mission Management
to rebound and come up and impact the rear Team meeting and the ice team report indicated
end of the Orbiter. no significant change.
"Following these discussions, I asked for
Findings
a position regarding proceeding with the
The Commission is concerned about three
launch. Mr. Colonna, Mr. Lamberth, and
aspects of the ice-on-the-pad issue.
Mr. Moser all recommended that we
1. An analysis of all of the testimony and in-
proceed.
terviews establishes that Rockwell's recommen-
"At that time, I also polled Mr. Robert dation on launch was ambiguous. The Commis-
Glaysher, the vice president, Orbiter proj- sion finds it difficult, as did Mr. Aldrich, to con-
ect manager, Rockwell International STS clude that there was a no-launch recommenda-
Division, and Mr. Marty Cioffoletti, Shut- tion. Moreover, all parties were asked specifically
tle Integration Project Manager, Rockwell to contact Aldrich or Moore about launch objec-
International STS Division. Mr. Glaysher tions due to weather. Rockwell made no phone
stated and he had been listening to this en- calls or further objections to Aldrich or other
tire discussion and had not been directly in- NASA officials after the 9:00 Mission Manage-
volved with it, but had been party to this the ment Team meeting and subsequent to the
whole time. resumption of the countdown.
"His statement to me as best I can 2. The Commission is also concerned about
reconstruct it to report to you at this time the NASA response to the Rockwell position at
was that, while he did not disagree with the the 9:00 a.m. meeting. While it is understood that
analysis that JSC [Johnson Space Center] decisions have to be made in launching a Shut-
and KSC had reported, that they would not tle, the Commission is not convinced Levels I and
give an unqualified go for launch as ice on II appropriately considered Rockwell's concern
the launch complex was a condition which about the ice. However ambiguous Rockwell's
had not previously been experienced, and position was, it is clear that they did tell NASA
thus this posed a small additional, but un- that the ice was an unknown condition. Given

117
the extent of the ice on the pad (see photos pages
112 and 113), the admitted unknown effect of the
Solid Rocket Motor and Space Shuttle Main
Engines ignition on the ice, as well as the fact that
debris striking the Orbiter was a potential flight
safety hazard, the Commission finds the decision
to launch questionable under those circum-
stances. In this situation, NASA appeared to be
requiring a contractor to prove that it was not
safe to launch, rather than proving it was safe.
Nevertheless, the Commission has determined
that the ice was not a cause of the 51-L accident
and does not conclude that NASA's decision to
launch specifically overrode a no-launch recom-
mendation by an element contractor.
3. The Commission concluded that the freeze
protection plan for launch pad 39B was inade-
quate. The Commission believes that the severe
cold and presence of so much ice on the fixed serv-
ice structure made it inadvisable to launch on the
morning of January 28, and that margins of safety
were whittled down too far.
Additionally, access to the crew emergency
slide wire baskets was hazardous due to ice con-
ditions. Had the crew been required to evacuate
the Orbiter on the launch pad, they would have
been running on an icy surface. The Commis-
sion believes the crew should have been made
aware of the situation, and based on the
seriousness of the condition, greater considera-
tion should have been given to delaying the
launch.

118
References
1
NASA Program Directive Shuttle FRR, September 26, 1983,
Appendix K, Volume I.
2
Shuttle Projects Flight Readiness Review Mission 51-L,
January 9, 1986.
3
STS 51-L Flight Readiness Review, Solid Rocket Booster,
January 15, 1986.
4
STS 51-L Flight Readiness Review.
5
Commission Hearing Transcript, Mav 2, 1986, pages
2610-2611.
6
Commission Interview Transcript, Ebeling, R., March 19,
1986, page 13.
7
Commission Hearing Transcript, February 25, 1986, pages
1264-1268.
8
Commission Hearing Transcript, Februarv 26, 1986, pages
1694-1697 and 1681.
9
Commission Hearing Transcript, February 25, 1986, pages
1412-1417,
10
Commission Hearing Transcript, February 25, 1986, pages
1268-1271.
11
Commission Hearing Transcript, Februarv 14, 1986, pages
1078-1080.
12
Commission Hearing Transcript, February 25, 1986, pages
1346-1347.
13
Commission Hearing Transcript, February 25, 1986, pages
1418-1422.
14
Commission Interview Transcript, Lund, R., April 1, 1986,
pages 37-53.
15
Commission Hearing Transcript, Februarv 25, 1986, pages
1456-1457.
16
Commission Inten'iew Transcript, Mason, J., April 2, 1986,
pages 24-26.
17
Commission Hearing Transcript. Februarv 14, 1986, pages
1234-1236.
18
Commission Hearing Transcript, February 26, 1986, pages
1537-1541.
19
Commission Hearing Transcript, February 26, 1986, pages
1553-1566 and 1560-1563.
20
Commission Hearing Transcript, Februarv 26, 1986, pages
1598-1601.
21
Commission Hearing Transcript, February 26, 1986, pages
1588-1589.
22
Commission Hearing Transcript, February 27, 1986, pages
1867-1868 and 1876-1879.
23
Commission Hearing Transcript, April 3, 1986, pages
2538-2541.
24
Commission Hearing Transcript, February 27, 1986, page
1899.
25
Commission Hearing Transcript, February 27, 1986, pages
1932-1933.
26
Commission Hearing Transcript, February 27, 1986, pages
1798-1800.
27
Ibid, page 1802.
28
Ibid, pages 1803-1806.
29
Ibid, pages 1806 and 1807.
30
Commission Work Session, Pre-Launch, March 4, 1986,
page 75.
31
Commission Interview Transcript, Peller, J., April 10, 1986,
pages 13-14.
32
Commission Hearing Transcript, Februarv 27, 1986, pages
1833-1836.

119
Chapter VI

An Accident
Rooted in History

Early Design
The Space Shuttle's Solid Rocket Thiokol's three competitors were Aerojet Solid
Booster problem began with the Propulsion Co., Lockheed Propulsion Co. and
faulty design of its joint and increased United Technologies. The Source Evaluation
as both NASA and contractor man- Board on the proposals rated Thiokol fourth
agement first failed to recognize it as a problem, under the design, development and verification
then failed to fix it and finally treated it as an factor, second under the manufacturing, refur-
acceptable flight risk. bishment and product support factor and first
Morton Thiokol, Inc., the contractor, did not under the management factor.5
accept the implication of tests early in the pro- Thiokol received the second highest overall
gram that the design had a serious and unan- Mission Suitability score, tied with United
ticipated flaw.1 NASA did not accept the judg- Technologies.6
ment of its engineers that the design was unac-
In a December 12, 1973, report, NASA selec-
ceptable, and as the joint problems grew in tion officials said Thiokol's "cost advantages were
number and severity NASA minimized them in substantial and consistent throughout all areas
management briefings and reports.2 Thiokol's
evaluated."7 They also singled out Thiokol's joint
stated position was that "the condition is not design for special mention.
desirable but is acceptable."3
Neither Thiokol nor NASA expected the rub- "The Thiokol motor case joints utilized dual
ber O-rings sealing the joints to be touched by O-rings and test ports between seals, enabling a
hot gases of motor ignition, much less to be par- simple leak check without pressurizing the entire
tially burned. However, as tests and then flights motor," the officials' report said. "This innovative
confirmed damage to the sealing rings, the reac- design feature increased reliability and decreas-
tion by both NASA and Thiokol was to increase ed operations at the launch site, indicating good
attention to low cost (design, development, testing
the amount of damage considered "acceptable."
At no time did management either recommend and engineering) and production."8
a redesign of the joint or call for the Shuttle's "We noted that the [NASA Source Selection]
grounding until the problem was solved. board's analysis of cost factors indicated that
Thiokol was selected to receive the NASA con- Thiokol could do a more economical job than any
tract to design and build the Solid Rocket of the other proposers in both the development
Boosters on November 20, 1973.4 The booster and the production phases of the program; and
was the largest Solid Rocket Motor ever produced that, accordingly, the cost per flight to be ex-
in the United States; it was also the first solid pected from a Thiokol-built motor would be the
motor program managed by NASA's Marshall lowest," the officials said. "We, therefore, conclud-
Space Flight Center in Huntsville, Alabama. ed that any selection other than Thiokol would
Costs were the primary concern of NASA's give rise to an additional cost of appreciable
selection board, particularly those incurred early size."9
in the program. The Selection officials said they "found no other

120
factors bearing upon the selection that ranked in
Comparison of Original
weight with the foregoing." Design to Design Used
Cost consideration overrode any other objec-
tions, they decided. "We concluded that the main
criticisms of the Thiokol proposal in the Mission
Suitability evaluation were technical in nature,
were readily correctable, and the costs to correct
did not negate the sizable Thiokol cost advan-
tage," the selection officials concluded.
The cost-plus-award-fee contract, estimated to
be worth $800 million, was awarded to Thiokol.
Original design with
The design of the Shuttle Solid Rocket Booster Face Seal and Bore Seal
was primarily based on the Air Force's Titan III
solid rocket, one of the most reliable ever pro-
duced. Thiokol hoped to reduce new design prob-
lems, speed up the development program and cut
costs by borrowing from the Titan design. In
Thiokol's Solid Rocket Motor proposal, the rocket
fuel is contained in four forged steel cases which
Design used with
are stacked one on top of the other. The casings Double Bore Seal
were connected by a circumferential tang and
clevis, as were the Titans.10
Figure 1
Despite their many similarities, the Thiokol
Solid Rocket Booster and the Titan motors had
some significant design differences. For example,
the joints of the Titan were designed so that the Rocket Motor joint had two O-rings, the second
insulation of one case fits tightly against the in- to provide a backup in case the primary seal
sulation of the adjacent case to form a more gas- failed.
tight fit than the Thiokol design. One O-ring bore Asbestos-filled putty was used in the Solid
seal was used in each Titan joint to stop any hot Rocket Motor to pack the space between the two
gas pressure that might pass by the insulation case segments to prevent O-ring damage from the
overlap,11 but in the Titan design the O-ring was heat of combustion gases.12 Thiokol believed the
able but not intended to take the brunt of the putty was plastic, so when acted on by the com-
combustion pressure. In contrast, the Thiokol O- bustion pressure at the motor's ignition the put-
rings were designed to take the brunt of the com- ty flow towards the O-ring would compress the
bustion pressure, with no other gas barriers pres- air in the gap between the putty and the primary
ent except an insulating putty. Also, the Solid O-ring.13 The compressed air, in turn, would

121
cause the primary O-ring to extrude into the gap been a larger rocket motor to our knowledge
between the clevis and the tang, behind the that was assembled (horizontally)".20
primary O-ring groove, thereby sealing the open-
Because of the extremely tight tolerances in the
ing. If the primary O-ring did not seal, the in- joints caused by horizontal assembly, Mclntosh
tent was that the secondary would pressurize and
noted, "We . . . put the bore seals in there, and
seal the joint by extruding into the gap behind
we opened the tolerance in the gaps slightly to
its groove.14
accommodate that."21 To tighten the joint's fit and
Another difference in the Solid Rocket Motor to increase the squeeze in the O-rings to compen-
and the Titan was that the tang portion of the sate for the larger tolerances, Thiokol subsequent-
Thiokol joint was longer in order to accommodate ly put thin metal shims between the outer walls
two O-rings instead of one. It was more suscep- of the tang and clevis.
tible to bending under combustion pressure than Another significant feature of the Thiokol
the Titan joint, as post-design tests and later flight design was a vent, or port, on the side of the
experience demonstrated.15 motor case used after assembly to check the seal-
The initial Thiokol design proposal was ing of the O-rings. As will be noted later, this leak
changed before the production motors were check eventually became a significant aspect of
manufactured. Originally, the joint seal design the O-ring erosion phenomenon.22
incorporated both a face seal and a bore seal.16 The manufacture of the O-rings themselves
(Figure 1.) However, the motor that was even- constituted another difference between the Titan
tually used had double bore O-rings. The original and the Thiokol Solid Rocket Motor. While both
bore seal/face seal design was chosen because it O-rings were Viton rubber, the Titan O-rings
was anticipated that it "provides [better] redun- were molded in one piece. The Solid Rocket
dance over a double bore ring seal since each is Motor O-rings were made from sections of rub-
controlled by different manufacturing tolerances, ber O-xing material glued together. The specifica-
and each responds differently during joint tions allowed five such joints, a number chosen
assembly."17 Because the early design incor- arbitrarily, and the vendor routinely made repairs
porated tolerances similar to the Titan and it also of voids and inclusions after getting the material
incorporated a face seal, Thiokol believed it supplies. Only surface inspections were per-
possessed "complete, redundant seal capability." 18 formed by Thiokol and by the manufacturer.
Nevertheless, as the Solid Rocket Motor pro- Finally, unlike the Titan, the Thiokol Solid
gram progressed, Thiokol with NASA's Rocket Motor was designed for multiple firings.
concurrence dropped the face/bore seal design To reduce program costs, each Thiokol motor
for one using a double bore seal (Figure 1). NASA case for the Shuttle was to be recovered after flight
engineers at Marshall said the original design and reused up to 20 times.23
would have required tapered pins to maintain
necessary tolerances and assure enough "squeeze" Early Tests
on the face-sealing O-ring.19 However, design
analysis determined that motor ignition would Thiokol began testing the Solid Rocket Motor
create tension loads on the joint sufficient to cause in the mid-1970's. One of the early important tests
the tapered pins to pop out. Solving that would was a 1977 "hydroburst test."24
have meant designing some type of pin-retainers. Its purpose was to test the strength of the steel
Moreover, the rocket assembly was much easier cases by simulating a motor firing. The case was
with the dual bore seals. Because inspections and pressurized with water to about one and one-half
tests had to be conducted on the Solid Rocket times the pressure of an ignited motor (about
Motor stack, horizontal assembly was required. 1,500 pounds per square inch) to make certain
Thiokol engineer, Howard Mclntosh, described the case had adequate structural margin.25 Also,
this in a Commission interview on April 2, 1986: to measure the pressure between the O-rings,
engineers attached instruments to the leak test
"We were concerned very much about the port at a segment joint. Although the test was suc-
horizontal assembly that we had to do to do cessful in that it demonstrated the case met
the static tests. The Titan had always been strength requirements, test measurements showed
assembled vertically, and so there had never that, contrary to design expectations, the joint

122
tang and inside clevis bent away from each other cause excessive joint clearance resulting in seal
instead of toward each other and by doing so leakage. Eccentric tang/clevis interface can cause
reduced instead of increased pressure on the O-ring extrusion when case is pressurized." Ray
O-ring in the milliseconds after ignition.26 This recommended a "redesign of the tang and reduce
phenomenon was called "joint rotation." Testi- tolerance on the clevis" as the "best option for a
fying before the Commission, Arnold Thompson, long-term fix." 29
Thiokol's supervisor of structures, said, After Ray's 1977 report, John Q. Miller, chief
"We discovered that the joint was open- of the Solid Rocket Motor branch at Marshall,
ing rather than closing as our original signed and sent a memorandum on January 9,
analysis had indicated, and in fact it was 1978 to his superior, Glenn Eudy, describing the
quite a bit. I think it was up to 52 one- problems evident in the Solid Rocket Motor joint
thousandths of an inch at that time, to the seal. "We see no valid reason for not designing
primary O-ring."27 to accepted standards," the memo said, and it em-
phasized that proper sealing of the joint by use
Thiokol reported these initial test findings to of shims to create necessary O-ring pressure was
the NASA program office at Marshall. Thiokol "mandatory to prevent hot gas leaks and resulting
engineers did not believe the test results really catastrophic failure."30
proved that "joint rotation" would cause signifi- One year later, not having received a response
cant problems,28 and scheduled no additional tests to his 1978 memo, Miller signed and forwarded
for the specific purpose of confirming or disprov- a second memo strenuously objecting to Thiokol's
ing the joint gap behavior. Solid Rocket Motor joint seal design. This memo,
dated January 19, 1979, opened with: "We find
Design Objections the Thiokol position regarding design adequacy
of the clevis joint to be completely unaccept-
Reaction from Marshall to the early Solid able. . . ."31 The memorandum made three prin-
Rocket Motor test results was rapid and totally cipal objections to Thiokol's joint design. The first
opposite of Thiokol's. In a September 2, 1977 was the "large sealing surface gap created by ex-
memorandum, Glenn Eudy, Marshall's Chief tensive tang/clevis relative movement." The
Engineer of the Solid Rocket Motor Division, in- memo said this movement, the so-called "joint
formed Alex McCool, Director of the Structures rotation," caused the primary O-ring to extrude
and Propulsion Laboratory, that the assembly of into the gap, "forcing the seal to function in a way
a developmental motor provided early indications which violates industry and government O-ring
that the Thiokol design: application practices."32 Moreover, joint rotation
allowed the secondary O-ring to "become com-
"Allowed O-ring clearance. . . . Some
pletely disengaged from its sealing surface on the
people believe this design deficiency must be
tang." Finally, the memorandum noted that
corrected by some method such as shimming
although Thiokol's contract required all high
and perhaps design modification to the case
pressure case seals to be verifiable, "the clevis joint
joint for hardware which has not been final
secondary O-ring seal has been verified by tests
machined. . . . I personally believe that our
to be unsatisfactory."33 A copy of the second
first choice should be to correct the design
memorandum was sent to George Hardy, then
in a way that eliminates the possibility of O-
Solid Rocket Booster project manager at Mar-
ring clearance. . . . Since this is a very
shall. Thiokol apparently did not receive copies
critical SRM issue, it is requested that the
of either Miller memorandum, and no reply from
assignment results be compiled in such a
Eudy to Miller has been found.
manner as to permit review at the S&E
The Commission has learned that Leon Ray
Director's level as well as project manager."
actually authored the Miller memos to Eudy,
After seeing the data from the September 1977 although Miller signed them and concurred in the
hydroburst test, Marshall engineer Leon Ray objections raised.34 During February, 1979, Ray
submitted a report entitled "Solid Rocket Motor also reported on a visit he made to two O-ring
Joint Leakage Study" dated October 21, 1977. manufacturers the Precision Rubber Products
It characterizes "no change" in the Thiokol design Corporation at Lebanor Tennessee, and the
as "unacceptable" "tang can move outboard and Parker Seal Co. at Lexington, Kentucky.35 Eudy
123
accompanied Ray on the Precision visit. The pur- 1980 again were demonstrating that inner tang/
pose of the trips was to give the manufacturers clevis relative movement was greater than orig-
the data on the O-ring experiences at Thiokol and inally predicted.39 Thiokol continued to ques-
to "seek opinions regarding potential risks in- tion the validity of these joint rotation measure-
volved," Ray wrote in a February 9, 1979, memo ments and their effect on the availability of the
describing the visit. Officials at Precision did secondary O-ring.
"voice concern for the design, stating that the In 1980, NASA empanelled a Space Shuttle
Solid Rocket Motor O-ring extrusion gap was Verification/Certification Committee to study the
larger than that covered by their experience," Ray flight worthiness of the entire Shuttle system. A
reported. "Their first thought was that the O-ring subdivision of that group, the Propulsion Com-
was being asked to perform beyond its intended mittee, met with NASA Solid Rocket Motor pro-
design and that a different type of seal should be gram personnel and raised several concerns about
.considered," Ray added.36 the joint design.40 The Committee pointed out
During the Commission hearing on May 2, that the booster's leak test pressurized the primary
1986, Ray was asked why the 1978 and 1979 O-ring in the wrong direction so that the motor
memoranda were written: ignition would have to move the ring across its
groove before it sealed. The Committee added
Mr. Ray: The reason they were written was
that the effect of the insulation putty was not cer-
as a result of test data that we had, and I
tain. Redundancy of the O-rings was also listed
have to go back to, I guess, a little bit fur-
as a verification concern. The same report, how-
ther back in time than these memos. When
ever, said "the Committee understands from a
the joint was first designed, the analysis pro-
telecon that the primary purpose of the second
duced by Thiokol says the joint would close,
O-ring is to test the primary and that redundan-
the extrusion gap would actually close.
cy is not a requirement." George Hardy testified
We had quite a debate about that until we
that the Committee's statement conflicted with his
did a test on the first couple of segments that
understanding:
we received from the manufacturer, which
in fact showed that the joint did open. Later "The discussion there or the reference
on we did some tests with the structural test there to a telecon and I don't know who
article, and this is mentioned in the memo that was with that implies there was no in-
as STA-1 [Structural Test Article]. tent for the joint to be redundant is totally
At that time, we really nailed it down. We foreign to me. I don't know where they
got some very accurate numbers on joint would have gotten that information because
rotation, and we know for a fact that dur- that was the design requirement for the
ing these tests that, just what the memo says, joint."41
the joint rotated. The primary O-ring was
extruded up into the joint. The secondary In May 1980, the Verification/Certification
O-ring did in fact detach from the seat.37 Committee recommended that NASA conduct
full-scale tests to verify the field joint integrity,
No records show Thiokol was informed of the including firing motors at a mean bulk propellant
visits, and the O-ring design was not changed.
temperature range of 40-90 degrees Fahrenheit.
Thiokol's phase 1 certification review on March
The panel also asked NASA to:
23, 1979, mentioned leak check failures, and
forces during case joint assembly that resulted in "Perform case burst test with one O-ring
clevis O-ring grooves not conforming with tang removed. During the burst test for final
sealing surfaces. However, this was not listed as verification of the motor case safety factor,
a problem or a failure.38 one of the two O-rings failed by extrusion
and leaked. The analysis used for additional
verification did not include further gap open-
Verification and ings caused by joint deflection at pressuriza-
Certification Committee tion or any deflections caused by bending
loads. The panel considers the above to be
While Ray was warning of problems with joint inadequate to provide operational program
rotation, static motor tests in July 1978 and April reliability, and marginal to provide adequate
124
safety factor confidence on [Shuttle flight] percent of maximum expected operating
one. '42 pressure."
The NASA program response to these issues When asked about the text of the 1980
was included in the final Committee report in Criticality 1R classification, Arnold Aldrich,
September 1980. It said that the original NASA Manager of the National Space Transpor-
hydroburst tests and the lightweight case tests, tation System, said,
being conducted at the time, satisfied the intent
"The way that . . . language [reads], I
of the Committee's recommendations. Moreover,
would call it [criticality] I."45
the response stated: "NASA specialists have
reviewed the field joint design, updated with Notwithstanding this apparent contradiction in
larger O-rings and thicker shims and found the the classification 1R and the questionable status
safety factors to be adequate for the current of the secondary described in the text of the CIL,
design. Re-analysis of the joint with larger O- the joint carried a 1R classification from
rings and thicker shims is being accomplished as November 1980 through the flight of STS-5
part of the lightweight case program. . . . The (November 1982).
joint has been sufficiently verified with the testing The Space Shuttle first flew on April 12-14,
accomplished to date (joint lab tests, structural 1981. After the second flight, STS-2, in Novem-
test article, and seven static firings and the two ber 1981, inspection revealed the first in-flight
case configuration burst tests) and currently erosion of the primary O-ring.46 It occurred in
scheduled for lightweight case program."43 the right Solid Rocket Booster's aft field joint and
was caused by hot motor gases.47 The damage
to the ring proved to be the worst ever found on
Criticality Classification a primary O-ring in a field joint on any recovered
Solid Rocket Booster.48 Post-flight examination
and Changes found an erosion depth of .053 inches on the
primary O-ring; nonetheless, the anomaly was
The Solid Rocket Motor certification was not reported in the Level I Flight Readiness
deemed satisfactory by the Propulsion Commit- Review for STS-3 held on March 9, 1982. Fur-
tee of the Verification/Certification Group on
thermore, in 1982 the STS-2 O-ring erosion was
September 15, 1980. Shortly thereafter, on not reported on the Marshall problem assessment
November 24, 1980, the Solid Rocket Booster system and given a tracking number as were other
joint was classified on the Solid Rocket Booster flight anomalies.49
Critical Items List as criticality category 1R.
In mid-1982, two significant developments
NASA defines "Criticality 1R" as any subsystem
took place. Because Thiokol believed blow holes
of the Shuttle that contains "redundant hardware, in the insulating putty were a cause of the ero-
total element failure of which could cause loss of sion on STS-2,50 they began tests of the method
life or vehicle."44 The use of "R", representing of putty layup and the effect of the assembly of
redundancy, meant that NASA believed the
the rocket stages on the integrity of the putty. The
secondary O-ring would pressurize and seal if the
manufacturer of the original putty, Fuller-
primary O-ring did not. Nonetheless, the 1980 O'Brien, discontinued the product and a new put-
Critical Items List (CIL) states: ty, from the Randolph Products Company, was
"Redundancy of the secondary field joint tested and selected in May 1982.51 The new Ran-
seal cannot be verified after motor case dolph putty was eventually substituted for the old
pressure reaches approximately 40 percent putty in the summer of 1983, for the STS-8 Solid
of maximum expected operating pressure. Rocket Motor flow.52
It is known that joint rotation occurring at A second major event regarding the joint seal
this pressure level with a resulting enlarged occurred in the summer of 1982. As noted before,
extrusion gap causes the secondary O-ring in 1977-78, Leon Ray had concluded that joint
to lose compression as a seal. It is not known rotation caused the loss of the secondary O-ring
if the secondary O-ring would successfully as a backup seal. Because of May 1982 high
reseal if the primary O-ring should fail after pressure O-ring tests and tests of the new
motor case pressure reaches or exceeds 40 lightweight motor case, Marshall management

125
finally accepted the conclusion that the secondary only one O-ring is acting" [emphasis
O-ring was no longer functional after the joints added].54
rotated when the Solid Rocket Motor reached 40
percent of its maximum expected operating The retention rationale for the "simplex" or
pressure. It obviously followed that the dual CD- single O-ring seal was written on December 1,
rings were not a completely redundant system, 1982, by Howard Mclntosh, a Thiokol engineer.55
so the Criticality 1R had to be changed to Crit- This document gave the justification for flight
icality I.53 This was done at Marshall on with the single functional O-ring. It reported that
December 17, 1982. The revised Critical Items tests showed the Thiokol design should be re-
List read (See pages 157 and 158): tained, citing the Titan history, the leak and
hydroburst tests, and static motor firings as
"Criticality Category 1. . . . justification. However, it also contained the
"Failure Mode and Causes: Leakage at case following rationale which appeared to conflict
assembly joints due to redundant O-ring seal with the Criticality 1 classification that the sec-
failures or primary seal and leak check port ondary O-ring was not redundant:
O-ring failure.
"Initial information generated in a light-
"Note: Leakage of the primary O-ring seal is weight cylinder-to-cylinder proof test shows
classified as a single failure point due to possibili- a total movement of only .030 inch at 1,004
ty of loss of sealing at the secondary O-ring because pounds per square inch, gauge pressure in
of joint rotation after motor pressurization. the center joint. This . . . indicates that the
"Failure Effect Summary: Actual Loss Loss tang-to-clevis movement will not unseat the
secondary O-ring at operating pressures."56
of mission, vehicle and crew due to metal erosion,
burn through, and probable case burst resulting in Testimony in hearings and statements given
fire and deflagration. . . . in Commission interviews support the view that
"Rationale for Retention: NASA management and Thiokol still considered
the joint to be a redundant seal even after the
"The Solid Rocket Motor case joint design
change from Criticality 1R to 1. For example,
is common in the lightweight and regular
Mclntosh's interview states:
weight cases having identical dimensions.
The joint concept is basically the same as the Question: [After the Criticality I classifica-
single O-ring joint successfully employed on tion], what did you think it would take to
the Titan III Solid Rocket Motor. ... On the make [the joint seal] 1R?
Shuttle Solid Rocket Motor, the secondary
Mr. Mclntosh: I thought it was already
O-ring was designed to provide redundancy
1R. I thought that after those tests that
and to permit a leak check, ensuring proper
would have been enough to do it.
installation of the O-rings. Full redundancy
exists at the moment of initial pressurization. Question: Well, you knew it was 1 but you
However, test data shows that a phe- were hoping for 1R?
nomenon called joint rotation occurs as the Mr Mclntosh: Yeah, I was hoping for 1R,
pressure rises, opening up the O-ring extru-
and I thought this test data would do it, but
sion gap and permitting the energized ring it didn't.57
to protrude into the gap. This condition has
been shown by test to be well within that re- At the time (in 1982-83), the redundancy of
quired for safe primary O-ring sealing. This the secondary O-ring was analyzed in terms of
gap may, however, in some cases, increase joint or hardware geometry, with no considera-
sufficiently to cause the unenergized second- tion being given to the resiliency of the ring as
ary O-ring to lose compression, raising ques- affected by temperatures.58 Moreover, Marshall
tion as to its ability to energize and seal if engineers like Ray and Miller disagreed with
called upon to do so by primary seal failure. Thiokol's calculations on the measurement of joint
Since, under this latter condition only the opening.59 That engineering debate eventually
single O-ring is sealing, a rationale for reten- went to a "referee" for testing which was not con-
tion is provided for the simplex mode where cluded until after the 51-L accident.

126
Notwithstanding the view of some of Marshall verified during ground turnaround and to
engineers that the secondary ring was not redun- the maximum extent possible while in
dant, even at the time of the Criticality revision, flight."63
Marshall Solid Rocket Motor program manage-
ment appeared to believe the seal was redundant Glynn Lunney, the former manager of the STS
in all but exceptional cases. Dr. Judson Lov- Program (Level II at JSC) described the Criticali-
ingood told the Commission: ty 1 change and resulting waiver to the Commis-
sion on May 2:
". . . [Tjhere are two conditions you have
to have before you don't have redundancy. Mr. Lunney: Well, the approval of the
One of them is what I call a spatial condi- waiver in March of'83, at the time I was
tion which says that the dimensional toler- involved in that. I was operating on the
ances have to be such that you get a bad assumption that there really would be
stackup, you don't have proper squeeze, etc. redundancy most of the time except when
on the O-ring so that when you get joint the secondary O-ring had a set of dimen-
rotation, you will lift the metal surfaces off sional tolerances add up, and in that ex-
the O-ring. All right, that's the one condi- treme case there would not be a secondary
tion, and that is a worst case condition in- seal.
volving dimensional tolerances. So I was dealing with what I thought was
"The other condition is a temporal con- a case where there were two seals unless the
dition which says that you have to be past dimensional tolerances were such that there
a point of joint rotation, and of course, that might only be one seal in certain cases.
relates back to what I just said. Chairman Rogers: Now, to me, if you will
"So first of all, if you don't have this bad excuse the expression, that sounds almost
stackup, then you have full redundancy. contradictory, what you just said. What you
Now, secondly, if you do have the bad first said was you came to the conclusion
stackup, you had redundancy during the ig- that you could only rely on the primary seal
nition transient up to the 170 millisecond and therefore you removed the R.
point, whatever it is, but that is the way I
understand the [Critical Items List]."60 Mr. Lunney: Yes, sir.
George Hardy and Lawrence Mulloy shared Chairman Rogers: And now you're saying,
Lovingood's view that the secondary seal was if I understand it, that experience showed
redundant in all but situations of worst case that there was redundancy after all.
tolerances.61 However, there is no mention of this
Mr. Lunney: No, I don't know of any ex-
caveat in the Critical Items List itself, nor does perience showing that. What I'm saying is
it appear in the subsequent "waiver" of the
that the removal of the R is an indicator that
Criticality 1 status granted by NASA Levels I and
under all circumstances we did not have
II in March, 1983.62 This waiver was approved
redundancy. There were a certain number
to avoid the obligations imposed on the Shuttle
of cases under which we would not have
Program by Paragraph 2.8 of the Space Shuttle
redundancy of the secondary O-ring.
Program Requirements Document, Level I,
Recognizing that, even though there were
dated June 30, 1977. That paragraph states:
a lot of cases where we expected we would
"The redundancy requirements for all have redundancy we changed the criticali-
flight vehicle subsystems (except primary ty designation.
structure, thermal protection system, and
Chairman Rogers: It was saying to
pressure vessels) shall be established on an
everybody else you can't necessarily rely on
individual subsystems basis, but shall not be
the primary seal, and if the primary seal
less than fail-safe. 'Fail-safe' is defined as the
fails, as you've said here, there may be loss
ability to sustain a failure and retain the
of vehicle, mission and crew.
capability to successfully terminate the mis-
sion. Redundant systems shall be designed Mr. Lunney: I would adjust that to only
so that their operational status can be say you cannot rely on the secondary O-ring

127
but we would expect the primary O-ring to nozzle joint primary O-rings both suffered ero-
always be there.64 sion damage. Thiokol engineers reacted to this
The criticality waiver was processed outside the discovery by filing a problem report on the O-
formal NASA Program Requirements Control ring erosion found on STS 41-B. Thiokol
Board, however, representatives of that group presented a series of charts to the Marshall Solid
"signed off on the document.65 It was forward- Rocket Booster Engineering Office about the
ed to Level I and approved by Associate Ad- 41-B O-ring erosion. Thiokol told Marshall that
ministrator for Space Flight (Technical), L. recent joint rotation measurements in tests in-
Michael Weeks on March 28, 1983. Weeks told dicated the secondary O-ring will not unseat, pro-
the Commission he signed the waiver because of viding confidence that the secondary was an ade-
the Certification/Verification Review of the Pro- quate backup. Keith Coates described his view
pulsion Committee in 1980. Weeks explained, about Thiokol's data in a February 29, 1984
"We felt at the time all of the people in the pro- memorandum to George Hardy:
gram I think felt that this Solid Rocket Motor "We have two problems with their ra-
in particular or the Solid Rocket Booster was tionale. The effect of 0.065 inch erosion on
probably one of the least worrisome things we had O-ring sealing capability is not addressed.
in the program."66 The waiver was signed less We have asked Thiokol to provide their data
than one week prior to the launch of STS-6 on to justify their confidence in the degraded
April 4. According to interviews of Arnold O-ring. The second concern is the amount
Aldrich and of Richard Kohrs, the latter having of joint rotation. L. Ray does not agree with
been involved with the waiver review at Johnson Thiokol numbers, and he has action to
Level II, the waiver was approved so that STS-6 discuss his concern with R. Boisjoly
could fly.67 However, Weeks denied any connec- (Thiokol) and reach agreement.
tion between the Level I waiver approval and the "Thiokol definition of their plans on
flight of STS-6.68 resolution of the problem is very weak."
Although some Thiokol engineers and officials
The erosion problem was identified and
claimed that they had no notice of the Criticality
tracked by the Marshall Problem Assessment
change and waiver in December, 1982 and in
System as Marshall Record A07934 and by
March, 1983, from the approval signatures (in-
Thiokol as Thiokol Contractor Record
cluding Thiokol's Operations Manager at Mar-
DR4-5/30, "Slight char condition on primary O-
shall, Maurice Parker) and the distribution of the
ring seal in forward field joint on SRM A57 of
Criticality and Waiver documents, apparently
STS-11 flight, Mission 4IB."73 The Marshall
Thiokol officials were sent copies and were in-
Problem Assessment System Report states:
volved in the criticality reclassification.69
Nonetheless, the Commission has also deter- "Remedial action none required; prob-
mined that several documents tracking the O-ring lem occurred during flight. The primary O-
erosion at Thiokol and Marshall refer to the Solid ring seal in the forward field joint exhibited
Rocket Motor field joint seal as Criticality 1-R, a charred area approximately 1 inch long
long after the status was changed to Criticality .03-.050 inches deep and .100 inches wide.
I.70 This was discovered during post-flight seg-
ment disassembly at KSC."
A March 8, 1984 entry on the same report
STS 41-B O-Ring Erosion continues:
"Possibility exists for some O-ring erosion
As Figure 2 shows,71 prior to STS 41-B, the on future flights. Analysis indicates max.
O-ring erosion/blow-by problem was infrequent, erosion possible is .090 inches according to
occurring on a field joint of STS-2 (November, Flight Readiness Review findings for
1981), nozzles of STS-6 (April, 1983) and a noz- STS-13. Laboratory test shows sealing in-
zle of QM-4 (March, 1983), a qualification test tegrity at 3,000 psi using an O-ring with a
motor fired by Thiokol.72 However, when STS simulated erosion depth of .095 inches.
41-B flew on February 3, 1984, the left Solid Therefore, this is not a constraint to future
Rocket Booster forward field joint and the right launches."74
128
Figure 2

O-Ring Anomalies Compared with Joint Temperature and Leak Check Pressure

Flight (Solid Pressure Joint


or Rocket Joint/ (in psi) Temp
Date Booster) O-Ring Field Nozzle Erosion Blow-by op
Motor

DM-1 07/18/77 _ _ XA NA 84
DM-2 01/18/78 NA NA 49
DM-3 10/19/78 NA NA 61
DM-4 02/17/79 NA NA 40
OM-1 07/13/79 NA NA 83
OM-2 09/27/79 NA NA 67
QM-3 02/13/80 NA NA 45
STS-1 04/12/81 50 50 66
STS-2 11/12/81 (Right) Aft
Field/Primary 50 50 X 70
STS-3 03/22/82 50 50 69
STS-4 06/27/82 unknown: hardware lost
at sea 50 50 NA NA 80
DM-5 10/21/82 NA NA 58
STS-5 11/11/82 50 50 68
QM-4 03/21/83 Nozzle/
Primary NA NA X 60
STS-6 04/04/83 (Right) Nozzle/
Primary 50 50 n 67
(Left) Nozzle/
Primary 50 50 c; 67
STS-7 06/18/83 50 50 72
STS-8 08/30/83 100 50 73
STS-9 11/28/83 HKF 100 70
STS 41-B 02/03/84 (Right) Nozzle/
Primary 200 100 X 57
(Left) Forward Field/
Primary 200 100 X 57
STS 41-C 04/06/84 (Right) Nozzle/
Primary 200 100 X 63

Dash ( ) denotes no anomaly.


NA denotes not applicable.
NOTE: A list of the sequence of launches (1-25), identified by STS mission designation, is pro-
vided on pages 4 thru 6.

1
On STS-6, both nozzles had a hot gas path detected in the putty with an indication of heat on
the primary O-ring.
2
On STS-9, one of the right Solid Rocket Booster field joints was pressurized at 200 psi after
a destack.

129
Flight (Solid Pressure Joint
or Rocket Joint/ (in psi) Temp
Motor Date Booster) O-Rtng Field Nozzle Erosion Blow-by 0
F

STS 41-C
(cont'd) (Left) Aft Field/
Primary 200 100 I!I 63
(Right) Igniter/
Primary NA NA X 63
STS 41-D 08/30/84 (Right) Forward
Field/Primary 200 100 X 70
(Left) Nozzle/
Primary 200 100 X X 70
(Right) Igniter/
Primary NA NA X 70
STS 41-G 10/05/84 200 100 78
DM-6 10/25/84 - Inner Gasket/
Primary NA NA X X 52
STS 51-A 11/08/84 - 200 100 67
STS 51-C 01/24/85 (Right) Center
Field/Primary f II i jini X X 53
(Right) Center Field/
Secondary 200 100 n 53
(Right) Nozzle/
Primary 200 100 X 53
(Left) Forward
Field/Primary 200 100 X X 53
(Left) Nozzle/
Primary 200 100 X 53
STS 51-D 04/12/85 (Right) Nozzle/
Primary 200 200 X 67
(Right) Igniter/
Primary NA NA X 67
(Left) Nozzle/
Primary 200 200 X 67
(Left) Igniter/
Primary NA NA X 67
STS 51-B 04/29/85 (Right) Nozzle/
Primary 200 100 X 75
(Left) Nozzle/
Primary 200 100 X X 75
Dash ( ) denotes no anomaly.
NA denotes not applicable.
NOTE: A list of the sequence of launches (1-25), identified by STS mission designation, is pro-
vided on pages 4 thru 6.
3
On STS 41-C, left aft field had a hot gas path detected in the putty with an indication of heat
on the primary O-ring.
4
On a center field joint of STS 51-C, soot was blown by the primary and there was a heat effect
on the secondary.

130
Flight (Solid Pressure Joint
or Rocket Joint/ (in psi) Temp
0
Motor Date Booster) 'O-Rtng Field Nozzle Erosion Blow-by F

STS 51-B (Left) Nozzle/


(cont'd) Secondary 200 100 X 75
DM-7 05/09/85 Nozzle/
Primary NA NA X 61
STS 51-G 06/17/85 (Right) Nozzle/
Primary 200 200 Xs X 70
(Left) Nozzle/
Primary 200 200 X X 70
(Left) Igniter/
Primary NA NA X 70
STS 51-F 07/29/85 (Right) Nozzle/
Primary 200 200 f6) 81
STS 51-1 08/27/85 (Left) Nozzle/
Primarv 200 200 X7 76
STS 51-J- 10/03/85 200 200 79
STS 61-A 10/30/85 (Right) Nozzle/
Primary 200 200 X 75
(Left) Aft
Field/Primary 200 200 X 75
(Left) Center Field/
Primary 200 200 X 75
STS 61-B 11/26/85 (Right) Nozzle/
Primary 200 200 X 76
(Left) Nozzle/
Primary 200 200 X X 76
STS 61-C 01/12/86 (Right) Nozzle/
Primary 200 200 X 58
(Left) Aft
Field/Primary 200 200 X 58
(Left) Nozzle/
Primary 200 200 X 58
STS 51-L 01/28/86 200 200 31
Dash ( ) denotes no anomaly.
NA denotes not applicable.
NOTE: A list of the sequence of launches (1-25), identified by STS mission designation, is pro-
vided on pages 4 thru 6.
5
On STS 51-G, right nozzle had erosion in two places on the primary O-ring.
6
On STS 51-F, right nozzle had hot gas path detected in putty with an indication of heat on the
primary O-ring.
7
On STS 51-1, left nozzle had erosion in two places on the primary O-ring.

131
This last entry is also a summary of the briefing erosion due to the hot gas impingement." 75 The
given by Thiokol to Lawrence Mulloy about the rationale for acceptance was the same as that
41-B erosion at the Level III Flight Readiness given at the Level III Flight Readiness Review
Review for STS 41-C held at Marshall on March and entered into the Marshall problem assess-
8, 1984. At that same briefing, the Chief Engineer ment report. An outgrowth of this review was an
for United Space Boosters, George Morefield, April 5, 1984, directive from NASA Deputy Ad-
raised prior Titan experience with O-ring prob- ministrator Dr. Hans Mark to Lawrence Mulloy
lems. He explained in a memorandum to Mulloy at Marshall. This "Programmatic Action Item"
the following day: was signed by Weeks and asked Mulloy to con-
"I alluded to the Titan III SRM history duct a "formal review of the Solid Rocket Motor
which is quite similar to the current STS case-to-case and case-to-nozzle joint sealing pro-
Solid Rocket Motor experience. Post-fire in- cedures to ensure satisfactory consistent close-
spection of Titan Solid Rocket Motor static outs."77 This action item had been preceded by
test motors showed that pressurization of the a letter written from NASA Associate Ad-
single O-rings in the pressure vessel routine- ministrator for Space Flight General Abraham-
ly occurred via a single break-down path son to Marshall Center Director Lucas.78 That
across the joint putty. There was also letter, sent January 18, 1984, requested that Mar-
evidence that some O-rings never see shall develop a plan of action to make improve-
pressure in the Titan motor. The segment- ment in NASA's ability to design, manufacture
to-segment case insulation design results in and fly Solid Rocket Motors. Abrahamson
a compression butt joint which apparently pointed out that NASA was flying motors where
is often sufficient to withstand P( basic design and test results were not well
"Your review showed that there was suf- understood. The letter addressed the overall
ficient margin of O-ring remaining to do the general Solid Rocket Motor design but did not
job. I'm sure you have considered that if it specifically mention O-ring erosion.
does burn through, the secondary O-ring After Mulloy received the April 5, 1984 STS
will then be similarly pressurized through a 41-C action item on the O-rings, he had
single port. So, some concern remains. Lawrence Wear forward a letter to Thiokol which
"I recommend that you set up a panel to asked for a formal review of the booster field joint
study the use of putty and consider some and nozzle joint sealing procedures. Thiokol was
alternatives: to identify the cause of the erosion, determine
"1) Is putty needed at all? whether it was acceptable, define necessary
changes, and reevaluate the putty then in use.
"2) If the tradition can't be broken, can
The Wear letter also requested small motor tests
the putty be applied with multiple
reflecting joint dynamics as well as analysis of the
(6 or 8) pressurization paths built booster assembly process.79
in?
Thiokol replied to the Marshall STS 41-C ac-
"I think that the primary seal should be
tion item on May 4, 1984, with a program plan
allowed to work in its classical design mode.
entitled "Protection of SRM Primary Motor
Both the Titan and STS Solid Rocket
Seals." The plan was prepared by Brian Russell,
Motors have been designed for this not to
then Thiokol's Manager of Systems Engineering.
happen. Titan has flown over a thousand
It outlined a systematic program to isolate the O-
pressure joints with no failure. My opinion
ring erosion and charring problem and to
is that the potential for failure of the joint eliminate damage to the joint seals.80 Proposed
is higher for the STS Solid Rocket Motor,
areas of inquiry included the leak check pressures,
especially when occasionally the secondary
assembly loads, case eccentricity and putty layup.
seal may not be totally effective."75
The Thiokol response in May 1984 was merely
When the 41-B erosion was taken to the Level a proposal. The actual final response to the direc-
I Flight Readiness Review for 41-C on March tive from Marshall was not completed until the
30, 1984, it was briefed as a "technical issue". A August 19, 1985 briefing on the Solid Rocket
recommendation to fly 41-C was approved by Motor seal held at NASA headquarters some 15
Level I "accepting the possibility of some O-ring months later.81

132
Field Joints Nozzle Joints

Rf!
90
50
70
40
Flight Flight 50
Anomaly Anomaly
30
Frequency Frequency
(%) (%) 30
20
10
10

50 100 150 200 50 100 150 200


Leak Check Leak Check
Stabilization Pressure Stabilization Pressure
(PSI) (PSI)
Graphs depict flight anomaly frequency for both field and noz-
zle joint of solid motors for a variety of leak check pressures.
Figure 3

Leak Check and Putty of hot gas to focus on a point on the primary O-
ring. Thiokol discovered the focused jet ate away
In addition to the action item from NASA or "impinged" on portions of the O-ring. Thiokol
Headquarters, another result of the 41-B erosion calculated that the maximum possible impinge-
was a warning written by John Q, Miller, Mar- ment erosion was .090 inch, and that lab test
shall chief of the solid motor branch, to George proved that an O-ring would seal at 3,000 psi
Hardy, through Keith Coates.82 Miller was wor- when erosion of .095 inches was simulated. This
ried about the two charred rings on 41-B and the "safety margin" was the basis for approving Shut-
"missing putty" found when the Solid Rocket tle flights while accepting the possibility of O-ring
Boosters were recovered and disassembled. He erosion.84
specifically identified the putty's sensitivity to Shortly after Miller's routing slip to Hardy
humidity and temperature as potential sources about the "urgent concern" of the missing putty
of problems. "The thermal design of the [Solid on 41-B, at Thiokol, Brian Russell authored a
Rocket Motor] joints depends on thermal pro- letter to Robert Ebeling which analyzed the ero-
tection of the O-ring by the [putty]," Miller said. sion history and the test data. Russell's April 9,
Failure of the putty to "provide a thermal bar- 1984 conclusion was that the putty itself and its
rier can lead to burning both O-rings and subse- layup were not at fault but that the higher
quent catastrophic failure." The memorandum stabilization pressure adopted in leak check pro-
also said that "the O-ring leak check procedure cedures, first implemented in one field joint on
and its potential effect on the (putty) installation STS-9, may increase the chances of O-ring ero-
and possible displacement is also an urgent con- sion. The conclusion by Miller and Russell was
cern which requires expedition of previously iden- that the air pressure forced through the joint dur-
tified full scale tests." ing the O-ring leak check was creating more putty
From the beginning, Thiokol had suspected the blow holes, allowing more focused jets on the
putty was a contributing factor in O-ring erosion, primary O-ring, thereby increasing the frequency
even after STS-2.83 In April 1983, Thiokol re- of erosion.85
ported on tests conducted to study the behavior This hypothesis that O-ring erosion is related
of the joint putty. One conclusion of the report to putty blow holes is substantiated by the leak
was that the STS-2 erosion was probably caused check history (Figure 3). Prior to January, 1984,
by blow holes in the putty, which allowed a jet and STS 41-B, when the leak check pressure was

133
50 or 100 psi, only one field joint O-ring anoma- cepted the increased pressure to ensure that the
ly had been found during the first nine flights. joint actually passed the integrity tests.89
However, when the leak check stabilization The documentary evidence produced by
pressure was officially boosted to 200 psi for STS NASA and Thiokol demonstrates that Marshall
41-B, over half the Shuttle missions experienced was very concerned about the putty erosion/blow
field joint O-ring blow-by or erosion of some hole problem after STS 41-B. In addition to John
kind.86 Miller's routing slip about putty on STS 41-B
Moreover, the nozzle O-ring history of prob- discussed above, there is a report of a June 7,
lems is similar. The nozzle joint leak check was 1984, telephone conference between Messrs.
changed from 50 psi to 100 psi before STS-9 Thompson, Coates and Ray (Marshall) and
launched in November 1983. After this change, Messrs. Sayer, Boisjoly, Russell and Parker
the incidence of O-ring anomalies in the nozzle (Thiokol), among others.90 Marshall told Thiokol
joint increased from 12 percent to 56 percent of that NASA was very concerned about the O-ring
all Shuttle flights. The nozzle pressure was in- erosion problem and that design changes were
creased to 200 psi for mission 51-D in April, 1985, necessary, including possible putty changes. The
and 51-G in June, 1985, and all subsequent mis- Thiokol engineers discussed Marshall's sugges-
sions. Following the implementation of the 200 tions after the telephone conference, but decided
psi check on the nozzle, 88 percent of all flights they could not agree a change was mandatory,
experienced erosion or blow-by.87 A follow-up telephone conference was held be-
Both Thiokol and NASA witnesses agreed that tween Ben Powers of Marshall and Lawrence
they were aware that the increase in blow holes Sayer of Thiokol on July 2. Powers told Sayer
in the putty could contribute to O-ring erosion. that NASA would not accept the removal of the
The Commission testimony of May 2, 1986, putty from the joint and that everyone expected
reads: the tests to show that gas jets would damage an
Dr. Walker: The analysis that some of our O-ring. However, Powers expressly stated that
staff has done suggests that after you in- Marshall would not accept Thiokol's opinion that
crease the test pressure to 200 pounds, the no further tests were necessary.
incidence of blow-by and erosion actually In mid-1984, the early tests after NASA's ac-
increased. tion item for 41-C led Thiokol to the conclusion
Mr. Russell: We realized that. that O-ring erosion was a function of the putty
blow hole size and the amount of free volume be-
Lawrence Mulloy was also questioned about
the blow holes in the putty: tween the putty orifice and the O-ring. The
damage to the O-ring was judged to be worse
Dr. Walker: Do you agree that the primary when the blow hole was smaller and the free
cause of the erosion is the blow holes in the volume was larger.91
putty? While Thiokol did establish plans for putty tests
Mr. Mulloy: I believe it is. Yes. to determine how it was affected by the leak check
in response to the 41-C action item, their prog-
Dr. Walker: And so your leak check pro- ress in completing the tests was slow. The action
cedure created blow holes in the putty? item was supposed to be completed by May 30,
Mr. Mulloy: That is one cause of blow 1984, but as late as March 6, 1985, there are
holes in the putty. Marshall internal memos that complain that
Thiokol had not taken any action on Marshall's
Dr. Walker: But in other words, your leak
December 1983 directive to provide data on putty
check procedure could indeed cause what
behavior as affected by the joint leak check
was your primary problem. Didn't that con-
stabilization pressure.92
cern you?
Mr. Mulloy: Yes, sir.88
Notwithstanding the knowledge that putty STS 51-C and Cold Temperature
blow holes caused erosion and that higher
pressure in the leak check caused more blow On January 24, 1985, STS 51-C was launched.
holes, Thiokol recommended and NASA ac- The temperature of the O-rings at launch was 53
134
Description of Awareness
NASA Official Position of O-Ring Problems
John Young Chief, Astronaut Office "The secret seal, which no one that we
know knew about." 93
Milton Silveira Chief Engineer ". . . If I had known . . . I'm sure in the
'82 time period when we first came to that
conclusion [that the seal was not redun-
dant], I would have insisted that we get
busy right now on a design change and
also look for any temporary fix we could
do to improve the operation of the
seal." 94
James Beggs (Former) NASA "I had no specific concerns with the joint,
Administrator the O-rings or the putty. . . ." 95
Arnold Aldrich Manager, National Space
Transportation System
Jesse Moore (Former) Associate Admin- None were aware of Thiokol's
istrator for Space Flight concern about negative effect
of cold temperature on O-ring perform-
Richard Smith Director, Kennedy Space * ance, nor were they
Center informed of the same concern
raised after STS 51-C.96
James A. Thomas Deputy Director, Kennedy
Launch and Landing
Operations
Figure 4

degrees, the coldest to that date. O-ring erosion when the O-ring has not yet sealed the joint gap
occurred in both solid boosters. The right and left and the edge of the ring erodes as the hot gas flows
nozzle joint showed evidence of blow-by between around it.
the primary and secondary O-rings. The primary Roger Boisjoly described the blow-by erosion
O-ring in the left booster's forward field joint was seen in 51-C:
eroded and had blow-by, or soot behind the "SRM 15 [STS 51-C] actually increased
ring.97 The right booster's damage was in the [our] concern because that was the first time
center field joint the first time that field joint we had actually penetrated a primary O-ring
seal was damaged. Both its primary and second- on a field joint with hot gas, and we had a
ary O-rings were affected by heat, and the witness of that event because the grease be-
primary ring also had evidence of blow-by of soot tween the O-rings was blackened just like
behind it. This was also the first flight where a coal . . . and that was so much more signifi-
secondary O-ring showed the effect of heat. cant than had ever been seen before on any
STS 51-C was the second example of O-ring blow-by on any joint . . . the fact was that
damage in flight where there was evidence of now you introduced another phenomenon.
blow-by erosion as well as impingement erosion. You have impingement erosion and bypass
As noted previously, impingement erosion occurs erosion, and the O-ring material gets re-
where the O-ring has already sealed and a focused moved from the cross section of the O-ring
jet of hot gas strikes the surface of the ring and much, much faster when you have bypass
removes a portion of it. Blow-by erosion happens erosion or blow-by."98

135
Boisjoly also said blow-by erosion was where experienced" for both primary and secondary O-
the primary 0-ring"at the beginning of the tran- rings for the field and nozzle joints. Accepting
sient cycle ... is still being attacked by hot gas, damage to the primary O-ring was being justified,
and it is eroding at the same time it is trying to in part, based on an assumption of the secondary
seal, and it is a race between, will it erode more O-ring working even with erosion. However, the
than the time allowed to have it seal." He describ- Criticality classification indicated the primary seal
ed the blow-by on 51-C as "over 100 degrees of was a "single point failure." During this flight
arc, and the blow-by was absolutely jet black. It readiness assessment at Marshall, for the first
was totally intermixed in a homogeneous mixture time Thiokol mentioned temperature as a factor
in the grease." When the blow-by material was in O-ring erosion and blow-by. Thiokol said in
chemically analyzed, Boisjoly said, "we found the its conclusions that "low temperature enhanced
products of putty in it, we found the products of probability of blow-by [flight] 51-C experienced
O-ring in it."99 worst case temperature change in Florida
On the Marshall problem assessment report history." Thiokol concluded that while the next
that was started to track field joint erosion after Shuttle flight "could exhibit same behavior,"
STS 41-B, the STS 51-C O-ring anomaly was de- nonetheless "the condition is not desirable but is
scribed as "O-ring burns were as bad or worse acceptable."103
than previously experienced . . . Design changes At the Level I Flight Readiness Review con-
are pending test results." 100 The changes being ducted on February 21, there was no detailed
considered included modifying the O-rings and analysis of O-ring problems presented or any
adding grease around the O-rings to fill the void reference made to low temperature effects. Instead,
left by putty blow holes. a single reference indicated the O-ring erosion and
On January 31, 1985, Marshall Solid Rocket blow-by experienced was "acceptable" because of
Booster Project Manager Mulloy sent an urgent "limited exposure time and redundancy."
message to Lawrence Wear with the stated sub-
ject: "51-C O-Ring Erosion Re: 51-EFRR."The STS 51-B and
message ordered that the Flight Readiness the Launch Constraint
Review for the upcoming flight:
"Should recap all incidents of O-ring ero- Joint seal problems occurred in each of the next
sion, whether nozzle or case joint, and all four Shuttle flights. Flight 51-D, launched April
incidents where there is evidence of flow past 12, 1985 had nozzle O-ring erosion and blow-by
the primary O-ring. Also, the rationale used on an igniter joint. STS 51-B, launched 17 days
for accepting the condition on the nozzle O- later, experienced both nozzle O-ring erosion and
ring. Also, the most probable scenario and blow-by as did 51-G, which flew on the follow-
limiting mechanism for flow past the ing June 17, STS 51-F, launched July 29, 1985
primary on the 51-C case joints. If [Thiokol] had nozzle O-ring blow-by.104
does not have all this for today I would like In reponse to the apparent negative effect of
to see the logic on a chart with blanks [to cold leading to the extensive O-ring problems on
be filled in]."101 flight 51-C in January, Thiokol conducted some
On February 8, 1985, Thiokol presented its O-ring resiliency tests in early 1985.105 The tests
most detailed analysis to date of the erosion prob- were conducted to quantify the seal timing func-
lems to the Solid Rocket Motor project office at tion of the secondary O-ring and the effect of joint
Marshall for what was then called Shuttle mis- rotation on its ability to back up the primary ring.
sion 51-E, but later changed to 51-D. Thiokol in- The key variable was temperature. The June 3
cluded a report on damage incurred by the O- test report, which was described in an August 9,
rings during flight 51-C at the left forward and 1985 letter from Brian Russell at Thiokol to Jim
right center field joints. The right center joint had Thomas at Marshall, showed:
hot gas past the primary O-ring. Thiokol said that "Bench test data indicates that the O-ring
caused a concern that the gas seal could be lost, resiliency (its capability to follow the metal)
but its resolution was "accept risk." 102 is a function of temperature and rate of case
Thiokol presented test results showing "max- expansion. [Thiokol] measured the force of
imum expected erosion" and "maximum erosion the O-ring against Instron platens, which
136
simulated the nominal squeeze on the O-ring established and its implementation effectivity
and approximated the case expansion determined) or sufficient rationale, i.e., dif-
distance and rate. ferent configuration, etc., exists to conclude
"At 100oF, the O-ring maintained contact. that this problem will not occur on the flight
At 750F the O-ring lost contact for 2.4 vehicle during pre-launch, launch, or
seconds. At 50oF, the O-ring did not re- flight."110
establish contact in ten minutes at which
time the test was terminated."106 Lawrence Mulloy told the Commission that the
launch constraint was "put on after we saw the
On June 25, 1985, the left nozzle joint of STS secondary O-ring erosion on the [51-B] nozzle."
51-B (launched April 29) was disassembled and "Based on the amount of charring," the problem
inspected after it had been shipped back to
report listing the constraint said, "the erosion
Thiokol. What Thiokol found was alarming. The
paths on the primary O-ring and what is
primary O-ring seal had been compromised understood about the erosion phenomenon, it is
because it eroded .171 inches and it did not seal. believed that the primary O-ring [of the joint]
The secondary O-ring did seal, but it had erod-
never sealed." 111 The constraint applied to STS
ed .032 inches. Lawrence Mulloy described the
51-F and all flights subsequent, including STS
51-B problem as follows: 51-L. Although one Marshall document says that
"This erosion of a secondary O-ring was the constraint applied to all O-ring anomalies,112
a new and significant event . . . that we cer- no similar launch constraint was noted on the
tainly did not understand. Everything up to Marshall Problem Assessment Report that started
that point had been the primary O-ring, tracking the field joint erosion after STS 41-B.
even though it had experienced some ero- Thiokol officials who testified before the Com-
sion does seal. What we had evidence of was mission all claimed they were not aware of the
that here was a case where the primary O- July 1985 launch constraint;113 however, Thiokol
ring was violated and the secondary O-ring letters referenced Marshall Record number
was eroded, and that was considered to be A09288, the report that expressly identified the
a more serious observation than previously constraint.114
observed . . .107 After the launch constraint was imposed. Proj-
"What we saw [in 51-B], it was evident ect Manager Mulloy waived it for each Shuttle
that the primary ring never sealed at all, and flight after July 10, 1985. Mr. Mulloy and Mr.
we saw erosion all the way around that O- Lawrence Wear outlined the procedure in the
ring, and that is where the .171 came from, following manner:
and that was not in the model that predicated
Chairman Rogers: To you, what does a
a maximum of .090, the maximum of .090
is the maximum erosion that can occur if the constraint mean, then?
primary O-ring seals. Mr. Mulloy: A launch constraint means
"But in this case, the primary O-ring did that we have to address the observations, see
not seal; therefore, you had another volume if we have seen anything on the previous
to fill, and the flow was longer and it was flight that changes our previous rationale,
blow-by and you got more erosion."108 and address that at the Flight Readiness
Review.
Upon receiving the report of the 51-B primary
ring failure, Solid Rocket Booster Project Chairman Rogers: When you say "address
Manager Mulloy and the Marshall Problem it," I always get confused by the word. Do
Assessment Committee placed a "launch con- you mean think about it? Is that what you
straint" on the Shuttle system.109 A 1980 Mar- mean?
shall letter which references "Assigning Launch
Mr. Mulloy: No, sir. I mean present the
Constraints on Open Problems Submitted to data as to whether or not what we have seen
MSFC PAS" defines launch constraint as: in our most recent observation, which may
"All open problems coded Criticality 1, not be the last flight, it may be the flight
1R, 2, or 2R will be considered launch con- before that, is within our experience base
straints until resolved (recurrence control and whether or not the previous analysis and
137
tests that previously concluded that was an ring was eroded, and that was considered
acceptable situation is still valid, based upon to be a more serious observation than
later observations. . . . previously observed.
The constraint was put on after we saw
the secondary O-ring erosion on the nozzle, Dr. Ride: Correct me if I am wrong, but
I believe. weren't you basing most of your decisions
on the field joint on analysis of what was the
Chairman Rogers: Who decided that? maximum, what you believed to be the
Mr. Mulloy: I decided that, that that would maximum possible erosion, and you had
be addressed, until that problem was re- that analysis for the field joint and for the
solved, it would be considered a launch con- nozzle joint. When you saw the complete
straint, and addressed at Flight Readiness erosion of the primary O-ring on the noz-
Reviews to assure that we were staying zle joint, that showed you that your analysis
within our test experience base. . . . on the nozzle joint wasn't any good, I would
think. That would indicate to you that your
Chairman Rogers: Do you have ultimate analysis on the field joint wasn't very good,
responsibility for waiving the launch either, or at least should be suspect.
constraints?
Mr. Mulloy: The conclusion, rightly or
Mr. Mulloy: Yes, sir, I have ultimate wrongly, for the cause of the secondary O-
responsibility for the launch readiness of the ring erosion on the nozzle joint, it was con-
Solid Rocket Boosters. cluded from test data we had that 100 psi
pressurization leak check, that the putty
Chairman Rogers: So there was a launch
could mask a primary O-ring that was not
constraint, and you waived it.
sealing. The conclusion was and that one
Mr. Mulloy: Yes, sir, all flights subsequent was done at 100 psi. The conclusion was that
to. . . . in order to get that type of erosion that we
saw on the primary O-ring, that that O-ring
Dr. Ride: I'm trying to understand how you
never sealed, and therefore the conclusion
deal with the launch constraint. How im-
was that it never was capable of sealing.
portant do you think a launch constraint is
The leak check on subsequent nozzles, all
and how unusual is it in your system?
subsequent nozzles was run at 200 psi, which
Mr. Wear: I think a launch constraint is a the test data indicated would always blow
significant event in our system, and it is one through the putty, and in always blowing
that has to be addressed within the Flight through the putty we were guaranteed that
Readiness cycle because I don't have the we had a primary O-ring seal that was
authority to not do that. . . . capable of sealing, and then we further did,
and we already had that on the field joints
Dr. Ride: Why didn't you put a launch con- at that time.115
straint on the field joint at the same time?
While Mulloy and Wear both testified that the
Mr. Mulloy: I think at that point, and I will constraint was still in effect and waived for
react to that question in real time, because Challenger's flight, they told the Commission that
I haven't really thought about it, but I think there had been two erroneous entries on the O-
the logic was that we had been observing the ring erosion nozzle problem assessment report
field joint, the field and nozzle joint primary stating the O-ring erosion problem had been
O-ring erosion. This erosion of a secondary resolved or closed.116 Thiokol had suggested this
O-ring was a new and significant event, very closure on December 10, 1985 (at Marshall's re-
new and significant even that we certainly quest according to Brian Russell) but Wear and
did not understand. Everything up to that Mulloy told the Commission they rejected that
point had been that the primary O-ring, recommendation and the problem was still be-
even though it had experienced some ero- ing addressed in Flight Readiness Reviews.117
sion, does seal. What we had evidence of NASA Levels I and II apparently did not realize
was that here was a case where the primary Marshall had assigned a launch constraint within
O-ring was violated and the secondary O- the Problem Assessment System.118 This com-
138
August 19, 1985 Headquarters Briefing

General Conclusions Recommendations


All O-ring erosion has occurred where gas paths in the The lack of a good secondary seal in the field joint is most
vacuum putty are formed critical and ways to reduce joint rotation should be incor-
porated as soon as possible to reduce criticality
Gas paths in the vacuum putty can occur during
assembly, leak check, or during motor pressurization The flow conditions in the joint areas during ignition and
motor operation need to be established through cold flow
Improved filler materials or layup configurations which
modeling to eliminate O-ring erosion
still allow a valid leak check of the primary O-rings may
reduce frequency of O-ring erosion but will probably not QM-5 static test should be used to qualify a second
eliminate it or reduce the severity of erosion source of the only flight certified joint filler material
Elimination of vacuum putty in a tighter joint area will (asbestos-filled vacuum putty) to protect the flight pro-
eliminate O-ring erosion if circumferential flow is not gram schedule
presentif it is present, some baffle arrangement may be VLS-1 should use the only flight certified joint filler
required material (Randolph asbestos-filled vacuum putty) in all
Erosion in the nozzle joint is more severe due to eccen- joints
tricity; however, the secondary seal in the nozzle will seal Additional hot and cold subscale tests need to be con-
and will not erode through ducted to improve analytical modeling of O-ring erosion
The primary O-ring in the field joint should not erode problem and for establishing margins of safety for eroded
through but if it leaks due to erosion or lack of sealing the O-rings
secondary seal may not seal the motor Analysis of existing data indicates that it is safe to con-
tinue flying existing design as long as all joints are leak
The igniter Gask-O-Seal design is adequate providing
checked with a 200 psig stabilization pressure, are free of
proper quality inspections are made to eliminate overfill
contamination in the seal areas and meet O-ring squeeze
conditions
requirements
Efforts need to continue at an accelerated pace to
Figures eliminate SRM seal erosion

munication failure was contrary to the require- Failure Criticality" to R. K. Lund, Thiokol's Vice
ment, contained in the NASA Problem Report- President of Engineering:
ing and Corrective Action Requirements System,
that launch constraints were to be taken to Level "The mistakenly accepted position on the
II. joint problem was to fly without fear of
failure and to run a series of design evalua-
tions which would ultimately lead to a solu-
Escalating Concerns tion or at least a significant reduction of the
When the burn through of the primary nozzle erosion problem. This position is now
O-ring on the left Solid Rocket Booster of STS changed as a result of the [51-B] nozzle joint
51-B was discovered in Utah on June 25, 1985, erosion which eroded a secondary O-ring
an engineer from the NASA headquarters Shut- with the primary O-ring never sealing. If the
tle Propulsion Group was on the scene. Three same scenario should occur in a field joint
days after the 51-B inspection, a memorandum (and it could), then it is a jump ball whether
was written to Michael Weeks, also at Head- as to the success or failure of the joint
quarters, reporting on the primary O-ring burn because the secondary O-ring cannot re-
through.119 The memo blamed the problem on spond to the clevis opening rate and may not
the faulty 100 psi leak check and reminded Weeks be capable of pressurization. The result
that Thiokol had not yet responded to the O-ring would be a catastrophe of the highest
erosion action item sent out after STS 41-B one order loss of human life."
year earlier. Boisjoly recommended setting up a team to
Engineers at Thiokol also were increasingly solve the O-ring problem, and concluded by
concerned about the problem. On July 22, 1985, stating:
Roger Boisjoly of the structures section wrote a
memorandum predicting NASA might give the "It is my honest and very real fear that if
motor contract to a competitor or there might be we do not take immediate action to dedicate
a flight failure if Thiokol did not come up with a team to solve the problem, with the field
a timely solution.120 joint having the number one priority, then
Nine days later (July 31) Boisjoly wrote another we stand in jeopardy of losing a flight along
memorandum titled "O-ring Erosion/Potential with all the launch pad facilities."121
139
In reply to specific questions from Marshall on Mr. Thompson: One problem in going to
August 9, Thiokol's Brian Russell reported the larger O-rings is in field joints plant joints,
test data on the June 3 resiliency tests. As noted excuse me. In the plant joints, if you put
previously, he indicated O-ring resiliency was a in the 295 and you take the worst on worst,
function of the temperature and case expansion. when the joint is raised to a temperature of
Also, he wrote, Thiokol had no reason to suspect 325 degrees during the curing of the insula-
that the primary O-ring would fail after motor tion, it is an overfill condition because of the
ignition transient. He said the secondary O-ring alpha problems with the case, and the
would seal within the period after ignition from rubber.
0 to 170 milliseconds.122 From 170 to 330 milli- Dr. Walker: There is no reason why a field
seconds, the probability of the sealing of the joint and a plant joint had to have the same
secondary O-ring was reduced. From 330 to 600 O-ring, is there?
milliseconds, there was only a slight chance the
secondary seal would hold. Mr. Thompson: There were some that
On August 19, 1985, Thiokol and Marshall were afraid of the QC people, that were
program managers briefed NASA Headquarters afraid of the confusion that might be
on erosion of the motor pressure seals.123 The developed between two nearly the same
briefing paper concluded that the O-ring seal was sized O-ring.127
a critical matter, but it was safe to fly. The brief- Thiokol's revised O-ring protection plan, dated
ing was detailed, identifying all prior instances of August 30, 1985, indicated that NASA and
field joint, nozzle joint and igniter O-ring erosion. Thiokol were still not in agreement on the
It recommended an "accelerated pace" to elimi- magnitude of the joint rotation phenomenon. It
nate seal erosion but concluded with the recom- said that "presently there are conflicting data from
mendation that "it is safe to continue flying ex- Solid Rocket Motor case hydrotest and [static
isting design as long as all joints are leak checked tests] concerning the magnitude of case field joint
with a 200 psig stabilization pressure, are free of rotation under motor pressure. A referee test will
contamination in the seal areas and meet O-ring be devised, which is mutually acceptable to
squeeze requirements." The briefing conclusions NASA and Thiokol, to determine joint opening
and recommendations appear in Figure 5.124 characteristics." 128
Thiokol's Robert Lund, Vice President Engi-
neering, noting that "the result of a leak at any
of the joints would be catastrophic," announced Design Questions Resurface
the establishment of a Thiokol O-ring task force
on August 20, 1985, to "investigate the Solid Also in late August, Thiokol submitted
Rocket Motor case and nozzle joints, both "Preliminary Solid Rocket Motor Nozzle/Field
materials and configurations, and recommend Joint Seal Concepts" to NASA, which were "for-
both short-term and long-term solutions." 125 mulated to solve the [Solid Rocket Motor] seal-
Two days later, A. R. Thompson, Thiokol's ing problems." The document contained 43 pos-
supervisor of structures design, said in a sible design concepts for field joints and 20 for
memorandum to S. R. Stein, project engineer, nozzle joints. The report said Thiokol "feels the
that the "O-ring seal problem has lately become case field joint poses the greatest potential risk
acute." Thompson recommended near-term solu- in that its secondary seal may not maintain metal
tions of increasing the thickness of shims used at contact throughout motor operation. The nozzle
the tang and clevis mating, and increasing the joint is also of major concern because the frequen-
diameter of the O-ring. "Several long-term solu- cy and severity of seal damage experienced has
tions look good; but, several years are required been greater than any other joint."
to incorporate some of them," Thompson wrote. In September 1985, Thiokol's plans called for
"The simple short-term measures should be taken test-firing a static motor with various O-ring con-
to reduce flight risks." 126 During a Commission figurations. In a September 10 presentation to
hearing, Thompson was asked about the larger Marshall, Thiokol discussed erosion predictions,
diameter O-ring solution: and evaluated primary engineering concerns in-
Dr. Walker: Why didn't you go to the larger cluding joint deflection and secondary O-ring
O-ring, then? resiliency. Temperature was not mentioned.129
140
Prior to that Thiokol presentation, Marshall tion by verbal request, but such is not the
Science and Engineering Director Kingsbury had case. This is a red flag."132
informed Solid Rocket Booster Program
Manager Mulloy: Shuttle flight 61-A was launched October 30,
1985. It experienced nozzle O-ring erosion and
"I am most anxious to be briefed on plans field joint O-ring blow-by.133 These anomalies
for improving the Solid Rocket Motor O- were not mentioned at the Level I Flight Readi-
ring seals. Specifically, I want to review ness Review for flight 61-B. That flight was
plans which lead to flight qualifications and launched on November 26, 1985, and sustained
the attendant schedules. I have been ap- nozzle O-ring erosion and blow-by.134
prised of general ongoing activities but these The following month (December) Thiokol's
do not appear to carry the priority which I problem status report which tracked the field joint
attach to this situation. I consider the O-ring erosion anomaly stated that the O-ring task force
seal problem on the Solid Rocket Motor to had made one hot gas test and preliminary results
require priority attention of both Morton indicated the test chamber needed to be re-
Thiokol/Wasatch and MSFC."130 designed.135 Mr. Ebeling of Thiokol became so
Early in October, internal warnings about the concerned about the gravity of the O-ring prob-
lack of results from the O-ring task force came lem that he told fellow members of the seal task
when Thiokol's management got two separate force that he believed Thiokol should not ship any
memoranda complaining about administrative more motors until the problem was fixed.
delays and lack of cooperation. One memoran- In testimony before the Commission, Ebeling
dum was written by Roger Boisjoly on October said:
4, 1985, and it warned Thiokol management
Mr. Ebeling: Well, I am a hydraulics engi-
about lack of management support of the O-ring
neer by profession, and O-rings and seals
team's efforts.131 He said that "even NASA
and hydraulics are very sacred, but for the
perceives that the team is being blocked in its
most part, a hydraulics or pneumatics engi-
engineering efforts to accomplish its task. NASA
neer controls the structure, the structural
is sending an engineering representative to stay
design, the structural deformation to make
with us starting October 14th. We feel that this
sure that this neat little part that is so critical
is the direct result of their feeling that we
is given every thing it needs to operate. In
[Thiokol] are not responding quickly enough on
Solid Rocket Motors I have been there now
the seal problem."
pushing 25 years. They had a different at-
R. V. Ebeling, manager of Thiokol's Solid
titude on O-rings when I came there, and
Rocket Motor ignition system, began his October
it is not just Thiokol, it is universal.
1, 1985, report to McDonald with the alarming
word "HELP!" Ebeling said the seal task force was Dr. Covert: By universal, you mean the
"constantly being delayed by every possible solid rocket industry?
means." "Marshall Space Flight Center," he said,
Mr. Ebeling: The entire solid rocket in-
"is correct in stating that we do not know how
dustry. It gets around from one, the com-
to run a development program." Ebeling con-
petitors' information eventually gets to me
tinued:
by one track or another, and mine to them,
"The allegiance to the O-ring investiga- but my experience on O-rings was and is
tion task force is very limited to a group of to this date that the O-ring is not a
engineers numbering 8-10. Our assigned mechanism and never should be a
people in manufacturing and quality have mechanism that sees the heat of the
the desire, but are encumbered with other magnitude of our motors, and I think before
significant work. Others in manufacturing, I do retire, I'm going to make sure that we
quality, procurement who are not involved discontinue to fly with round seals which I
directly, but whose help we need, are am against round seals anyway. I think seals
generating plenty of resistance. We are with memories, not pressure-activated, but
creating more instructional paper than energized through mechanical means, and
engineering data. We wish we could get ac- in all cases, keep the heat of our rocket

141
motors away from those seals. Whatever it to complete the monthly problem report, and
is, you do not need chamber pressure to in addition to that we have our monthly
energize a seal. problem review board telephone conference
Dr. Covert: In this regard, then, did you with NASA and the contractors, of which
have an increasing concern as you saw the we are a part, and the monthly problem
tendency first to accept thermal distress and review or the monthly problem report that
then to say, well, we can model this reliability prepares, they get the information
reasonably and we can accept a little bit of from engineering or from the office as neces-
erosion, and then etc., etc.? Did this cause sary to complete their status of what has hap-
you a feeling of if not distress, then betrayal pened during that month, whether the prob-
in terms of your feeling about O-rings? lem originated that month or what has been
done to close the problem out, and that is
Mr. Ebeling: I'm sure sorry you asked that
submitted every month, and I for one do
question.
review that before it is submitted to the
Mr. Covert: I'm sorry I had to. Marshall Space Flight Center, and so much
Mr. Ebeling: To answer your question, of the information that I would read in these
yes. In fact, I have been an advocate, I used reports would be the same information that
to sit in on the O-ring task force and was we had given in that monthly problem
involved in the seals since Brian Russell report or over the telephone on the tele-
worked directly for me, and I had a certain conference.
allegiance to this type of thing anyway, that
I felt that we shouldn't ship any more rocket Chairman Rogers: Mr. Russell, when you
say close the problem out, what do you
motors until we got it fixed.
mean by that? How do you close it out
Dr. Covert: Did you voice this concern? normally?
Mr. Ebeling: Unfortunately, not to the
Mr. Russell: Normally, whether it takes
right people.136
engineering analysis or tests or some cor-
rective action, a closeout to the problem
The Closure Issue would occur after an adequate corrective ac-
tion had been taken to satisfy those on the
On December 6, 1985, Thiokol's Brian Russell problem review board that the problem had
wrote Al McDonald, Thiokol Solid Rocket Motor indeed been closed out. That is the way that
Project Director, requesting "closure of the Solid that happens; for example, we had found a
Rocket Motor O-ring erosion critical prob- loose bolt on the recovery one time, and we
lems." 137 He gave 17 reasons for the closure, in- had to take corrective action in our pro-
cluding test results, future test plans and the work cedures and in the engineering to make sure
to date of Thiokol's task force. Four days later that that wouldn't happen again, and then
(December 10) McDonald wrote a memorandum to verify that corrective action, and at that
to NASA's Wear asking for closure of the O-ring point that problem would be ready to be
problem. All O-ring erosion problems, including closed out. It generally involves a report or
the problem containing the July 1985 launch con- at least a mention by the review board
straint, were among the referenced matters that stating what had been done to adequately
Thiokol suggested should be closed. McDonald close it out, and then it is agreed upon by
noted that the O-ring problem would not be fully the parties involved. . . .
resolved for some time, and he enclosed a copy
of Thiokol's August 30 plan for improving the Question: What do you understand a
motor seals.138 launch constraint to mean?
Brian Russell described the problem tracking
Mr. Russell: My understanding of a launch
process and gave the reason for the closure recom-
constraint is that the launch cannot proceed
mendation during the following exchange:
without adequately without everyone's
Mr. Russell: We have our reliability agreement that the problem is under
engineering department, who is responsible control.

142
Chairman Rogers: Under control meaning problem is closed, it comes off the board and
what? You just said a moment ago that you is no longer under active review. . . .
would expect some corrective action to be
taken. Chairman Rogers: What was being done
to fix it?
Mr. Russell: That is correct, and in this
particular case on this 51-B nozzle O-ring Mr. Russell: Well, we had a task force
erosion problem there had been some cor- created of full-time people at Thiokol, of
rective action taken, and that was included which I was a member of that task team,
in the presentation made as a special adden- and we had done some engineering tests.
dum to the next Flight Readiness Review, We were trying to develop concepts. We had
and at the time we did agree to continue to developed some concepts to block the flow
launch, which apparently had lifted the of hot gas against the O-ring to the point
launch constraint, would be my under- where the O-ring would no longer be
standing. . . . damaged in a new configuration.
And we had run some cold gas tests and
Chairman Rogers: But really my question some hot gas motor firing tests and were
is: Did you gentlemen realize that it was a working toward a solution of the problem
launch constraint? and we had some meetings scheduled with
Mr. Russell: I would like to answer for the Marshall Space Flight Center. We had
myself. I didn't realize that there was a for- weekly telephone calls where we statused our
mal launch constraint on this one, any dif- progress and there was a team at Marshall
ferent than some of the other erosion and also of engineering people who were
blow-by that we had seen in the past. monitoring the things that we were doing to
fix the problem with the goal of implement-
Mr. Ebeling: I agree. . . . ing a fix in our qualification motor No. 5,
Question: . . . Mr. Russell, you wrote a which was scheduled at that time in January,
letter, did you not, or a memorandum in- this timeframe being about the December
dicating that the problem should be closed. timeframe of last year.
Could you explain to the Commission
what you meant by that? Chairman Rogers: Can I interrupt? So
you're trying to figure out how to fix it,
Mr. Russell: Yes. In our December right? And you're doing some things to try
telephone call on the Problem Review to help you figure out how to fix it.
Board and I can't remember the date it Now, why at that point would you close
was around the 9th or so there was a re- it out? . . .
quest to close the problems out and par-
ticularly the ones that had been open for a Mr. Russell: Because I was asked to do it.
long time, of which this was one, and a long
Chairman Rogers: I see. Well, that ex-
time meaning six months or more.
plains it.
There was a request from the Director of
Engineering, as I recall it, that we close these Mr. Rummel: It explains it, but really
problems out. . . . doesn't make any sense. On one hand you
close out items that you've been reviewing
Dr. Walker: That was the Director of
flight by flight, that have obviously critical
Engineering at Marshall?
implications, on the basis that after you close
Mr. Russell: Yes, at Marshall Space Flight it out, you're going to continue to try to fix
Center. Now, he wasn't in that call. My it.
understanding is what they told us and my So I think what you're really saying is,
recollection was that Mr. Kingsbury would you're closing it out because you don't want
like to see these problems closed out. to be bothered. Somebody doesn't want to
Now, the normal method of closing them be bothered with flight-by-flight reviews, but
out is to implement the corrective action, you're going to continue to work on it after
verify the corrective action, and then the it's closed out.139

143
Marshall received the Thiokol letter asking for Mr. Wear: Mr. Fletcher, and he reports
the closure and an entry was placed on all Mar- within our quality organization at the Flight
shall Problem Reports referenced in McDonald's Readiness Reviews, ... as I think have
December 10 letter indicating "contractor closure been described to you before. There is one
received" on December 18, 1985.140 On January from Thiokol to me, and there is one from
23, 1986, another entry was placed on the same my group to Larry, and then Larry, of
reports indicating the "problem is considered course, does one with the Shuttle project of-
closed." 141 Lawrence Mulloy and Lawrence Wear fice, and so forth, on up the line. At my
testified those entries were "in error." They said: review and at Larry's review, here is a heads
Mr. Mulloy: The problem assessment up given to the quality representative at that
system was put in place to provide visibility board for what problems the system has
throughout the Shuttle system for the types open, and they cross-check to make sure that
of problems that do occur, not just in flight, we address that problem in the readiness
but also in qualification tests, and in failure review.
of hardware that is back for refurbishment On this particular occasion, there was no
at a vendor or whatever. And it is a closed heads up given because their Problem
loop tracking system that lists the Assessment System considered that action
anomaly. . . . closed. That is unfortunate.142
Now, the entry that is shown in there that Project Manager Mulloy was asked during
the problem was closed prior to 51-L is in Commission hearings about the original response
error. What happened there was, one of your to O-ring erosion:
documents here which we did not discuss is Mr. Hotz: Mr. Mulloy, I would like to try
the letter from Mr. McDonald to Mr. Wear to understand this in somewhat simpler
which proposed that this problem be terms than you people are used to using.
dropped from the problem assessment Is it correct to state that when you
system and no longer be tracked for the originally designed this joint and looked at
reasons stated in Mr. McDonald's letter. it, that you did not anticipate erosion of any
That letter was in the review cycle. The of the O-ring during flights?
letter, I believe, was dated 10 December
1985. It came into the center, it was in the Mr. Mulloy: That is my understanding. I
review cycle. After Mr. Wear brought this entered this program in November of 1982
letter to my attention, my reaction was, we and I wasn't there on the original design of
are not going to drop this from the problem the joint, but when I took over the program
assessment system because the problem is there was no O-ring erosion anticipated.
not resolved and it has to be dealt with on Mr. Hotz: So that when you did run into
a flight-by-flight basis. signs of O-ring erosion, this was a bad sign.
Since that was going through the review
cycle, the people who run this problem Mr. Mulloy: Yes, sir. . . .
assessment system erroneously entered a Mr. Hotz: So then you decided to introduce
closure for the problem on the basis of this a standard based on the measurement or the
submittal from Thiokol. Having done that possibility of the limits of O-ring erosion.
then for the 51-L review, this did not come And as those limits, as the experience went
up in the Flight Readiness Review as an up, your criteria for, say, flight went up too.
open launch constraint, so you won't find a In other words, when you experienced
project signature because the PAS system more than maximum anticipated O-ring
showed the problem was closed, and that was erosion, you waived the flight and said
an error. "Well, it's possible to tolerate that. We still
have a margin left."
Chairman Rogers: Who made the error?
Do you know? Mr. Mulloy: Are you speaking of the case
where we did not have a primary seal.
Mr. Mulloy: The people who do the prob-
lem assessment system. Mr. Hotz: Yes.

144
Mr. Mulloy: Yes, sir. That is correct. . . . cy of occurrence based on all flights (Figure 6 ).
Mr. Hotz: Then you finally, you're talking In such a comparison, there is nothing irregular
in the distribution of O-ring "distress" over the
about these margins of safety, and I wonder
spectrum of joint temperatures at launch between
if you could express in either percentages or
actual measurement terms you have used 53 degrees Fahrenheit and 75 degrees Fahrenheit.
the term "wide margin." I wonder if you When the entire history of flight experience is
could give us a quantitative measurement as considered, including "normal" flights with no
erosion or blow-by, the comparison is substan-
to what you consider a wide margin?
tially different (Figure 7).
Mr. Mulloy: Yes, sir. Well, as 1 said we had This comparison of flight history indicates that
demonstrated that we could stand 125 only three incidents of O-ring thermal distress oc-
thousandths of erosion and still seat. The curred out of twenty flights with O-ring
maximum erosion that we had seen in the temperatures at 66 degrees Fahrenheit or above,
case joint was on STS-2, which was 53 whereas, all four flights with O-ring temperatures
thousandths, so that is a factor of two and at 63 degrees Fahrenheit or below experienced
a half . . . O-ring thermal distress.
Dr. Keel: ... I think, Larry, if you go back Consideration of the entire launch temperature
and look at your Flight Readiness Reviews, history indicates that the probability of O-ring
that you were relying on less margins than distress is increased to almost a certainty if the
that. temperature of the joint is less than 65.
You were arguing in the Flight Readiness
Reviews where you briefed the problems of
primary O-ring erosion that for the worst Flight Readiness Reviews
case for the field joint also that it would be
90 thousandths. It is clear that contractor and NASA program
Mr. Mulloy: That is correct. personnel all believed that the O-ring ero-
sion/blow-by anomaly, and even the launch con-
Dr. Keel: At that point you were pointing straint, were problems that should be addressed
out that's okay, because you can seal at 95, in NASA's Flight Readiness Review process. The
not at 125 but at 95. It wasn't until later on Flight Readiness Review is a multi-tiered review
during the process that you determined you that is designed to create an information flow
could seal at 125. from the contractor up through Level III at Mar-
Mr. Mulloy: That is when we got the hot shall, then to Level II officials from Johnson and
gas test data. Level I at Headquarters. With regard to the Solid
Rocket Booster, the process begins at the element
Dr. Keel: So that's a five percent margin, level and culminates in a coordinated Marshall
roughly, five and a half. position at the subsequent Levels II and 1 Flight
Mr. Mulloy: On the 90 to 95 on a max Readiness Review.144
predictable, yes.143 NASA policy manuals list four objectives of the
Shuttle Projects Flight Readiness Review, an in-
termediate review between Level III and Level
Temperature Effects I, when contractors and Level III program per-
sonnel consider the upcoming launch. The stated
The record of the fateful series of NASA and objectives are:
Thiokol meetings, telephone conferences, notes,
and facsimile transmissions on January 27th, the "1. To provide the review team with suffi-
night before the launch of flight 51-L, shows that cient information necessary for them to
only limited consideration was given to the past make an independent judgment regard-
history of O-ring damage in terms of tempera- ing flight readiness.
ture. The managers compared as a function of "2. Review solved problems and previous
temperature the flights for which thermal distress flight anomalies and establish confidence
of O-rings had been observed not the frequen- in solution rationale.

145
STS51-C
- -w

Field Joint

61A

CD C

3 O
41B 41C 41D
4>
61C STS-2

50 55 60 65 70 75 80
0
Calculated Joint Temperature, F

Figure 6
Plot of flights with incidents of O-ring thermal
distress as function of temperature

STS51-C

Field Joint
61A

0) c
JD CD

=1 o
41B 41C 41D
--#
61C STS-2
Flights
with no
incidents \

50 55 60 65
+~4 70
m m
75

80

Calculated Joint Temperature, 0F

Figure 7
Plot of flights with and without incidents of O-ring
thermal distress

NOTE: Thermal distress defined as O-ring erosion, blow-by,


or excessive heating

146
"3. Address all problems, technical issues, sealing integrity at 3,000 psi pressure using
open items and constraints requiring an O-ring with a simulated .095 in. erosion
resolution before flight. depth.
"4. Establish the flight baseline configuration
"Recommendation:
particularly as it differs from previous
missions." 145 "Fly STS 41-C accepting possibility of some
The Commission has reviewed the various O-ring gas impingement." 149
documentary presentations made by Thiokol and
NASA program people for Flight Readiness The next significant treatment of the problem
Reviews on all Shuttle flights. The O-ring presen- occurred after the coldest flight, 51-C at 53
tations in those Flight Readiness Reviews have degrees in January 1985. In part, Thiokol's ex-
been summarized in an Appendix to this report. tensive analysis for the 51-E Flight Readiness
The erosion on STS-2 was not considered on Review was due to the fact that four joints on
any level of the Flight Readiness Review for 51-C had problems.150 Additionally, Mr.
STS-3.146 Similarly the heat effect on STS-6's Mulloy's specific request for a recap of the O-ring
primary O-ring in the nozzle was not mentioned history undoubtedly prompted a full treatment.
on the STS-7 Flight Readiness Review in 1983. Temperature was highlighted as a concern when
However, the rationale for acceptance of the Mulloy took Thiokol's analysis up to the Shuttle
"secondary seal condition" for the lightweight case Projects Office Flight Readiness Review. That
first flown on STS-6 contained the observation 18-page briefing concluded with the statement
that an O-ring sealed during a Thiokol test under that: "STS 51-C consistent with erosion data
3,000 psi where .125 inches had been cut out of based. Low temperature enhanced probability of
the O-ring.147 blow-by. STS-51-C experienced worst case
The inattention to erosion and blow-by anoma- temperature change in Florida history. STS 51-E
ly changed when Thiokol filed a problem report could exhibit the same behavior. Condition is
on the field joint erosion after STS 41-B. The O- acceptable."151
ring problems (field and nozzle) on 41-B were At the Level I Flight Readiness Review for
briefed as a "technical issue" in the 41-C Flight 51-E on February 21, 1985, the previous 18-page
Readiness Review. "Probable causes" were de- analysis had been reduced to a one page chart
fined as: with the resolution: "acceptable risk because of
"Putty blow-through at ignition causes limited exposure and redundancy (Ref. STS 41-C
cavity between putty and primary O-ring to FRR)".152 No mention of temperature was found
fill during pressurization. Inability of putty in the Level I report.
to withstand motor pressure. Air entrapment The last major discussion of erosion was at the
in putty during mating. Blow holes in putty Level I Flight Readiness Review for STS 51-F
during joint leak test." (July 2, 1985).153 An analysis of the failure of the
Thiokol presented the question at its 41-C pre- nozzle primary O-ring to seal due to erosion on
board to Marshall, "If primary O-ring allowed flight STS 51-B (April 29, 1985) was presented.
a hot gas jet to pass through, would the second- This serious erosion was attributed to leak check
ary O-ring survive impingement?"148 At the 41-C procedures. An increase in the nozzle leak check
Level I Flight Readiness Review, on March 30, to 200 psi was proposed to be a cure. There was
1984, Marshall said the erosion phenomenon was no mention of the fact that .171 inches of ero-
"acceptable" and that blow holes in the putty were sion on the primary O-ring far exceeded a more
the "most probable cause." The rationale for the recent analysis model prediction of .070 inches
acceptance of the possibility of erosion on STS maximum possible erosion. This was a revision
41-C was: of the former prediction of .090 inches. The
"Conservative analysis indicates max erosion launch constraint activated after STS 51-B was
possible: not specifically listed in the Level I Flight
Readiness Review for 51-F. The Commission has
".090 in. (field joint)
also not found any mention of the July 1985 con-
".090 in. (nozzle joint)
straint, or its waiver for subsequent Shuttle
"Laboratory test of full scale O-ring/joint flights, in any Flight Readiness Review briefing
cross section shows capability to sustain joint documents.
147
The Commission's review of the Marshall and ment to configure the qualifications test
Thiokol documentary presentations at the various motor as it would be in flight, and the
Flight Readiness Reviews revealed several signifi- motors were static tested in a horizontal
cant trends. First, O-ring erosion was not con- position, not in the vertical flight
sidered early in the program when it first occur- position.
red. Second, when the problem grew worse after 2. Prior to the accident, neither NASA nor
STS 41-B, the initial analysis of the problem did Thiokol fully understood the mechanism
not produce much research; instead, there was by which the joint sealing action took
an early acceptance of the phenomenon. Third, place.
because of a belief that in-flight O-ring erosion 3. NASA and Thiokol accepted escalating
was "within the data base" of prior experience, risk apparently because they "got away
later Flight Readiness Reviews gave a cursory with it last time." As Commissioner
review and often dismissed the recurring erosion Feynman observed, the decision making
as within "acceptable" or "allowable" limits. was:
Fourth, both Thiokol and Marshall continued to "a kind of Russian roulette. . . .
rely on the redundancy of the secondary O-ring [The Shuttle] flies [with O-ring ero-
long after NASA had officially declared that the sion] and nothing happens. Then it
seal was a non-redundant single point failure. is suggested, therefore, that the risk
Finally, in 1985 when temperature became a ma- is no longer so high for the next
jor concern after STS 51-C and when the launch flights. We can lower our standards
constraint was applied after 51-B, NASA Levels a little bit because we got away with
I and II were not informed of these developments it last time. . . . You got away with
in the Flight Readiness Review process. it, but it shouldn't be done over and
over again like that."154
4. NASA's system for tracking anomalies for
Flight Readiness Reviews failed in that,
Findings despite a history of persistent O-ring ero-
sion and blow-by, flight was still per-
The genesis of the Challenger accident-the
mitted. It failed again in the strange se-
failure of the joint of the right Solid Rocket
quence of six consecutive launch con-
Motor began with decisions made in the design
straint waivers prior to 51-L, permitting
of the joint and in the failure by both Thiokol and
it to fly without any record of a waiver,
NASA's Solid Rocket Booster project office to
or even of an explicit constraint. Track-
understand and respond to facts obtained dur-
ing and conunuing only anomalies that
ing testing.
are "outside the data base" of prior flight
The Commission has concluded that neither
allowed major problems to be removed
Thiokol nor NASA responded adequately to in-
from, and lost by, the reporting system.
ternal warnings about the faulty seal design. Fur-
5. The O-ring erosion history presented to
thermore, Thiokol and NASA did not make a
Level I at NASA Headquarters in
timely attempt to develop and verify a new seal
August 1985 was sufficiently detailed to
after the initial design was shown to be deficient.
require corrective action prior to the next
Neither organization developed a solution to the
flight.
unexpected occurrences of O-ring erosion and
6. A careful analysis of the flight history of
blow-by even though this problem was experi-
O-ring performance would have revealed
enced frequently during the Shuttle flight history.
the correlation of O-ring damage and low
Instead, Thiokol and NASA management came
temperature. Neither NASA nor Thiokol
to accept erosion and blow-by as unavoidable and
carried out such an analysis; consequent-
an acceptable flight risk. Specifically, the Com-
ly, they were unprepared to properly
mission has found that:
evaluate the risks of launching the 51-L
1. The joint test and certification program mission in conditions more extreme than
was inadequate. There was no require- they had encountered before.

148
39
References Report, "Analytical Evaluation of the Space Shuttle SRM
Tang/Clevis Joint Behavior," Thiokol, October 6, 1978, PC
1
Letter, Dorsey to Hardy, November 7, 1978. 102302.
40
2
Report, "STS-3 through STS-25 Flight Readiness Reviews Report, "Space Shuttle Verification/Certification Review
to Level III Center Board," NASA. Propulsion Committee Cognizant Engineers 5th Meeting,"
:i
Ibid. NASA, July 10, 1980, pages C-7-22.
41
4
Report, "Selection of Contractor for Space Shuttle Program Commission Hearing Transcript, May 2, 1986, page 2807.
42
SRM," NASA, December 12, 1973; GAO Report B-17367, page Report, "Verification/Certification Space Shuttle Program
339. Response to Assessment," NASA, September 1980, page 59, PC
5
Ibid., page 6. 094010.
43
" Ibid., pages 21 and 22. Report, "SRM Program Response." NASA, August 15.
7
Ibid., page 18. 1980, PC 102359.
44
8
Ibid., page 7. NASA Handbook, NASA, 5300.4 (1D-2), Appendix A, page
9
Ibid., page 20. a-1.
45
1,1
Chart, "SRM and Titan III Clevisjoint Comparison," from Commission Interview Transcript, A. Aldrich, April 8, 1986,
Pclham presentation to Commission Development and Produc- page 13.
46
tion Subcommittee, March 17, 1986, page 3, PC 73978. Memorandum, Abrahamson to Bcggs, December 8, 1981.
47
11
Chart, "Segment/Segment Interface," from Pelham presen- Ibid.
48
tation to Commission Development and Production Subcommit- Report, "Erosion of SRM Pressure Seals," Thiokol, August
tee, March 17, 1986, page 2, PC 73977. 19, 1985, Rev. A (February 10, 1986), page A-4a.
49
12
Report, "Thiokol Space Shuttle Joint Review," Thiokol, Commission Interview Transcript, Thomas, J.W., April 10,
February 25, 1986, PC 021453. 1986, pages 64-66; and Reports, Marshall Space Flight Center
'3 Ibid. Problem Assessment Reports, NASA.
50
14
Ibid. Report, "Post-flight Evaluation of STS-2 SRM Com-
15
Report, "Presidential Commission Development and Pro- ponents," Thiokol, January, 1983, part 1, page 2, TWR 13286.
51
duction Panel, Response to Panel Question/Special Actions Report, "NASA Response to Commission Request DP-006,"
SRM and Titan III Clevis Joint Comparison," Thiokol, April NASA, March 17, 1986, PC 074021.
52
3, 1986, PC 073979. Report, "STS-8, SRB Pre-Board Flight Readiness Review,"
16
Report, "Original Design of Joint Assembly SRB Morton Thiokol, July 29, 1983.
53
Thiokol," Thiokol, July 13, 1973, PC 009350; and Commission Report, "Retention Rationale, SRM Simplex Seal," Thiokol,
Work Session, Panel on Development and Production, April 17, December I, 1982, page 4; and Report, "Critical Items List,"
1986, page 18. NASA, December 17, 1982.
54
17
Report, "1974 Proposal Write Up On Case Design," Thiokol, Report. "SRB Critical Items List," NASA, December 17,
1974, page 4. 3-3, PC 010957. 1982.
18 55
Ibid., page 4. 3-19, PC 010973. Report, "Retention Rationale, SRM Simplex Seal," Thiokol,
19
Commission Work Session, Development and Production December 1, 1982, page 5.
56
Panel, April 7, 1986, page 118. Ibid., page 4.
57
20
Commission Interview Transcript, Mclntosh, H., April 2, Commission Interview Transcript, Mclntosh, H., April 2,
1986, page 5. 1986, page 66.
21 58
Ibid. Commission Hearing Transcript, May 2, 1986, pages
22
Letter, Brian Russell to Bob Ebeling, Thiokol, April 9, 1986, 2729-30.
59
PC 091702 and Commission Hearing Transcript, May 2, 1986, Ibid., footnote 31, page 1.
60
pages 2653-2658. Commission Hearing Transcript, February 26, 1986, pages
23
Commission Hearing Transcript, February 6, 1986, page 30. 1700-1701.
61
24
Report, "Space Shuttle Case Burst Test Report," Thiokol, Commission Hearing Transcript, February 26, 1986, pages
December 21, 1977, PC 049551-049648, TWR-11664. 1514-1516.
25 62
Ibid. Report, "Space Transportation System Level I Change
26
Report, "Analytical Evaluation of the Space Shuttle Solid Request Report, SRB Critical Items List Requirements,"
Rocket Motor Tang/Clevis Joint Behavior," Thiokol, October NASA, March 2, 1983, page 1; and Report, "Space Shuttle Pro-
6, 1978, TWR-12019; and Report, "SRM Clevisjoint Leakage gram Requirements Control Board Directive Level II SRB
Study," NASA, October 21, 1977. Critical Item List Requirements for SRM Case Joint Assemblies,"
27
Commission Hearing Transcript, February 25, 1986, page NASA, March 2, 1983, page 1.
63
1435. Report, "Space Shuttle Program Requirements Document
28
Commission Hearing Transcript, May 2, 1986, page 2784. Level I," NASA, June 30, 1977, page A-8.
64
29
Report, "SRM Clevisjoint Leakage Study," NASA, October Commission Hearing Transcript, May 2, 1986, pages
21, 1977, PC 102337. 2842-2844.
65
30
Letter, Miller to Eudy, January 9, 1978, PC 009923. Commission Hearing Transcript, May 2, 1986, page 2845;
31 and Report, "Space Shuttle Program Requirements Control Board
Letter, Miller to Eudy, January 19, 1979, PC 009921.
32 Directive Level II, SRB Critical Item List Requirements for
Ibid.
33 SRM Case Joint Assemblies," NASA, March 2, 1983, page 1.
Ibid., footnote 31.
66
34
Commission Hearing Transcript, May 2, 1986, page 2782. Commission Hearing Transcript, May 2, 1986, page 2852.
67
35
Report, "Visit to Precision Rubber Products Corporation Commission Interview Transcript, A. Aldrich, and R.
and Parker Seal Company," NASA, February 6, 1979. Kohrs, April 8, 1986, pages 19-20.
36 68
Ibid. Commission Interview Transcript, L. Weeks, April 7, 1986,
37
Commission Hearing Transcript, May 2, 1986, page 2782. page 16.
69
38
Report, "Phase I Design Certification Review," Thiokol, Ibid., footnote 54.
March 23, 1979, TWR-12230.

149
70 100
Report, "MSFC Problem Assessment Report O-Ring Ero- Report, "Problem Assessment System Record #A07934,"
sion in the Case to Nozzle Joint," NASA, February 26, 1986, NASA, page 3, PC 037598.
101
page 1 of 3; and Commission Inteniew Transcript, W. Hankins. Memorandum, "51-C O-Ring Erosion Re: 51-E FRR,"
April 2, 1986, page 11. Mulloy to Wear, 01/31/85, PC 102482.
71 102
Report, "Erosion ol'SRM Pressure Seals," Thiokol, February Report, "STS 51-E Flight Readiness Review," Thiokol,
10, 1986, TWR-15150 Revision A; and Chart, "History of O- February 8, 1984, TWR-14740 Rev. B Section 1, page 4.
103
Ring Damage in Field Joints" from Thiokol's presentation on Ibid., Section 6, page 4.
104
February 25, 1986 to Commission, PC 072076 and PC 072077. Report, "SRM Seal Erosion Problems," NASA, March 19,
72
Report, "Case and Nozzle Joint Configuration Review," 1986, PC 10235.
105
Thiokol, July 2, 1980, pages 2 and 5; and Report, "Erosion of Report, "O-Ring Resiliency Testing," Thiokol, June 3,
SRM Pressure Seals," Thiokol, August 19, 1986, pages A-4 and 1985, PC 102509; and Memorandum, "Actions Pertaining to Field
A-6, TWR-15150. Joint Secondary Seal," B. Russel, Thiokol, August 9, 1985, PC
" Report, "Char Condition on O-Ring Seal in Forward Field 102543.
Joint of SRM A57 of STS-11 Flight Mission 41-B," Thiokol, en- >06 Ibid.
i07
try of March 12, 1984, page 5, TWR-14283; and Report, "MSFC Commission Hearing Transcript, May 2, 1986, page 2591.
108
Problem Assessment System Segment Joint Primary O-Ring Commission Hearing Transcript, May 2, 1986, pages
Charred," NASA, February 17, 1984. 2606-2607.
74 109
Report, "MSFC Problem Assessment System Segment Commission Hearing Transcript, May 2, 1986, page 2591.
110
Joint Primary O-Ring Charred," NASA, entry of March 12, 1984, Memorandum, Lindstrom to Distribution, NASA,
page 5, TWR-14283. September 15, 1980, page 1.
75 111
Letter, Morefield to Mulloy, March 9, 1984. Report, "MSFC Problem Assessment System," February
76
Report, "Flight Readiness Review-41C Level I," NASA, 26, 1986, PC 037710.
112
March 30, 1984. Report, "SRM Seal Erosion Problem, Revised," March 19,
77
Hans Mark 41-C Programmatic Action Item, NASA, March 1986, PC 037593.
113
30, 1984. Commission Hearing Transcript, May 2, 1986, page 2735.
78 114
Letter, Abrahamson to Lucas, January 18, 1984, PC 008191. Letter, McDonald to Wear, Thiokol, December 10, 1985,
79
Letter, Wear to Kilminster, April 13, 1984, pages 1 and 2. PC 49701.
80 1,5
Report, "Protection of Space Shuttle SRM Primary Motor Commission Hearing Transcript, May 2, 1986, excerpt
Seals," Thiokol, May 4, 1984, PC 014053. beginning pages 2590 through 2646.
81 116
Report, "Erosion of SRM Pressure Seals Presentation to Commission Hearing Transcript, May 2, 1986, page 2589.
117
NASA HQ," Thiokol, August 19, 1985, page 1, and "STS 41-C Commission Hearing Transcript, May 2, 1986, page 2635.
118
Action Item Closeout," L. Mulloy, S. Reinartz, NASA, February Commission Hearing Transcript, May 2, 1986, page 2867.
119
20, 1986. Memorandum, Winterhalter to Weeks, June 28, 1985.
82 120
Routing slip. Miller to Hardy, NASA, February 28, 1984, Memorandum, R. Boisjoly, July 22, 1985.
121
PC 0266494. Memorandum, R. Boisjoly, July 31, 1985.
83 122
Report, "SRM Field Joint Zinc Chromate Vacuum Putty Letter, "Actions Pertaining to SRM Field Joint Secondary
Test Report," Thiokol, April 21, 1983, page 13. Seal," Russell to Thomas, August 9, 1985.
84 123
Report, "SRM Joint Putty, O-Ring, and Leak History," Report, "Erosion of Solid Rocket Motor Pressure Seal Up-
Thiokol, April 9, 1984, page 1, TWR-13484. dated from August 19, 1985-Revised February 10, 1986,"
85
Ibid.; and Report, "Erosion of SRM Pressure Seals," Thiokol, TWR-15150, PC 000769.
124
Thiokol, TWR-15150, page D-16, PC 002963. Ibid.
86 125
Ibid.; and Report, "SRB STS 9 Flight Readiness Review," Memorandum, Lund to Sayer, August 20, 1985.
NASA, November 4, 1983, page 35. 126 Memorandum, "SRM Flight Seal Recommendation,"
87
Report, "Erosion of Solid Rocket Motor Pressure Seals," Thompson to Stein, August 22, 1985.
Thiokol, August 19, 1985, TWR-15150, PC 021767. 127
Commission Hearing Transcript, February 14, 1986, page
88
Commission Hearing Transcript, May 2, 1986, page 2687. 1220.
89 128
Commission Hearing Transcript, May 2, 1986, page 2621. Report, "Program Plan Improvement of Space Shuttle SRM
90
Memorandum, B. Russell, Thiokol, June 13, 1984, "Minutes Motor Seal," Thiokol, August 30, 1985, page 6.
of Telecon with NASA MSFC on June 7, 1984," page 1, PC 129
Report, "Erosion of SRM Pressure Seals," Thiokol,
102463. September 10, 1985, pages A-l to C-5.
91 130
Memorandum, B. Russell, Thiokol, June 1, 1984, "Vacuum Letter, Kingsbury to Mulloy, September 5, 1985.
131
Putty/O-Ring Test Results," page 1. PC 102460. Report, "Activity Report Solid Rocket Motor Seal Prob-
92
Memorandum, J. Miller, March 6, 1985, NASA. lem Task Team Status," Thiokol, October 4, 1985.
93 132
Memorandum, Young to Director, Flight Crew Operations, Memorandum, Ebeling to McDonald, October 1, 1985,
March 3, 1986. page 1.
94 133
Commission Interview Transcript, M. Silveira, April 16, Ibid., page 2; and Report, "Erosion of SRM Pressure Seals,
1986, page 30. Update," February 10, 1986, pages A-4a, A-6a, TWR-1510,
95
Commission Interview Transcript, J. Beggs, May 1, 1986. PC000760.
134
pages 5-6. Report, "Level I STS 61-C Flight Readiness Review,"
96
Commission Hearing Transcript, February 27, 1986, page NASA, December 11, 1985.
135
1899. Ibid., footnote 133; and Report, "Solid Motor Branch
97
Report, "Flight Readiness Review STS 51-E SRM-16," Significant Events," NASA, December 12, 1985.
136
Thiokol, February 12, 1985, pages 3-1 through 3-17. Commission Hearing Transcript, May 2, 1986, pages
98
Commission Hearing Transcript, February 25, 1986, page 2746-2747.
137
1392. Memorandum, "Closure of SRM O-Ring Erosion Critical
99
Commission Hearing Transcript, February 14, 1986, page Problems," Russell to McDonald, December 6, 1985.
138
1202. Letter, McDonald to Wear, December 10, 1985.

150
139
Commission Hearing Transcript, May 2, 1986, pages
2682-2695.
140
Report, "Problem Assessment System," NASA, entry dated
December 18, 1985.
141
Ibid., entry January 23, 1986.
142
Commission Hearing Transcript, May 2, 1986, pages
2589-2590.
143
Ibid., pages 2619-2623.
144
Commission Hearing Transcript, February 11, 1986, pages
650-653.
145
Report, "Shuttle Project Flight Readiness Review (Pre-
launch Activities Team Report)," NASA, December 29, 1983,
page 75.
146
Reports, "STS-3 Flight Readiness Review for Levels I, II,
III and Contractor."
147
Commission Hearing Transcript, February 26, 1986, page
1639.
148
Report, "STS-13 Solid (41-C) Rocket Motor Flight
Readiness Review," Thiokol, March 2, 1984, page 2,
TWR-14231.
149
Report, "STS 41-C Flight Readiness Review Solid Rocket
Booster," NASA, March 30, 1984, page 39.
150
Report, "O-Ring Erosion on SRM-15," Thiokol, February
12, 1985, pages 1 through 17.
151
Report, "STS 51-E Flight Readiness Review," Thiokol,
February 12, 1985, TWR-14740 Rev. D., Section 3, page 17.
152
Report, "STS 51-E Flight Readiness Review, Level I,"
NASA, February 21, 1985, page 4.
153
Report, "STS 51-F Flight Readiness Review, Level I,"
NASA, July 2, 1985, page 5.
154
Commission Hearing Transcript, April 3, 1986, page 2469.

151
Chapter VII

The Silent Safety


Program

The Commission was surprised to reporting requirements, inadequate trend


realize after many hours of testimony analysis, misrepresentation of criticality and lack
that NASA's safety staff was never of involvement in critical discussions.2 A properly
mentioned. No witness related the staffed, supported, and robust safety organiza-
approval or disapproval of the reliability tion might well have avoided these faults and thus
engineers, and none expressed the satisfaction or eliminated the communication failures.
dissatisfaction of the quality assurance staff. No NASA has a safety program to ensure that the
one thought to invite a safety representative or communication failures to which Mr. Aldrich
a reliability and quality assurance engineer to the referred do not occur. In the case of mission 51-L,
January 27, 1986, teleconference between Mar- that program fell short.
shall and Thiokol. Similarly, there was no
representative of safety on the Mission Manage-
ment Team that made key decisions during the
countdown on January 28, 1986. The Commis- NASA's Safety Program
sion is concerned about the symptoms that it sees.
The unrelenting pressure to meet the demands The NASA Safety, Reliability and Quality
of an accelerating flight schedule might have been Assurance Program should play an important role
adequately handled by NASA if it had insisted in agency activities, for the three concerns in-
upon the exactingly thorough procedures that dicated in the program title are its functions. In
were its hallmark during the Apollo program. An general terms, the program monitors the status
extensive and redundant safety program com- of equipment, validation of design, problem
prising interdependent safety, reliability and analysis and system acceptability. Each of these
quality assurance functions existed during and has flight safety implications.
after the lunar program to discover any poten- More specifically, safety includes the prepara-
tial safety problems. Between that period and tion and execution of plans for accident preven-
1986, however, the program became ineffective. tion, flight system safety and industrial safety re-
This loss of effectiveness seriously degraded the quirements. Within the Shuttle program, safety
checks and balances essential for maintaining analyses focus on potential hazards and the assess-
flight safety. ment of acceptable risks.
On April 3, 1986, Arnold Aldrich, the Space Reliability refers to processes for determining
Shuttle program manager, appeared before the that particular components and systems can be
Commission at a public hearing in Washington, relied on to work as planned. One product of such
D.C. He described five different communication processes is a Critical Items List that identifies
or organization failures that affected the launch how serious the failure of a particular item or
decision on January 28, 1986.1 Four of those system would be.
failures relate directly to faults within the safety Quality assurance is closely related to both safe-
program. These faults include a lack of problem ty and reliability. All NASA elements prepare

152
plans and institute procedures to insure that high Criticality 3 All others.
standards of quality are maintained. To ac- Criticality 1R Redundant components, the
complish that goal, elements charged with respon- failure of both could cause
sibility for quality assurance establish procedural loss of life or vehicle.
controls, assess inspection programs, and par- Criticality 2R Redundant components, the
ticipate in a problem identification and reporting failure of both could cause
system. loss of mission.
The Chief Engineer at NASA Headquarters,
The assignment of criticality follows a highly
has overall responsibility for safety, reliability and
detailed analysis of each Space Shuttle compo-
quality assurance. The ability of the Chief
nent to determine the effect of various ways the
Engineer to manage NASA's safety program is
component could fail. This analysis always
limited by the structure of safety, reliability and
assumes the most adverse conditions with the
quality assurance organizations within the agen-
most conservative assumptions. Any component
cy. His limited staff of 20 persons3 includes only
that does not meet the fail-safe design require-
one who spends 25 percent of his time on Shut-
ment is designated a Criticality 1 item and must
tle maintainability, reliability and quality
receive a waiver for use. A Critical Items List is
assurance and another who spends 10 percent of
produced that contains information about all
his time on these vital aspects of flight safety.4
Criticality 1 components. The Solid Rocket
At Johnson, a large number of government and
Booster Critical Items List entry for the field joint,
contractor engineers support the safety, reliability
dated December 17, 1982 is an example of this
and quality assurance program, but needed ex-
process.
pertise concerning Marshall hardware is absent.
Component criticality is related to test re-
Thus the effectiveness of the oversight respon-
quirements in the Operational Maintenance Re-
sibilities at Level II was limited.5
quirements and Specifications Document pub-
Kennedy has a myriad of safety, reliability and
lished and maintained by Level II at Johnson.
quality assurance organizations. In most cases,
For the Orbiter, the references from the Critical
these organizations report to supervisors who are
Items List to the requirements and specifications
responsible for processing. The clear implication
document are complete and traceable in both
of such a management structure is that it fails to
directions. The Solid Rocket Booster Critical
provide the kind of independent role necessary
Items List, however, does not include references
for flight safety.
to the requirements and specifications document.7
At Marshall, the director of Reliability and
Such references would make the Critical Items
Quality Assurance reports to the director of
List a more efficient management tool for track-
Science and Engineering who oversees the
ing activities concerned with items critical for
development of Shuttle hardware. Again, this
flight safety.
results in a lack of independence from the pro-
The next step in procedures documentation is
ducer of hardware and is compounded by reduc-
the Operations and Maintenance Instruction,
tions in manpower,6 the net bringing about a
which develops the directives into step-by-step
decrease in effectiveness which has direct implica-
procedures used at Kennedy by technicians, in-
tions for flight safety.
spectors and test personnel to accomplish each
step of the hardware preparations for flight. The
current Operations and Maintenance Instruction
Monitoring Safety Critical Items does not indicate the criticality level of
components.
As part of the safety, reliability and quality
If the Operations and Maintenance Instruction
assurance effort, components of the Shuttle
clearly indicated when the work to be performed
system are assigned to criticality categories as
related to a Criticality 1 component, all concerned
follows:
would be alerted that a higher than normal level
Criticality 1 Loss of life or vehicle if the of care should be used. The same point applies
component fails. to production activities at Thiokol where criticali-
Criticality 2 Loss of mission if the com- ty should be directly incorporated into manufac-
ponent fails. turing quality planning.

153
Problem Reporting flight are addressed in Space Shuttle Program
Directive 34E. For the Solid Rocket Booster, the
Prior to 1983, Level III was required to report Huntsville Operations Support Center is charged
all problems, trends, and problem closeout ac- with these activities as well as other evaluations
tions to Level II unless the problem was and documentation of mission results.
associated with hardware that was not flight- "The Space Shuttle Project Managers at
critical.8 Unfortunately, this requirement was Kennedy, Johnson, and Marshall, and the
substantially reduced to include only those prob- Manager for Systems Integration are
lems which dealt with common hardware items responsible for the implementation of this
or physical interface elements. The revision directive in their respective areas."11
eliminated reporting on flight safety problems,
flight schedule problems, and problem trends. A letter dated October 20, 1981, from the
The change to the reporting requirements was manager of the National Space Transportation
signed by James B. Jackson, Jr., for Glynn Lun- System (Level II) addressed flight anomaly
ney, who was at that time manager of the Na- resolution:
tional Space Transportation System (Level II "Beginning with the STS-2 evaluations,
manager). The change was submitted by Mar- the enclosed new form and instructions,
tin Raines, director of Safety, Reliability and outlined in enclosure 1, will be utilized for
Quality Assurance at Johnson.9 With this action. all official flight anomaly closeouts. Flight
Level II lost all insight into safety, operational anomalies will be presented for review and
and flight schedule issues resulting from Level III closeout at the Noon Special PRCB [Pro-
problems. gram Requirements Change Board]. The
On May 19, 1986, Mr. Raines wrote a memo briefing charts will be prepared by the Proj-
in which he explained that the documentation ect elements, and should include a
change was made in an attempt to streamline the schematic/graph/sketch of the problem area.
system since the old requirements were not pro- This material, along with the closeout form
ductive for the operational phase of the Shuttle and appropriate signatures, will become a
program.10 In retrospect, it is still difficult to part of the permanent closeout record.
understand why the director of Safety, Reliability Enclosure 2 provides a sample of closeout
and Quality Assurance at Johnson initiated this material from STS-1 that would be
action, and it is even more difficult to understand acceptable.
why Level II approved it. "Your cooperation in this activity will be
A review of all Level III monthly problem appreciated."12
reports (Open Problem List) issued by Marshall Since O-ring erosion and blow-by were con-
during 1984 and 1985 indicates that none was sidered by Marshall to be flight anomalies,13 the
distributed to Level II management. From a letter above would appear to require reporting
lengthy list of recipients, only a single copy was by the Solid Rocket Booster Project Office to
sent to Johnson, and that one was sent to an Level II. However, the sample closeout material
engineer in the flight control division. Mr. attached to the 1981 letter was identified as per-
Aldrich's office and the entire Johnson safety, taining to "Flight Test" (the first four flights). The
reliability and quality assurance directorate were 1983 change might well have been interpreted as
not on the distribution list for the problem superseding the 1981 Lunney letter, particular-
reports. A Rockwell International safety, reliabil- ly since the program officially became "opera-
ity and quality assurance contractor at Johnson tional" in late 1982.
received a statistical summary of problem status, The reporting of anomalies (unexpected events
but not the actual problems descriptions. or unexplained departures from past experience)
that occur during mission performance is a key
Reporting of In-flight Anomalies ingredient in any reliability and quality assurance
A second method of notifying Level II of prob- program. Through accurate reporting, careful
lems would have been through the in-flight analysis and thorough testing, problems or recur-
anomaly reporting channels. The identification rence of problems can be prevented. In an effec-
and resolution of anomalies that occur during tive program, reporting, analysis, testing and im-

154
plementation of corrective measures must be fully expected function of any reliability and quality
documented. assurance program. As previously noted, the
The level of management that should be in- history of problems with the Solid Rocket Booster
formed is a function of the seriousness of the prob- O-ring took an abrupt turn in January, 1984,
lem. For Criticality 1 equipment anomalies, the when an ominous trend began. Until that date,
communications must reach all levels of manage- only one field joint O-ring anomaly had been
ment. Highly detailed and specific procedures for found during the first nine flights of the Shuttle.
reporting anomalies and problems are essential Beginning with the tenth mission, however, and
to the entire process. The procedures must be concluding with the twenty-fifth, the Challenger
understood and followed by all. flight, more than half of the missions experienced
Unfortunately, NASA does not have a concise field joint O-ring blow-by or erosion of some
set of problem reporting requirements. Those in kind.
effect are found in numerous individual In retrospect, this trend is easily recognizable.
documents, and there is little agreement about According to Wiley Bunn, director of Reliabil-
which document applies to a given level of ity and Quality Assurance at Marshall;
management under a given set of circumstances
for a given anomaly. "I agree with you from my purview in
quality, but we had that data. It was a mat-
ter of assembling that data and looking at
Safety Program Failures it in the proper fashion. Had we done that,
the data just jumps off the page at you."14
The safety, reliability and quality assurance This striking change in performance should
program at Marshall serves a dual role. It is have been observed and perhaps traced to a root
responsible for assuring that the hardware cause. No such trend analysis was conducted.
delivered for use on the Space Shuttle meets While flight anomalies involving the O-rings
design specifications. In addition, it acts as a received considerable attention at Morton
"watch dog" on the system to assure that sound Thiokol and at Marshall, the significance of the
engineering judgment is exercised in the use of developing trend went unnoticed. The safety,
hardware and in appraising hardware problems. reliability and quality assurance program, of
Limited human resources and an organization course, exists to ensure that such trends are
that placed reliability and quality assurance func- recognized when they occur.
tions under the director of Science and Engineer- A series of changes to Solid Rocket Booster
ing reduced the capability of the "watch dog" role. processing procedures at Kennedy may be signifi-
Much of what follows concerns engineering cant: on-site O-ring inspections were discon-
judgments and decisions by engineers and tinued; O-ring leak check stabilization pressure
managers at Marshall and Morton Thiokol. It on the field joint was increased to 200 pound per
is the validity of these judgments that the Com- square inch from 100, sometimes blowing holes
mission has examined closely. In its "watch dog" through the protective putty; the patterns for posi-
role, an effectively functioning safety, reliability tioning the putty were changed; the putty type
and quality assurance organization could have was changed; re-use of motor segment casings in-
taken action to prevent the 51-L accident. creased; and a new government contractor began
In the discussion that follows, various aspects management of Solid Rocket Booster assembly.
of the Solid Rocket Booster joint design issue One of these developments or a combination of
discussed earlier will be reviewed in the context them was probably the cause of the higher
of safety, reliability and quality assurance. The anomaly rate. The safety, reliability and quality
critical issue, discussed in detail elsewhere, in- assurance program should have tracked and
volves the O-rings installed to seal the booster discovered the reason for the increasing erosion
joints. and blow-by.
The history of problems in the nozzle joint is
Trend Data similar to that of the Solid Rocket Booster field
Development of trend data and the possible joint. While several of the changes mentioned
relationships between problems is a standard and above also could have influenced the frequency

155
Pressure tests at 200 pounds per square inch of the Solid
Rocket Booster joints produced bubbles in putty used to line
the joints.

of nozzle O-ring problems, the frequency cor- was visible on the inside core of the Solid Rocket
relates with leak check pressure to a remarkable Booster.
degree. The trends of flight anomalies in relation to
Again, development of trend data is a standard leak check stabilization pressure are illustrated for
and expected function of any reliability and qual- the field joint and the nozzle joint in Figure 3,
ity assurance program. Even the most cursory ex- on page 133. While the data point concerning the
amination of failure rate should have indicated 100 pound per square inch field joint leak check
that a serious and potentially disastrous situation is not conclusive since it is based on only two
was developing on all Solid Rocket Booster joints. flights, the trend is apparent.
Not recognizing and reporting this trend can only Management Awareness
be described, in NASA terms, as a "quality During its investigation, the Commission
escape," a failure of the program to preclude an repeatedly heard witnesses refer to redundancy
avoidable problem. If the program had func- in the Solid Rocket Motor joint and argue over
tioned properly, the Challenger accident might the criticality of the joint. While the field joint
have been avoided. The trend should have been has been categorized as a Criticality 1 item since
identified and analyzed to discover the physical 1982 (page 157), most of the problem reporting
processes damaging the O-ring and thus jeopard- paperwork generated by Thiokol and Marshall
izing the integrity of the joint. listed it as Criticality 1R, perhaps leading some
A likely cause of the O-ring erosion appears managers to believe wrongly that redundan-
to have been the increased leak check pressure cy existed. The Problem Assessment System
that caused hazardous blow holes in the putty. operated by Rockwell contractors at Marshall,
Such holes at booster ignition provide a ready which routinely updates the problem status still
path for combustion gases directly to the O-ring. listed the field joint as Criticality 1R on March
The blow holes were known to be created by the 7, 1986, more than five weeks after the accident.
higher pressure used in the leak check. The Such misrepresentation of criticality must also be
phenomenon was observed and even photo- categorized as a failure of the safety, reliability
graphed prior to a test firing in Utah on May 9, and quality assurance program. As a result, in-
1985. In that particular case, the grease from the formed decision making by key managers was
O-ring was actually blown through the putty and impossible.

156
5RB CRITICAL ITEMS LIST Bw-L.''^-

jafttYJii" sguo iccai acpsTga Cftitiiity Cut^oti . Hticiion Tow tfl <>.<;,

, Codi 10'OWOl Pjjt: A>A

mm Hum (Joint Aisyi. Factory ?/N lu0U? Ftela: 'mSOTa? RtYrtiW*;

vo. Itcuwto: 1 Ui igq^ents. 1 FlilA Joints 7 plant JointiJ 0u: ..DtCf^fr 17. ]952

Anwt;C*rbgr

C:iKii ^;iit: Booit ADOrOVtd ^^^ZZ


Fii' Moo<4 Cjum Ltsnaqe it ce s$emt)ly jointJ 4uc to reduntwnt O-riny seal f*UureJ or pnnary nil ina
leak check port O-rlng Cjtlure.

NOTE: Leaksg* of the prlnary 0-rlng sel Is cUj1f<ed ts a jlnijlt f11ure point due to po$t6(Hty of lOSI of
veJTtng *L tne secondary 0-nng because of joint rotation after motor pressuMzaclon.

fi.iurf fitctSummirv: Actual loss -Loss of miyslon, vehicle,, and crew du to-metal erosion, burnthrousn, Ad
probable case.burst resulting in fir* and deflagration.

RATIONALE FOR RETENTION

Case, P/N lUS0129,'iu50131, 1U50U0. lUSOlES. 1US0147. 1US0715, 1U50716, IUS0717


A. DESIGN

The SRM case joint design Is conmon In the lightweight and regular weight cases having Identical d1tni1o$.
The joint concept Is basically the same as the single 0-ring Joint successfully emoloyeu on tha Titan III
solid rocket motor. The S^M joint uses centering clips which are installed in the gap between th tang 0.0.
and the outside Oevis leg to rrtunpnsate ''CT- the loss of concentricity due to gathering and to rtduca tht
total clevis gao wnich has been provioed for ease OT ass&iol^. On the thutrla SRH. tht secondary 0-ring
was designed to provide redundancy and to permit a leak check, ensuring propjr installation of tfl i>r1r;y.
Full redundancy exists at the ncment of initial pressurization. However, test data shows that a phnor.tnon
called joint rotation accjrs as the sressur* rises, ooenlne uo the O-r-ing extrusion gaa and permitting tht
energized 0-ring to srotrude into the gap. This candition'has been snewn py test to be well within that
required for safe primary 0-ring sealing. This gap may, hewever, in seme cases, increase sufflcltntly to
cause the unenergueo secondary O-rmg to lose cor.oretsion, raising Question as to Its ability to tBerglrt
and seal if called uoon to oo so by pri.rar/ seal failure. Since, unaer this latter condition only tha
Single 0>r1ng U sealing, a rationale for retention is provided for the simplex node wnerc only one 0-rlng
Is acting.

A snail M5 port leading to the annular cavity between the redundapt teals pemits a leak Lheck of the seals
litnedlately after joining se'jn-ents. The MS plug, installed after'leak test, has a retaining groovt and
conpression face for its o-nng seal, A rr.eam to test the seal of the Installed MS plug has not Bean
established.

The O-rlngs for the case joints are mold formed and ground to close tolerance and the 0-rlngj for the ttst
port are mold formed to net dimensions. Both 0-rlngs are made for high tonnerature, low compression set
fluorocaroon elastcmer. The dtsign pemits five scarf joints for the case Joint seal rings. Th* 0-rlnfl
Joint strength must equal or exceed 40X of the parent naterlal strength.

6. TESTING

To date, eight static firings and five flights have resulted In ISO (5^ field and 126 factory) Joints
tested with no evidence of leakage. The Titan III program using a similar joint concept has tastod a total
tf 1076 joints successfully.

157
SRB CRITICAL ITEMS LIST 'JL-'JL.
(nmcouit
SutlYlltm: sou? oricrtr gfigSISS C'lttcilirv Cutioiy. ftuctioi Trtnt n <*(

lltm tadi: lO-Ol-Ol ^.: A-6B


C*e, ?/N ($ Rotention Rationale)
l^isi taxL iuxix* p"i IX1S2S1 thU: !l!gHZ *tviiio:

RATIONALE FOR RETENTION (CCNTD)

Test (TVR .
tO the nn5 cm pcrmU iny 1e*k2gt.
Further demonstration of the caoabllity or Joint jealing u found in th hy<iTo-proof tet<r of nw and
refurolshea case septents. Over 540 joints have oeen exposed to llouid pressurlzatlons at levels
exceeding motor f.lQ? wit.t no leakaae exoerltnced past the prir^ry i-ring. The only occasions where leakioe
was experienced was during refuroiDvnent of STS-1 wnere two jfiffentr segraenti were severely damtped duniig
uvity collapse ac water Impact.

A eiore detailed description of 5W1 Joint testing history Is contained In TWIM3520. (levlslon A.
C. INSPECTION

The tang -A- diameter and clevis -C- diameter are measured and reconiid. The deoth, width and surface
finish of the O-rings grooves are verified. The surface finish of the tano is also verified. Characteristics
ere Inspected on each 0-nng to assure conformance to the standares to include:
o Surface conditions
0 Hold flashing
0 Scerf Joint (nljmatch or separation
e Cross section
o Clrcurfarence
e Duraneter

Each esseniMed joint seal 1 tested per STW7-2747 via pressurlting the annular cavity between seals to SO
5 psl and monitoring for 10 minutes. A pressure decay of 1 psig cr ereatcr is not acceptable. Following
seal verification by QC, We leak test port plug Is installed-with CC_verifyin<) installation and torquing.
0. FAIIUR! HISTORY

No fellurtx Kv b;*r, c.rperlcnced in t.k.c statli firing if u.re* suallfication motors, five development
motors and ten flight motors.

158
Mr. Bunn, the director of Reliability and since the exact time that field joint anomalies had
Quality Assurance at Marshall, stated on April become dangerously frequent. At the time of this
17, 1986: briefing, the increased pressure already had been
used on four Solid Rocket Motor nozzle joints, ,
"But the other thing you will notice on
and all four had erosion. Erosion was the enemy,
those problem reports is that for some reason
and increased pressure was its ally.
on the individual problem reports we kept
While Mr. Moore was not being intentionally
sticking [Criticality] 1-R on them and that
deceived, he was obviously misled. The report-
is just a sheer quality escape."15
ing system simply was not making trends, status
and problems visible with sufficient accuracy and
The Impact of Misinformation
emphasis.
The manner in which misinformation in-
fluences top management has been illustrated by
former Associate Administrator for Space Flight Reporting Launch Constraints
Jesse Moore. The Commission was surprised to learn that
a launch constraint had been imposed on the
"And then we had a Flight Readiness Solid Rocket Booster. It was further surprised to
Review, I guess, in July, getting ready for learn that those outside of Marshall were not
a mid-July or a late July flight, and the ac- notified. Because of the seriousness of the mis-
tion had come back from the project office. sion 51-B nozzle O-ring erosion incident, launch
I guess the Level III had reported to the constraints were placed against the next six Shut-
Level II Flight Readiness Review, and then tle flights. A launch constraint arises from a flight
they reported up to me that they reported safety issue of sufficient seriousness to justify a
the two erosions on the primary (O-ring) and decision not to launch. The initial problem
some 10 or 12 percent erosion on the sec- description stated that, "based on the amount of
ondary (O-ring) on that flight in April, and charring, the erosion paths on the primary O-ring
the corrective actions, I guess, that had been and what is understood about the erosion
put in place was to increase the test pressure, phenomenon, it is believed that the primary O-
I think, from 50 psi [pounds per square inch] ring of SRM 16A [the Solid Rocket Motor on
to 200 psi or 100 psi I guess it was 200 psi flight 51-B] never seated."17 The maximum ero-
is the number and they felt that they had sion depth was 0.171 inches on the primary O-
run a bunch of laboratory tests and analyses ring and 0.032 inches on the secondary. On
that showed that by increasing the pressure February 12, at a Level III Flight Readiness
up to 200 psi, this would minimize or Review, maximum expected erosion on nozzle
eliminate the erosion, and that there would joint O-rings had been projected as 0.070 inches
be a fairly good degree of safety factor for the primary and 0.004 inches for the second-
margin on the erosion as a result of increas- ary. Thus, the results far exceeded the max-
ing this pressure and ensuring that the sec- imum expected. If this same ratio of actual to pro-
ondary seal had been seated. And so we left jected erosion were to occur on a field joint, the
that FRR [Flight Readiness Review] with erosion would be 0.225 inches. With secondary
that particular action closed by the proj- seal inadequacy, as indicated by Criticality 1
ect. 16
status, that degree of erosion could result in joint
Not only was Mr. Moore misinformed about failure and loss of vehicle and crew.
the effectiveness and potential hazards associated The Problem Reporting and Corrective Action
with the long-used "new" procedure, he also was document (JSC 08126A, paragraph 3.2d) re-
misinformed about the issue of joint redundan- quires project offices to inform Level II of launch
cy. Apparently, no one told (or reminded) Mr. constraints. That requirement was not met.
Moore that while the Solid Rocket Booster noz- Neither Level II nor Level I was informed.
zle joint was Criticality 1R, the field joint was
Criticality 1. No one told him about blow holes Implications of an Operational Program
in the putty, probably resulting from the in- Following successful completion of the orbital
creased stabilization pressure, and no one told flight test phase of the Shuttle program, the
him that this "new" procedure had been in use system was declared to be operational. Subse-

159
quently, several safety, reliability and quality alert and vigorous organization that oversees the
assurance organizations found themselves with flight safety program.
reduced and/or reorganized functional capabil-
ity. Included, notably, were the Marshall offices
where there was net attrition18 and NASA Head- Aerospace Safety Advisory Panel
quarters where there were several reorganizations
and transfers. The Aerospace Safety Advisory Panel (the
The apparent reason for such actions was a "panel" in what follows) was established in the
perception that less safety, reliability and quali- aftermath of the Apollo spacecraft fire January
ty assurance activity would be required during 27, 1967. Shortly thereafter the United States
"routine" Shuttle operations. This reasoning was Congress enacted legislation (Section 6 of the
faulty. The machinery is highly complex, and the NASA Authorization Act, 1968; 42 U.S.C. 2477)
requirements are exacting. The Space Shuttle re- to establish the panel as a senior advisory com-
mains a totally new system with little or no mittee to NASA. The statutory duties of the panel
history. As the system matures and the experience are:
changes, careful tracking will be required to pre-
"The panel shall review safety studies and
vent premature failures. As the flight rate in-
operations plans referred to it and shall make
creased, more hardware operations were in-
reports thereon, shall advise the Ad-
volved, and more total in-flight anomalies
ministrator with respect to the hazards of
occurred.19 Tracking requirements became more
proposed operations and with respect to the
rather than less critical because of implications
for the next flight in an accelerating program. adequacy of proposed or existing safety
standards, and shall perform such other
Two problems on mission 61-C were not
duties as the Administrator may request."
evaluated as part of the review process for the next
flight, 51-L. A serious failure of the Orbiter wheel The panel membership is set by statute at no
brake was not known to the crew as mission 51-L more than nine members, of whom up to four
lifted off with a plan to make the first Kennedy may come from NASA. The NASA Chief Engi-
landing since a similar problem halted such neer is an ex-officio member. The staff consists
operations in April, 1985.20 Secondly, an O-ring of full-time NASA employees, and the staff direc-
erosion problem had occurred on mission 61-C, tor serves as both executive secretary and
and while it had been discovered, it had not been technical assistant to the panel.
incorporated into the Problem Assessment The role of the panel has been defined and
System when mission 51-L was launched.21 If the redefined by the members themselves, NASA
program cannot come to grips with such critical senior management and members of the House
safety aspects before subsequent flights are and Senate of the U.S. Congress. The panel
scheduled to occur, it obviously is moving too began to review the Space Shuttle program in
fast, or its safety, reliability and quality assurance 1971, and in its 1974 annual report, it
programs must be strengthened to provide more documented a shift in focus:
rapid response.
The inherent risk of the Space Shuttle program "The panel feels that [a] broader examina-
is defined by the combination of a highly dynamic tion of the programs and their management
environment, enormous energies, mechanical gives them more confidence than in limiting
complexities, time consuming preparations and their inquiry to safety alone."22
extremely time-critical decision making. Com- Over ensuing years, the panel continued to ex-
placency and failures in supervision and report- amine the Space Shuttle program including safe-
ing seriously aggravate these risks. ty, reliability and quality assurance; systems
Rather than weaken safety, reliability and redundancy; flight controls; and ground process-
quality assurance programs through attrition and ing and handling, though management issues
reorganization, NASA must elevate and continued to dominate their concerns. Following
strengthen these vital functions. In addition, the first flight of the Shuttle, the panel in-
NASA's traditional safety, reliability and quali- vestigated a wide variety of specific subjects, to
ty assurance efforts need to be augmented by an include the lightweight External Tank, the Cen-

160
taur and Inertial Upper Stage programs, Shut- safety panel. After that time, the NASA Shuttle
tle logistics and spare parts, landing gear, tires, program had no focal point for flight safety.
brakes. Solid Rocket Motor nozzles and the Solid
Rocket Motor using the filament-wound case. The Need for a New Safety
There is no indication, however, that the details Organization
of Solid Rocket Booster joint design or in-flight
problems were ever the subject of a panel activi-
The Aerospace Safety Advisory Panel unques-
ty. The efforts of this panel were not sufficiently
tionably has provided NASA a valuable service,
specific and immediate to prevent the 51-L
which has contributed to the safety of NASA's
accident.
operations. Because of its breadth of activities,
however, it cannot be expected to uncover all of
the potential problems nor can it be charged with
Space Shuttle Program Crew failure when accidents occur that in hindsight
Safety Panel were clearly probable. The ability of any panel
to function effectively depends on a focused scope
The Space Shuttle Crew Safety Panel, of responsibilities. An acceptable level of opera-
established by Space Shuttle Program Directive tional safety coverage requires the total combina-
4A dated April 17, 1974, served an important tion of NASA and contractor organizations,
function in NASA flight safety activities, until it working more effectively on a coordinated basis
went out of existence in 1981. If it were still in at all levels. The Commission believes, therefore,
existence, it might have identified the kinds of that a top-to-bottom emphasis on safety can best
problems now associated with the 51-L mission. be achieved by a combination of a strong central
The purpose of the panel was twofold: (1) to iden- authority and a working level panel devoted to
tify possible hazards to Shuttle crews and (2) to the operational aspects of Shuttle flight safety.
provide guidance and advice to Shuttle program
management concerning the resolution of such Findings
conditions.
The membership of the panel comprised 10 1. Reductions in the safety, reliability and
representatives from Johnson and a single quality assurance work force at Marshall
representative each from Dryden (the NASA and NASA Headquarters have serious-
facility at Edwards Air Force Base, California), ly limited capability in those vital
Kennedy, Marshall and the Air Force. functions.
The panel was to support the Level II Program 2. Organizational structures at Kennedy
Requirements Control Board chaired by the proj- and Marshall have placed safety,
ect manager, and recommendations were subject reliability and quality assurance offices
to Control Board approval. under the supervision of the very
From 1974 through 1978, the panel met on a organizations and activities whose efforts
regular basis (24 times) and considered vital issues they are to check.
ranging from mission abort contingencies to 3. Problem reporting requirements are not
equipment acceptability. The membership of the concise and fail to get critical informa-
panel from engineering, project management and tion to the proper levels of management.
astronaut offices ensured a minimum level of safe- 4. Little or no trend analysis was performed
ty communications among those organizations. on O-ring erosion and blow-by problems.
This ceased to exist when the panel effectively 5. As the flight rate increased, the Marshall
ceased to exist in 1980.23 NASA had expected the safety, reliability and quality assurance
panel to be functional only "during the design, work force was decreasing, which
development and flight test phases" and to "con- adversely affected mission safety.
cern itself with all vehicle systems and operating 6. Five weeks after the 51-L accident, the
modes."24 When the original chairman, Scott H. criticality of the Solid Rocket Motor field
Simpkinson, retired in 1981, the panel was joint was still not properly documented
merged with a safety subpanel that assumed in the problem reporting system at
neither the membership nor the functions of the Marshall.

161
References
1
Commission Hearing Transcript, April 3, 1986, page 2538.
2
Commission Interview Transcript, Bunn, W., April 17, 1986,
Washington, D.C., pages 42-43.
3
Commission Interview Transcript, Silveira, M., April 16,
1986, Washington, D.C., page 4.
4
Commission Interview Transcript, Quong, H., April 11,
1986, Washington, D.C., pages 29-30.
5
Commission Work Session, March 25, 1986, JSC, page 84.
6
Commission Inter\'iew Transcript, Bunn, W., April 17, 1986,
Washington, D.C., page 89.
7
SRB Critical Items List, Change 2, November 30, 1983 page
A6-A.
8
Space Shuttle Program Requirements Control Board
Directive-Level II, PRCBD Number 501152A, JSC, April 4,
1975, pages 2-4.
9
Space Shuttle Program Requirements Control Board
Directive-Level II, PRCBD Number 521701R2, JSC, March
7, 1983, pages 1-6.
10
Letter from Martin L. Raines. JSC, ND5/86-M 121, May
19, 1986.
11
Space Shuttle Program Manager Directive 34E, September
3, 1982, page 2.
12
Letter from Glynn Lunney, JSC, WA-81-L038, October
20, 1981.
13
Commission Interview Transcript, Bunn, W., April 17,
1986, Washington, D.C., page 4.
14
Commission Interview Transcript, Bunn, W., April 17,
1986, Washington, D.C., page 41.
15
Commission Interview Transcript, Bunn, W., April 17,
1986, Washington, D.C., page 13.
16
Commission Interview Transcript, Moore, J., April 8, 1986,
NASA Headquarters, page 19.
17
Marshall Space Flight Center Record Number A09288,
February 26, 1986, page 2.
18
Commission Interview Transcript, Bunn, W., April 17,
1986, Washington, D.C., pages 85-86.
19
Commission Interview Transcript, Bunn, W., April 17,
1986, Washington, D.C., pages 78-79.
20
Commission Hearing Transcript, April 3, 1986, page 2552.
21
Marshall Space Flight Center Record Number A07934,
March 7, 1986, page 6.
22
Annual Report, Aerospace Safety Advisory Panel, 1974,
page 4.
23
Report, "Space Shuttle Crew Safety Panel History," JSC,
April 16, 1986, pages 4-6.
24
Space Shuttle Program Directive 4A, JSC, April 17, 1974,
page 1.

162
Chapter VIII

Pressures on
the System

With the 1982 completion of the or- cost-effective in providing routine access to
bital flight test series, NASA space."
began a planned acceleration of
the Space Shuttle launch sched- From the inception of the Shuttle, NASA had
ule. One early plan contemplated an eventual rate been advertising a vehicle that would make space
of a mission a week, but realism forced several operations "routine and economical." The greater
downward revisions. In 1985, NASA published the annual number of flights, the greater the
a projection calling for an annual rate of 24 flights degree of routinization and economy, so heavy
by 1990. Long before the Challenger accident, emphasis was placed on the schedule. However,
however, it was becoming obvious that even the the attempt to build up to 24 missions a year
modified goal of two flights a month was brought a number of difficulties, among them the
overambitious. compression of training schedules, the lack of
In establishing the schedule, NASA had not spare parts, and the focusing of resources on near-
provided adequate resources for its attainment. term problems.
As a result, the capabilities of the system were One effect of NASA's accelerated flight rate and
strained by the modest nine-mission rate of 1985, the agency's determination to meet it was the dilu-
and the evidence suggests that NASA would not tion of the human and material resources that
have been able to accomplish the 15 flights could be applied to any particular flight.
scheduled for 1986. These are the major conclu- The part of the system responsible for turning
sions of a Commission examination of the the mission requirements and objectives into
pressures and problems attendant upon the ac- flight software, flight trajectory information and
celerated launch schedule. crew training materials was struggling to keep up
On the same day that the initial orbital tests with the flight rate in late 1985, and forecasts
concludedJuly 4, 1982 President Reagan an- showed it would be unable to meet its milestones
nounced a national policy to set the direction of for 1986. It was falling behind because its
the U.S. space program during the following resources were strained to the limit, strained by
decade. As part of that policy, the President stated the flight rate itself and by the constant changes
that: it was forced to respond to within that accelerating
schedule. Compounding the problem was the fact
"The United States Space Transportation that NASA had difficulty evolving from its single-
System (STS) is the primary space launch flight focus to a system that could efficiently sup-
system for both national security and civil port the projected flight rate. It was slow in
government missions." developing a hardware maintenance plan for its
Additionally, he said: reusable fleet and slow in developing the
capabilities that would allow it to handle the
"The first priority of the STS program is higher volume of work and training associated
to make the system fully operational and with the increased flight frequency.

164
Pressures developed because of the need to these points, sometimes called freeze points, deci-
meet customer commitments, which translated sions are made that form the basis for further
into a requirement to launch a certain number engineering and product development. The
of flights per year and to launch them on time. disciplines affected by these freeze points include
Such considerations may occasionally have integration hardware, engineering, crew timeline,
obscured engineering concerns. Managers may flight design and crew training.
have forgotten partly because of past success, The first major freeze point is at launch minus
partly because of their own well-nurtured image 15 months. At that time the flight is officially
of the program that the Shuttle was still in a defined: the launch date, Orbiter and major
research and development phase. In his testimony payloads are all specified, and initial design and
before a U.S. Senate Appropriations subcommit- engineering are begun based on this information.
tee on May 5, 1982, following the third flight of The second major freeze point is at launch
the Space Shuttle, James Beggs, then the NASA minus 7.7 months, the cargo integration review.
Administrator, expressed NASA's commitment: During this review, the integration hardware
design, Orbiter vehicle configuration, flight
"The highest priority we have set for
design and software requirements are agreed to
NASA is to complete development of the
and specified. Further design and engineering can
Shuttle and turn it into an operational
then proceed.
system. Safety and reliability of flight and
Another major freeze point is the flight plan-
the control of operational costs are primary
ning and stowage review at launch minus five
objectives as we move forward with the Shut-
months. At that time, the crew activity timeline
tle program."1
and the crew compartment configuration, which
Sixteen months later, arguing in support of the includes middeck payloads and payload specialist
Space Station, Mr. Beggs said, "We can start assignments, are established. Final design,
anytime. . . . There's no compelling reason [why] engineering and training are based on these
it has to be 1985 rather than '86 or '87. The point products.
that we have made is that the Shuttle is now
operational."2 The prevalent attitude in the pro-
gram appeared to be that the Shuttle should be Development of Flight Products
ready to emerge from the developmental stage,
The "production process" begins by collecting
and managers were determined to prove it
all mission objectives, requirements and con-
"operational."
straints specified by the payload and Space Shut-
Various aspects of the mission design and
tle communities at the milestones described
development process were directly affected by that
above. That information is interpreted and
determination. The sections that follow will
assimilated as various groups generate products
discuss the pressures exerted on the system by the
required for a Space Shuttle flight: trajectory
flight rate, the reluctance to relax the optimistic
data, consumables requirements, Orbiter flight
schedule, and the attempt to assume an opera-
software. Mission Control Center software and
tional status.
the crew activity plan, to name just a few.
Some of these activities can be done in parallel,
Planning of a Mission but many are serial. Once a particular process
has started, if a substantial change is made to the
The planning and preparation for a Space flight, not only does that process have to be
Shuttle flight require close coordination among started again, but the process that preceded it and
those making the flight manifest, those design- supplied its data may also need to be repeated.
ing the flight and the customers contracting If one group fails to meet its due date, the group
NASA's services. The goals are to establish the that is next in the chain will start late. The delay
manifest; define the objectives, constraints and then cascades through the system.
capabilities of the mission; and translate those into Were the elements of the system meeting their
hardware, software and flight procedures. schedules? Although each group believed it had
There are major program decision points in the an adequate amount of time allotted to perform
development of every Shuttle flight. At each of its function, the system as a whole was falling

165
Shuttle Mission Simulator Training

When Shuttle Mission Simulator Training Began in


Comparison With the Normal Launch-minus-77-Days
Training Start Date
200

41-B 41-C 41-D 41-G 51-A 51-C 51-D 51-B 51-G 51-F 51-1 51-J 61-A 61-B 61-C 51-L 61-E*
FLIGHT 'projected

Graph depicts beginning of simulator training for Shuttle


crews in days before launch for missions 41-B through 61-E.

behind. An assessment of the system's overall per- Changes in the Manifest


formance is best made by studying the process
at the end of the production chain: crew train-
Each process in the production cycle is based
ing. Analysis of training schedules for previous
on information agreed upon at one of the freeze
flights and projected training schedules for flights points. If that information is later changed, the
in the spring and summer of 1986 reveals a clear
process may have to be repeated. The change
trend: less and less time was going to be available could be a change in manifest or a change to the
for crew members to accomplish their required Orbiter hardware or software. The hardware and
training. (See the Shuttle mission simulator train- software changes in 1985 usually were mandatory
ing chart.)
changes; perhaps some of the manifest changes
The production system was disrupted by were not.
several factors including increased flight rate, lack The changes in the manifest were caused by
of efficient production processing and manifest factors that fall into four general categories: hard-
changes. ware problems, customer requests, operational

166
constraints and external factors. The significant
1985 Changes in the Manifest
changes made in 1985 are shown in the accom-
panying table. The following examples illustrate
that a single proposed change can have extensive Hardware Problems
impact, not because the change itself is particular- Tracking and Data Relay Satellite (canceled
ly difficult to accommodate (though it may be), 51-E, added 61-M).
but because each change necessitates four or five
Synchronous Communication Satellite (added
other changes. The cumulative effect can be
substantial. (See the Impact of Manifest Changes to 61-C).
chart.) Synchronous Communication Satellite (re-
When a change occurs, the program must moved from 61-C).
choose a response and accept the consequences OV-102 late delivery from Palmdale
of that response. The options are usually either (changed to 51-G, 51-1, and 61-A).
to maximize the benefit to the customer or to
minimize the adverse impact on Space Shuttle Customer Requests
operations. If the first option is selected, the con-
sequences will include short-term and/or long- HS-376 (removed from 51-1).
term effects. G-Star (removed from 61-C).
Hardware problems can cause extensive Satellite Television Corporation Direct
changes in the payload manifest. The 51-E mis- Broadcast Satellite (removed from 61-E).
sion was on the launch pad, only days from Westar (removed from 61-C).
launch, with a Tracking and Data Relay Satellite
Satellite Television Corporation Direct
and Telesat satellite in the cargo bay, when a
hardware problem in the tracking satellite was Broadcast Satellite (removed from 61-H).
discovered. That flight was canceled and the Electrophoresis Operations in Space (removed
payload reassigned. The cancellation resulted in from 61-B).
major changes to several succeeding flights. Mis- Electrophoresis Operations in Space (removed
sion 51-D, scheduled to fly two months later, was from 61-H).
changed to add the Telesat and delete the retrieval
Hubble Space Telescope (swap with Earth
of the Long Duration Exposure Facility. The
retrieval mission was then added to mission 61-1, Observation Mission).
replacing another satellite. A new mission (61-M)
was scheduled for July, 1986, to accommodate Operational Constraints
the Tracking and Data Relay Satellite and the No launch window for Skynet/Indian Satellite
displaced satellite, and all flights scheduled later Combination (61-H).
in 1986 slipped to make room for 61-M.
Unacceptable structural loads for Tracking and
Customers occasionally have notified NASA Data Relay Satellite/Indian Satellite (61-H).
Headquarters of a desire to change their sched-
uled launch date because of development prob- Landing weight above allowable limits for each
lems, financial difficulties or changing market of the following missions: 61-A, 61-E, 71-A,
conditions. NASA generally accedes to these re- 61-K.
quests and has never imposed the penalties
available. An example is the request made to External Factors
delay the flight of the Westar satellite from mis- Late addition of Senator Jake Garn (R-Utah)
sion 61-C (December, 1985) to a flight in March, (51-D).
1986. Westar was added to flight 61-E, and the
Getaway Special bridge assembly was removed Late addition of Representative Bill Nelson (D-
to make room for it; the HS-376 satellite slot was Florida) (61-C).
deleted from 51-L and added to 61-C; the Late addition of Physical Vapor Transport
Spartan-Halley satellite was deleted from 61-D Organic Solid experiment (51-1).
and added to 51-L. Thus, four flights experienced
major payload changes as a result of one
customer's request.
167
Impact of Manifest Changes
on Workload at Johnson Space Center

140

120-

lOO- Mission
Redefined
At L-5 Review

SO-
.MO
T> UJ

< S- 60-
At Cargo Integration Review (CIR)

40-
At Cargo Integration
Review Dry Run (GIRD)
20-

II I I II M II 11 I I { II I | I I I | I I I I | I I I | I I I | I I I | I I I { I
L-15 L-14 L-13 L-12 L-11 L-10 L-9 L-i L-6 L-5 L-4 L-3 L-2 L-1 L-0
I
CIRD CIR Installation Launch Minus Months
Instructions
at Kennedy

Graph shows that changes to the payload manifest for Shuttle


missions can boost Johnson Space Center workload as much
as 130 percent.

Operational constraints (for example, a con- but changes to other payloads or to payload
straint on the total cargo weight) are imposed to specialists can create problems as well. One small
insure that the combination of payloads does not change does not come alone; it generates several
exceed the Orbiter's capabilities. An example in- others. A payload specialist was added to mission
volving the Earth Observation Mission Spacelab 61-C only two months before its scheduled lift off.
flight is presented in the NASA Mission Planning Because there were already seven crew members
and Operations Team Report in Appendix J. assigned to the flight, one had to be removed. The
That case illustrates that changes resulting from Hughes payload specialist was moved from 61-C
a single instance of a weight constraint violation to 51-L just three months before 51-L was
can cascade through the entire schedule. scheduled to launch. His experiments were also
External factors have been the cause of a added to 51-L. Two middeck experiments were
number of changes in the manifest as well. The deleted from 51-L as a result, and the deleted ex-
changes discussed above involve major payloads, periments would have reappeared on later flights.
168
Simulation Training

When Shuttle Simulator Training Began in Comparison with


the Normal LaunGh-Minus-77-Days Training Start Date
100

90

80

in 70
>.
Q

60

o
c
50 it^ v y v

40 X-/- it

30

20

10

51-1 51-J 61-A 61-B 61-C 51-L 61-E* 61-F* 61-G* 61-H* 62-A* 61-M* 61-K*

Mission "projected

Graph depicts beginning of simulator training for Shuttle crews


in days before launch for missions 51 -L through 61 -K. Launch
minus 77 days is normal training date start.

Again, a "single" late change affected at least two cargo integration review, have only a minimal
flights very late in the planning and preparation impact; changes at launch minus five months (two
cycles. months after the cargo integration review) can
The effects of such changes in terms of budget, carry a major impact, increasing the required
cost and manpower can be significant. In some resources by approximately 30 percent. In the
cases, the allocation of additional resources allows missions from 41-C to 51-L, only 60 percent of
the change to be accommodated with little or no the major changes occurred before the cargo in-
impact to the overall schedule. In those cases, tegration review. More than 20 percent occurred
steps that need to be re-done can still be ac- after launch minus five months and caused
complished before their deadlines. The amount disruptive budget and manpower impacts.3
of additional resources required depends, of Engineering flight products are generated
course, on the magnitude of the change and when under a contract that allows for increased ex-
the change occurs: early changes, those before the penditures to meet occasional high workloads.

169
Even with this built-in flexibility, however, the not been enough preparation for what "opera-
requested changes occasionally saturate facilities tional" might entail. For example, routine and
and personnel capabilities. The strain on re- regular post-flight maintenance and inspections
sources can be tremendous. For short periods of are critical in an operational program; spare parts
two to three months in mid-1985 and early 1986, are critical to flight readiness in an operational
facilities and personnel were being required to fleet; and the software tools and training facilities
perform at roughly twice the budgeted flight rate. developed during a test program may not be
If a change occurs late enough, it will have an suitable for the high volume of work required in
impact on the serial processes. In these cases, ad- an operational environment. In many respects,
ditional resources will not alleviate the problem, the system was not prepared to meet an "opera-
and the effect of the change is absorbed by all tional" schedule.
downstream processes, and ultimately by the last As the Space Shuttle system matured, with
element in the chain. In the case of the flight numerous changes and compromises, a com-
design and software reconfiguration process, that prehensive set of requirements was developed to
last element is crew training. In January, 1986, ensure the success of a mission. What evolved was
the forecasts indicated that crews on flights after a system in which the preflight processing, flight
51-L would have significantly less time than planning, flight control and flight training were
desired to train for their flights.4 (See the Simula- accomplished with extreme care applied to every
tion Training chart.) detail. This process checked and rechecked
According to Astronaut Henry Hartsfield: everything, and though it was both labor- and
"Had we not had the accident, we were time-intensive, it was appropriate and necessary
going to be up against a wall; STS 61-H for a system still in the developmental phase. This
. . . would have had to average 31 hours in process, however, was not capable of meeting the
the simulator to accomplish their required flight rate goals.
training, and STS 61-K would have to After the first series of flights, the system
average 33 hours. That is ridiculous. For the developed plans to accomplish what was required
first time, somebody was going to have to to support the flight rate. The challenge was to
stand up and say we have got to slip the streamline the processes through automation,
launch because we are not going to have the standardization, and centralized management,
crew trained."5 and to convert from the developmental phase to
the mature system without a compromise in
quality. It required that experts carefully analyze
"Operational" Capabilities their areas to determine what could be standard-
ized and automated, then take the time to do it.
For a long time during Shuttle development, But the increasing flight rate had priority
the program focused on a single flight, the first quality products had to be ready on time. Fur-
Space Shuttle mission. When the program be- ther, schedules and budgets for developing the
came "operational," flights came more frequent- needed facility improvements were not adequate.
ly, and the same resources that had been applied Only the time and resources left after supporting
to one flight had to be applied to several flights the flight schedule could be directed toward ef-
concurrently. Accomplishing the more pressing forts to streamline and standardize. In 1985,
immediate requirements diverted attention from NASA was attempting to develop the capabilities
what was happening to the system as a whole. of a production system. But it was forced to do
That appears to be one of the many telling dif- that while responding with the same person-
ferences between a "research and development" nelto a higher flight rate.
program and an "operational program." Some of At the same time the flight rate was increas-
the differences are philosophical, some are at- ing, a variety of factors reduced the number of
titudinal and some are practical. skilled personnel available to deal with it. These
Elements within the Shuttle program tried to included retirements, hiring freezes, transfers to
adapt their philosophy, their attitude and their other programs like the Space Station and tran-
requirements to the "operational era." But that sitioning to a single contractor for operations
era came suddenly, and in some cases, there had support.

170
The flight rate did not appear to be based on provements are minimal and spread out over a
assessment of available resources and capabilities 10-year period. This is another clear demonstra-
and was not reduced to accommodate the capacity tion that the system was trying to develop its
of the work force. For example, on January 1, capabilities to meet an operational schedule but
1986, a new contract took effect at Johnson that was not given the time, opportunity or resources
consolidated the entire contractor work force to do it.7
under a single company. This transition was
another disturbance at a time when the work force
needed to be performing at full capacity to meet Responding to Challenges
the 1986 flight rate. In some important areas, a and Changes
significant fraction of workers elected not to
change contractors. This reduced the work force Another obstacle in the path toward accom-
and its capabilities, and necessitated intensive modation of a higher flight rate is NASA's legen-
training programs to qualify the new personnel. dary "can-do" attitude. The attitude that enabled
According to projections, the work force would the agency to put men on the moon and to build
not have been back to full capacity until the sum- the Space Shuttle will not allow it to pass up an
mer of 1986. This drain on a critical part of the exciting challenge even though accepting the
system came just as NASA was beginning the challenge may drain resources from the more
most challenging phase of its flight schedule.6 mundane (but necessary) aspects of the program.
Similarly, at Kennedy the capabilities of the A recent example is NASA's decision to per-
Shuttle processing and facilities support work form a spectacular retrieval of two communica-
force became increasingly strained as the Orbiter tions satellites whose upper stage motors had
turnaround time decreased to accommodate the failed to raise them to the proper geosynchronous
accelerated launch schedule. This factor has orbit. NASA itself then proposed to the insurance
resulted in overtime percentages of almost 28 per- companies who owned the failed satellites that the
cent in some directorates. Numerous contract agency design a mission to rendezvous with them
employees have worked 72 hours per week or in turn and that an astronaut in a jet backpack
longer and frequent 12-hour shifts. The poten- fly over to escort the satellites into the Shuttle's
tial implications of such overtime for safety were payload bay for a return to Earth.
made apparent during the attempted launch of The mission generated considerable excitement
mission 61-C on January 6, 1986, when fatigue within NASA and required a substantial effort
and shiftwork were cited as major contributing to develop the necessary techniques, hardware
factors to a serious incident involving a liquid and procedures. The mission was conceived,
oxygen depletion that occurred less than five created, designed and accomplished within 10
minutes before scheduled lift off. The issue of months. The result, mission 51-A (November,
workload at Kennedy is discussed in more detail 1984), was a resounding success, as both failed
in Appendix G. satellites were successfully returned to Earth. The
Another example of a system designed during retrieval mission vividly demonstrated the service
the developmental phase and struggling to keep that astronauts and the Space Shuttle can
up with operational requirements is the Shuttle perform.
Mission Simulator. There are currently two Ten months after the first retrieval mission,
simulators. They support the bulk of a crew's NASA launched a mission to repair another com-
training for ascent, orbit and entry phases of a munications satellite that had failed in low-Earth
Shuttle mission. Studies indicate two simulators orbit. Again, the mission was developed and ex-
can support no more than 12-15 flights per year. ecuted on relatively short notice and was resound-
The flight rate at the time of the accident was ingly successful for both NASA and the satellite
about to saturate the system's capability to pro- insurance industry.
vide trained astronauts for those flights. Further- The satellite retrieval missions were not isolated
more, the two existing simulators are out-of-date occurrences. Extraordinary efforts on NASA's
and require constant attention to keep them part in developing and accomplishing missions
operating at capacity to meet even the rate of will, and should, continue, but such efforts will
12-15 flights per year. Although there are plans be a substantial additional drain on resources.
to improve capability, funds for those im- NASA cannot both accept the relatively spur-of-
171
the-moment missions that its "can-do" attitude the manifest and typically necessitates changes to
tends to generate and also maintain the planning many other flights, each requiring resources
and scheduling discipline required to operate as (budget, manpower, facilities) to implement.
a "space truck" on a routine and cost-effective Some changes are more expensive than others,
basis. As the flight rate increases, the cost in but all have an impact, and those impacts must
resources and the accompanying impact on future be understood.
operations must be considered when infrequent In fact, Leonard Nicholson, manager of Space
but extraordinary efforts are undertaken. The Transportation System Integration and Opera-
system is still not sufficiently developed as a "pro- tions at Johnson, in arguing for the development
duction line" process in terms of planning or im- of a forecasting tool, illustrated the fact that the
plementation procedures. It cannot routinely or resources were spread thin: "The press of busi-
even periodically accept major disruptions ness would have hindered us getting that kind of
without considerable cost. NASA's attitude tool in place, just the fact that all of us were
historically has reflected the position that "We can busy . . . ."10
do anything," and while that may essentially be
The effect of shuffling major payloads can be
true, NASA's optimism must be tempered by the significant. In addition, as stated earlier, even ap-
realization that it cannot do everything. parently "easy" changes put demands on the
NASA has always taken a positive approach resources of the system. Any middeck or second-
to problem solving and has not evolved to the ary payload has, by itself, a minimal impact com-
point where its officials are willing to say they no pared with major payloads. But when several
longer have the resources to respond to proposed changes are made, and made late, they put signifi-
changes. Harold Draughon, manager of the Mis- cant stress on the flight preparation process by
sion Integration Office at Johnson, reinforced this diverting resources from higher priority problems.
point by describing what would have to happen
Volume III of JSC 07700, Revision B, specifies
in 1986 to achieve the flight rate:
that all middeck experiments must be scheduled,
"The next time the guy came in and said and payload specialists assigned, 22 weeks before
'I want to get off this flight and want to move launch.11 That rule has not been enforced in
down two' . . . [the system would have had fact, it is more honored in the breach than in the
to say,] 'We can't do that,' and that would observance. A review of missions 41-G through
have been the decision."8 61-C revealed that of the 16 payload specialists
Even in the event of a hardware problem, after added to those flights, seven were added after
the problem is fixed there is still a choice about launch minus five months.
how to respond. Flight 41-D had a main engine Even "secondary" payloads take a lot of time
shutdown on the launch pad. It had a commer- and attention when they are added to a flight late.
cial payload on it, and the NASA Customer Serv- Harold Draughon:
ices division wanted to put that commercial "I spend more than half of my time work-
payload on the next flight (replacing some NASA ing on things that are not very important
payloads) to satisfy more customers. Draughon because they get put in so late. Rather than
described the effect of that decision to the Com- working on PAM's [Payload Assist Modules]
mission: "We did that. We did not have to. And and lUS's [Inertial Upper Stages], I am
the system went out and put that in work, but working on chicken eggs."12
it paid a price. The next three or four flights all
slipped as a result."9 Those directing the changes in the manifest
NASA was being too bold in shuffling mani- were not yet sensitive to the problem. Each
fests. The total resources available to the Shuttle change nibbles away at the operational resources,
program for allocation were fixed. As time went and the changes were occurring frequently,
on, the agency had to focus those resources more even routinely. Much of the capacity of the
and more on the near term worrying about to- system was being used up responding to late
day's problem and not focusing on tomorrow's. changes in lower priority experiments. That flexi-
NASA also did not have a way to forecast the bility toward secondary experiments tied up the
effect of a change of a manifest. As already in- resources that would have been better spent build-
dicated, a change to one flight ripples through ing capability to meet the projected flight rate.
172
Tommy Holloway, chief of the Johnson Flight spares began to increase faster than deliveries.
Director Office, emphasized that, given finite A year later, when inventory stockage should
resources, one must decide: "It's flight rate ver- have been complete, only 32,000 of the required
sus [manifest] flexibility."13 50,000 items (65 percent) had been delivered.16
The portion of the system forced to respond The spare parts plan to support 24 flights per
to the late changes in the manifest tried to bring year had called for completing inventory stockage
its concerns to Headquarters. As Mr. Nicholson by June, 1987. By mid-1985, that schedule was
explained, in jeopardy.
The logistics plan could not be fully im-
"We have done enough complaining about
plemented because of budget reductions. In Oc-
it that I cannot believe there is not a grow-
tober, 1985, the logistics funding requirement for
ing awareness, but the political aspects of the
the Orbiter program, as determined by Level III
decision are so overwhelming that our con-
management at Johnson, was $285.3 million.
cerns do not carry much weight. . . . The
That funding was reduced by $83.3 million a
general argument we gave about distracting
cut that necessitated major deferrals of spare parts
the attention of the team late in the process
purchases. Purchasing deferrals come at great
of implementing the flight is a qualitative
cost. For example, a reduction due to deferral of
argument .... And in the face of that,
$11.2 million in fiscal year 1986 would cost $ 11.2
political advantages of implementing those
million in fiscal year 1987, plus an additional
late changes outweighed our general
$21.6 million in fiscal year 1988. This three-to-
objections."14
one ratio of future cost to current savings is not
It is important to determine how many flights uncommon. Indeed, the ratio in many instances
can be accommodated, and accommodated safe- is as high as seven to one. This practice cannot
ly. NASA must establish a realistic level of ex- make sense by any standard of good financial
pectation, then approach it carefully. Mission management.
schedules should be based on a realistic assess- According to Johnson officials, reductions in
ment of what NASA can do safely and well, not spares expenditures provided savings required to
on what is possible with maximum effort. The meet the revised budgets. As Program Manager
ground rules must be established firmly, and then Arnold Aldrich reported to the Commission:
enforced.
"There had been fund contentions in the
The attitude is important, and the word opera-
program for a number of years, at least start-
tional can mislead. "Operational" should not im-
ing in the mid-seventies and running
ply any less commitment to quality or safety, nor
through into the early to mid-eighties . . .
a dilution of resources. The attitude should be,
intentional decisions were made to defer the
"We are going to fly high risk flights this year;
heavy build-up of spare parts procurements
every one is going to be a challenge, and every
in the program so that the funds could be
one is going to involve some risk, so we had bet-
devoted to other more pressing activities.
ter be careful in our approach to each."15
... It was a regular occurrence for several
annual budget cycles. And once the flight
rate really began to rise and it was really
Effect of Flight Rate on Spare Parts clear that spare parts were going to be a
problem, significant attention was placed on
As the flight rate increases, the demand on that problem by all levels of NASA and ef-
resources and the demand for spare parts in- forts had been made to catch up. But . . .
creases. Since 1981, NASA has had logistics plans our parts availability is well behind the flight
for Shuttle flight rates of 12 and 24 flights a year. need. . . ."17
It was originally forecast (in mid-1983) that the
supply of spares required to support 12 flights an- Those actions resulted in a critical shortage of
nually could be accomplished in the spring of serviceable spare components. To provide parts
1986. Actual inventory of spare parts had run required to support the flight rate, NASA had to
close to plan until the second quarter of fiscal year resort to cannibalization. Extensive cannibaliza-
1985. At that time, inventory requirements for tion of spares, i.e., the removal of components

173
from one Orbiter for installation in another, our knees this spring [1986] by this problem
became an essential modus operandi in order to [spare parts] if we had kept trying to fly." 20
maintain flight schedules. Forty-five out of ap-
proximately 300 required parts were cannibalized NASA's processes for spares provisioning
for Challenger before mission 51-L. These parts (determining the appropriate spares inventory
levels), procurement and inventory control are
spanned the spectrum from common bolts to a
thrust control actuator for the orbital maneuver- complicated and could be streamlined and
simplified.
ing system to a fuel cell. This practice is costly
and disruptive, and it introduces opportunities As of spring 1986, the Space Shuttle logistics
for component damage. program was approximately one year behind.
Further, the replenishment of all spares (even
This concern was summarized in testimony
parts that are not currently available in the
before the Commission by Paul Weitz, deputy
system) has been stopped. Unless logistics sup-
chief of the Astronaut Office at Johnson:
port is improved, the ability to maintain even a
"It increases the exposure of both Orbiters three-Orbiter fleet is in jeopardy.
to intrusion by people. Every time you get Spare parts provisioning is yet another illustra-
people inside and around the Orbiter you tion that the Shuttle program was not prepared
stand a chance of inadvertent damage of for an operational schedule. The policy was short-
whatever type, whether you leave a tool sighted and led to cannibalization in order to meet
behind or whether you, without knowing it, the increasing flight rate.
step on a wire bundle or a tube or something
along those lines." 18
Cannibalization is a potential threat to flight The Importance of
safety, as parts are removed from one Orbiter, Flight Experience
installed in another Orbiter, and eventually
replaced. Each handling introduces another op- In a developmental program it is important to
portunity for imperfections in installation and for make use of flight experience, both to understand
damage to the parts and spacecraft. the system's actual performance and to uncover
Cannibalization also drains resources, as one problems that might not have been discovered in
Kennedy official explained to the Commission on testing. Because Shuttle flights were coming in
March 5, 1986: fairly rapid succession, it was becoming difficult
"It creates a large expenditure in man- to analyze all the data from one flight before the
power at KSC. A job that you would have next was scheduled to launch. In fact, the Flight
normally used what we will call one unit of Readiness Review for 51-L was held while mis-
effort to do the job now requires two units sion 61-C was still in orbit. Obviously, it was im-
of effort because you've got two ships [Or- possible to even present, much less analyze and
biters] to do the task with." 19 understand, anomalies from that flight.
The point can be emphasized by citing two
Prior to the Challenger accident, the shortage problems that occurred during mission 61-C but
of spare parts had no serious impact on flight were discovered too late to be considered at the
schedules, but cannibalization is possible only so 51-L Flight Readiness Review:
long as Orbiters from which to borrow are
available. In the spring of 1986, there would have 1. The Space Shuttle brakes and tires have
been no Orbiters to use as "spare parts bins." long been a source of concern. In particular,
Columbia was to fly in March, Discovery was to after the 51-D Orbiter blew a tire at Ken-
be sent to Vandenberg, and Atlantis and nedy in April, 1985, there was considerable
Challenger were to fly in May. In a Commission effort (within budgetary constraints) to
interview, Kennedy director of Shuttle Engineer- understand and resolve the problems, and
ing Horace Lamberth predicted the program Kennedy landings were suspended until cer-
would have been unable to continue: tain improvements were made. (See section
"Landing: Another Critical Phase," page 186.)
"I think we would have been brought to Mission 51-L was to be the first flight to land

174
in Florida since 51-D had experienced brake tified, the more difficult it will be to correct, but
problems. STS 61-C landed at Edwards Air the payload safety process has worked well in
Force Base in California on January 19, identifying and resolving safety hazards.
1986, four days after the 51-L Flight Unfortunately, pressures to maintain the flight
Readiness Review. The 61-C brakes were schedule may influence decisions on payload safe-
removed following landing and shipped to ty provisions and hazard acceptance. This in-
the vendor for further inspection and fluence was evident in circumstances surrounding
analysis. That inspection revealed major the development of two high priority scientific
brake damage. The subsystem manager at payloads and their associated booster, the
Johnson in charge of the brakes did not Centaur.
receive the information until January 27, Centaur is a Space Shuttle-compatible booster
1986, one day before 51-L was launched, that can be used to carry heavy satellites from the
and did not learn the extent of the problem Orbiter's cargo bay to deep space. It was sched-
until January 30, 1986. uled to fly on two Shuttle missions in May, 1986,
2. The inspection of the 61-C Solid Rocket sending the NASA Galileo spacecraft to Jupiter
Booster segments was completed on January and the European Space Agency Ulysses space-
19, 1986, four days after the 51-L Level I craft first to Jupiter and then out of the planets'
Flight Readiness Review. The post-recovery orbital plane over the poles of the Sun. The
inspection of the 61-C Solid Rocket Booster pressure to meet the schedule was substantial
segments revealed that there was O-ring ero- because missing launch in May or early June
sion in one of the left booster field joints and meant a year's wait before planetary alignment
additional O-ring anomalies on both booster would again be satisfactory.
nozzles. Although the information was Unfortunately, a number of safety and
available for Marshall's 51-L Level III schedule issues clouded Centaur's use. In par-
review at launch minus one day, it was clear- ticular. Centaur's highly volatile cryogenic pro-
ly not available in time for consideration in pellants created several problems. If a return-to-
the formal launch preparation process.21 launch-site abort ever becomes necessary, the
These examples underscore the need to propellants will definitely have to be dumped
establish a list of mandatory post-flight in- overboard. Continuing safety concerns about the
spections that must precede any subsequent means and feasibility of dumping added pressure
launch. to the launch preparation schedule as the program
struggled to meet the launch dates.
Of four required payload safety reviews, Cen-
taur had completed three at the time of the
Effect on Payload Safety Challenger accident, but unresolved issues re-
mained from the last two. In November, 1985,
The payload safety process exists to ensure that the Payload Safety Panel raised several impor-
each Space Shuttle payload is safe to fly and that tant safety concerns. The final safety review,
on a given mission the total integrated cargo does though scheduled for late January, 1986, ap-
not create a hazard. NASA policy is to minimize peared to be slipping to February, only three
its involvement in the payload design process. months before the scheduled launches.
The payload developer is responsible for produc- Several safety waivers had been granted, and
ing a safe design, and the developer must verify several others were pending. Late design changes
compliance with NASA safety requirements. The to accommodate possible system failure would
Payload Safety Panel at Johnson conducts a probably have required reconsideration of some
phased series of safety reviews for each payload. of the approved waivers. The military version of
At those reviews, the payload developer presents the Centaur booster, which was not scheduled to
material to enable the panel to assess the payload's fly for some time, was to be modified to provide
compliance with safety requirements. added safety, but because of the rush to get the
Problems may be identified late, however, 1986 missions launched, these improvements
often as a result of late changes in the payload were not approved for the first two Centaur
design and late inputs from the payload boosters. After the 51-L accident, NASA allotted
developer. Obviously, the later a hazard is iden- more than $75 million to incorporate the opera-
175
tional and safety improvements to these two The flight activity officer who was responsible
vehicles.22 We will never know whether the for developing the crew activity plan testified that
payload safety program would have allowed the three live telecasts were planned for the
Centaur missions to fly in 1986. Had they flown, Challenger, but they related in no way to the
however, they would have done so without the State of the Union Message:24
level of protection deemed essential after the
During the teacher activities on flight day 4.
accident.
During the phase partitioning experiment
on flight day 5.
Outside Pressure to Launch During the crew conference on flight day 6.
The Commission concluded that the decision
After the accident, rumors appeared in the to launch the Challenger was made solely by the
press to the effect that persons who made the deci- appropriate NASA officials without any outside
sion to launch mission 51-L might have been sub- intervention or pressure.
jected to outside pressure to launch. Such rumors
concerning unnamed persons, emanating from
anonymous sources about events that may never
have happened, are difficult to disprove and
dispel. Nonetheless, during the Commission's Findings
hearings all persons who played key roles in that
decision were questioned. Each one attested, 1. The capabilities of the system were stretched
under oath, that there had been no outside in- to the limit to support the flight rate in winter
tervention or pressure of any kind leading up to 1985/1986. Projections into the spring and sum-
the launch. mer of 1986 showed a clear trend; the system,
There was a large number of other persons who as it existed, would have been unable to deliver
were involved to a lesser extent in that decision, crew training software for scheduled flights by the
and they were questioned. All of those persons designated dates. The result would have been an
provided the Commission with sworn statements unacceptable compression of the time available
that they knew of no outside pressure or for the crews to accomplish their required
intervention.23 training.
The Commission and its staff also questioned 2. Spare parts are in critically short supply. The
a large number of other witnesses during the Shuttle program made a conscious decision to
course of the investigation. No evidence was postpone spare parts procurements in favor of
reported to the Commission which indicated that budget items of perceived higher priority. Lack
any attempt was ever made by anyone to apply of spare parts would likely have limited flight
pressure on those making the decision to launch operations in 1986.
the Challenger. 3. Stated manifesting policies are not enforced.
Although there was total lack of evidence that Numerous late manifest changes (after the cargo
any outside pressure was ever exerted on those integration review) have been made to both ma-
who made the decision to launch 51-L, a few jor payloads and minor payloads throughout the
speculative reports persisted. Shuttle program.
One rumor was that plans had been made to Late changes to major payloads or pro-
have a live communication hookup with the 51-L gram requirements can require extensive
crew during the State of the Union Message. resources (money, manpower, facilities)
Commission investigators interviewed all of the to implement.
persons who would have been involved in a
If many late changes to "minor" payloads
hookup if one had been planned, and all stated
occur, resources are quickly absorbed.
unequivocally that there was no such plan. Fur-
thermore, to give the crew time to become Payload specialists frequently were added
oriented, NASA does not schedule a communica- to a flight well after announced deadlines.
tion for at least 48 hours after the launch and no Late changes to a mission adversely af-
such communication was scheduled in the case fect the training and development of pro-
of flight 51-L. cedures for subsequent missions.

176
4. The scheduled flight rate did not accurate- References
ly reflect the capabilities and resources. 1
Hearings of the U.S. Senate, Subcommittee of the Commit-
The flight rate was not reduced to accom- tee on Appropriations, May 5, 1982, page 1029.
2
modate periods of adjustment in the "Interview with NASA Administrator James Beggs," Space
Business News, September 12, 1983.
capacity of the work force. There was no 3
See Appendix, NASA Mission Planning and Operations
margin in the system to accommodate un- Team Report (Preliminary), April, 1986, page 86.
4
foreseen hardware problems. Commission Work Session, Mission Planning and Opera-
tions Panel, April 1, 1986, JSC, page 198.
Resources were primarily directed toward 5
Commission Work Session, Mission Planning and Opera-
supporting the flights and thus not tions Panel, April 1, 1986, JSC, page 198.
6
NASA Memo, DA-RRR-86-()6.'
enough were available to improve and ex- 7
See Appendix J, NASA Mission Planning and Operations
pand facilities needed to support a higher Team Report (Preliminary), April, 1986, pages 58-59.
8
flight rate. Commission Work Session, Mission Planning and Opera-
tions Panel, March 24, 1986, JSC, page 130.
5. Training simulators may be the limiting fac- 9
Commission Work Session, Mission Planning and Opera-
tor on the flight rate: the two current simulators tions Panel, March 24, 1986, JSC, page 126.
10
Commission Work Session, Mission Planning and Opera-
cannot train crews for more than 12-15 flights per tions Panel, April 8, 1986, JSC, page 240.
year. 11
Page 12.
12
6. When flights come in rapid succession, cur- Commission Work Session, Mission Planning and Opera-
tions Panel, April 1, 1986, JSC, page 205.
rent requirements do not ensure that critical 13
Commission Work Session, Mission Planning and Opera-
anomalies occurring during one flight are iden- tions Panel, April 8, 1986, JSC, pages 216-218. '
tified and addressed appropriately before the next 14
Commission Work Session, Mission Planning and Opera-
flight. tions Panel, April 8, 1986, JSC, pages 216-218.
15
Commission Work Session, Mission Planning and Opera-
tions Panel, April 8, 1986, JSC, pages 262-263.
16
NASA Memo from Goetz, R., "Logistics Responsibility
Transfer from NASA JSC to NASA KSC," February 6, 1986.
17
Commission Hearing Transcript, April 3, 1986, page 2544.
18
Commission Hearing Transcript, April 3, 1986, page 2443.
19
Commission Work Session, Mission Planning and Opera-
tions Panel, March 5, 1986, KSC, page 306.
20
Commission Work Session, Mission Planning and Opera-
tions Panel, March 4, 1986, KSC, page 304.
21
Report, "SRM Post-tlight Hardware Inspection Report for
STS 61-C," Part I of 2, January 24, 1986, pages 51-52.
22
Cost figures were provided by the Centaur program
manager, telephone call. May 16, 1986.
23
Twenty-eight Affidavits submitted to the Commission.
24
Commission Interview Transcript, Ehlers, K., April 16,
1986, JSC, pages 1-10.

177
Chapter IX

Other Safety
Considerations

In the course of its investigation, the Com- mission are the current abort capabilities, options
mission became aware of a number of mat- to improve those capabilities, options for crew
ters that played no part in the mission 51-L escape and the performance of the range safety
accident but nonetheless hold a potential for system.
safety problems in the future. It is not the Commission's intent to second-
Some of these matters, those involving opera- guess the Space Shuttle design or try to depict
tional concerns, were brought directly to the escape provisions that might have saved the 51-L
Commission's attention by the NASA astronaut crew. In fact, the events that led to destruction
office. They were the subject of a special hearing. of the Challenger progressed very rapidly and
Other areas of concern came to light as the without warning. Under those circumstances, the
Commission pursued various lines of investiga- Commission believes it is highly unlikely that any
tion in its attempt to isolate the cause of the acci- of the systems discussed below, or any combina-
dent. These inquiries examined such aspects as tion of those systems, would have saved the flight
the development and operation of each of the 51-L crew.
elements of the Space Shuttle the Orbiter, its
main engines and the External Tank; the pro- Abort Capabilities
cedures employed in the processing and assembly Various unexpected conditions during ascent
of 51-L, and launch damage. can require premature termination of a Shuttle
This chapter examines potential risks in two mission. The method of termination, or abort,
general areas. The first embraces critical aspects depends upon the nature of the unexpected con-
of a Shuttle flight; for example, considerations dition and when it occurs.
related to a possible premature mission termina- The Space Shuttle is lifted to orbit by thrust
tion during the ascent phase and the risk factors from its two solid rockets and three main engines.
connected with the demanding approach and The design criteria for the Shuttle specify that,
landing phase. The other focuses on testing, proc- if a single main engine is lost at any time between
essing and assembling the various elements of the lift off and normal main engine cut off, the Shuttle
Shuttle. must be able to continue to orbit or to execute
an intact abort, that is, make a survivable land-
ing on a runway. That design requirement has
been met. If a single main engine is lost early in
Ascent: A Critical Phase ascent, the Shuttle can return to make an
emergency landing at Kennedy (a return-to-
The events of flight 51-L dramatically il- launch-site abort). If the failure occurs later, the
lustrated the dangers of the first stage of a Space Shuttle can make an emergency landing in Africa
Shuttle ascent. The accident also focused atten- or Europe (a transatlantic abort landing). If the
tion on the issues of Orbiter abort capabilities and failure occurs during the last part of the ascent,
crew escape. Of particular concern to the Com- the Shuttle can proceed around the Earth to a
178
landing in the continental United States (abort Ocean. The Orbiter then glides to a landing on
once around), or can continue to a lower-than- the runway at the Shuttle Landing Facility at
planned orbit (abort to orbit). Indeed, if the Kennedy.
failure occurs late enough, the Shuttle will achieve Transatlantic Abort. During ascent there
the intended orbital conditions. comes a time when the Shuttle is too far
Return-to-Launch-Site Abort. If the termina- downrange to fly back to Kennedy. If it suffers
tion is necessary because of loss of a main engine an engine failure after that point, but has not yet
during the first four minutes of flight, the Shut- achieved enough energy to continue toward or-
tle has the capability to fly back to the launch site. bit, it will have to land on the other side of the
It continues downrange to burn excess propellant, Atlantic. It will continue on a special flight path
and at the proper point it turns back toward until it achieves the energy necessary to glide to
Florida. The computers shutdown the remaining the landing site. At that point the Shuttle com-
two engines and separate the Orbiter from the puters will cut off the two remaining engines and
External Tank, which falls into the Atlantic separate the Orbiter from the External Tank. The

Shuttle Abort Regions

Abort-to-Orbit (ATO)-
Trajectory
MECO

Staging ^

Preferred Abort Mode: 3:51 5:20 5:33 6:30 3:30

RTLS TAL ATO NOMINAL


I 1 I 1 1 1 1 1
Lift-off 1:00 2:00 8:00 4 :00 5:00 6:00 7:00 8:00
AOA
Mission Elapsed Time (minutes ; seconds)
Note: Times are scaled to the schematic

Schematic shows options available to Space Shuttle crews for


aborts in the event of power loss at various stages in the
ascent to space.

179
Shuttle will then re-enter the lower atmosphere Early Orbiter Separation
much like a normal entry. The landing, however, If a problem arose that required the Orbiter
will be at a pre-selected site in Africa or Europe. to get away from failing Solid Rocket Boosters,
Design. The Shuttle design specifications do the separation would have to be performed ex-
not require that the Orbiter be able to manage tremely quickly. Time would be of the essence
an intact abort (i.e., make it to a runway) if a for two reasons. First, as 51-L demonstrated, if
second main engine should fail. If two (or all a problem develops in a Solid Rocket Booster,
three) main engines fail within the first five to six it can escalate very rapidly. Second, the ascent
minutes of the flight, the Space Shuttle will land trajectory is carefully designed to control the
in water. This maneuver is called a "contingen- aerodynamic loads on the vehicle; very small
cy abort" and is not believed to be survivable deviation from the normal path will produce ex-
because of damage incurred at water impact. cessive loads, so if the vehicle begins to diverge
The Shuttle design requirements did not from its path there is very little time (seconds)
specify that the Shuttle should be able to survive before structural breakup will occur.
a Solid Rocket Booster failure. The system has The normal separation sequence to free the
no way to identify when a booster is about to fail, Shuttle from the rest of the system takes 18
and no way to get the Orbiter or the crew away seconds, far too long to be of use during a first-
from a failing Solid Rocket Booster. stage contingency. "Fast-separation" was formally
Crew survival during ascent rests on the follow- established by Review Item Discrepancy
ing assumptions: 03.00.151, which stated the requirement to
separate the Orbiter from the External Tank at
1. The Solid Rocket Boosters will work any time. The sequence was referred to as fast-
from ignition to planned separation. separation because delays required during nor-
2. If more than one main engine fails, the mal separation were bypassed or drastically
crew must be able to survive a water landing. shortened in order to achieve separation in ap-
proximately three seconds. Some risk was ac-
Shuttle Abort Enhancements cepted to obtain this contingency capability. Fast-
Between 1973 and 1983, first stage abort pro- separation was incorporated into the flight soft-
visions were assessed many times by all levels of ware, so that technically this capability does exist.
NASA management. Many methods of saving Unfortunately, analysis has shown that, if it is
the Orbiter and/or crew from emergencies dur- attempted while the Solid Rocket Boosters are still
ing first stage were considered. thrusting, the Orbiter will "hang up" on its aft
Ejection seats (which afforded only limited pro- attach points and pitch violently, with probable
tection during first stage) were provided for the loss of the Orbiter and crew.
two-man crews of the Orbital Flight Test program In summary, as long as the Solid Rocket
(the first four Shuttle flights). Other options for Boosters are still thrusting, fast-separation does
"operational" flights carrying crews of five or more not provide a way to escape. It would be useful
astronauts were considered, but were not im- during first stage only if Solid Rocket Booster
plemented because of limited utility, technical thrust could first be terminated.
complexity and excessive cost in dollars, weight The current concept of fast-separation does,
or schedule delays. however, have some use. Contingency aborts
Because of these factors, NASA adopted the resulting from loss of two or three main engines
philosophy that the reliability of first stage ascent early in ascent are time-critical, and every frac-
must be assured, and that design and testing must tion of a second that can be trimmed from the
preclude time critical failures that would require separation sequence helps. These abort pro-
emergency action before normal Solid Rocket cedures are executed after the Solid Rocket
Booster burnout. That philosophy has been Boosters are expended, and fast-separation is used
reviewed many times during the Space Shuttle to reduce the time required for separation as the
program and is appropriately being reevaluated, Shuttle must attain entry attitude very quickly.
as are all first stage abort options, in light of the Unfortunately, all contingency aborts culminate
51-L accident. in water impact.

180
Thrust Termination extremely heavy, very costly and, at best,
Thrust termination (or thrust neutralization) present some risk to the Orbiter and ET [Ex-
as originally proposed for the Space Shuttle was ternal Tank]. Venting of hot gases and the
a concept conceived for the Titan 3-M booster shock load or pressure spike, have the poten-
intended for use in the Manned Orbiting tial for being as great a hazard as the prob-
Laboratory Program. The objective of thrust ter- lem to be corrected. It does not appear that
mination is to either extinguish or reduce the a practical approach exists for achieving the
thrust of the Solid Rocket Booster in an emergen- desired pressure decay rate without a ma-
cy situation. With this thrust terminated, jor redesign of the motor."1
emergency options such as crew ejection or fast-
In retrospect, the possibility of Solid Rocket
separation might become feasible during the first
Booster failures was neither very remote nor
two minutes of flight.
limited to primary structural failure.
The principal drawback is that thrust termina-
Although it would not have helped on mission
tion itself introduces high dynamic loads that
51-L, thrust termination is the key to any suc-
could cause Shuttle structural components to fail.
cessful first-stage abort, and new ideas and
Early design reviews suggested that to strengthen
technologies should be examined. If a thrust ter-
the Orbiter to withstand the stresses caused by
mination system is eventually deemed feasible
rapid thrust termination would require an addi-
(that is, the Orbiter/External Tank will still be
tional, prohibitive 19,600 pounds. Thrust ter-
intact after the rapid deceleration), it cannot have
mination was deleted from design consideration
failure modes that would cause an uncommanded
on April 27, 1973, by Space Shuttle Directive
neutralization of the thrust of one or both of the
SS00040. Key factors in the decision were that
Solid Rocket Boosters. If thrust termination were
(1) proper design would be stressed to prevent
to be implemented, reliable detection mechanisms
Solid Rocket Booster failure and (2) other first-
and reliable decision criteria would be
stage ascent systems provided enough redundan-
mandatory.
cy to allow delaying an abort until after the Solid
Rocket Boosters burned out.
The subject arose again in 1979 when Space
Ditching
As previously discussed, most contingency
Shuttle Directive Si3141 required the system con-
aborts (those resulting from failure of two or three
tractor to determine the time over which thrust
main engines during the first five to six minutes
reduction must be spread so that the deceleration
of flight) result in a water landing, or ditching.
loads would not destroy the Orbiter. Marshall
In addition, if the Space Shuttle did have a thrust
analyzed the thrust decay curves submitted by
termination capability to use with fast-separation
the contractor and concluded that achieving the
to allow it to separate from failing solid rockets,
required thrust decay rates was impractical.
the Orbiter would have to ditch in the water
On July 12, 1982, the Associate Administrator
unless the failure occurred during a small win-
for Space Transportation Systems requested
dow 50-70 seconds after launch. Accordingly,
reconsideration of thrust termination. Gerald
whether the crew can survive a water impact is
Griffin, director of Johnson, responded to the re-
a critical question.
quest in a letter dated September 9, 1982, as
In 1974 and 1975, ditching studies were con-
follows:
ducted at Langley Research Center. Although
"In our opinion, further study of a thrust test limitations precluded definitive conclusions,
termination system for the SRB [Solid the studies suggested that the loads at water im-
Rocket Booster] would not be productive. pact would be high. The deceleration would most
The potential failure modes which could probably cause structural failure of the crew cabin
result in a set of conditions requiring SRB support ties to the fuselage, which would impede
thrust termination are either very remote or crew egress and possibly flood the cabin. Further-
a result of primary structural failure. The more, payloads in the cargo bay are not designed
structural failure risk would normally be ac- to withstand decelerations as high as those ex-
cepted as a part of the factor of safety pected,2 and would very possibly break free and
verification by analysis or test. In addition, travel forward to the crew cabin. The Langley
any thrust termination system is going to be report does state that the Orbiter shape and mass

181
properties are good for ditching, but given the Crew Escape Options
structural problems and deceleration loads, that In a study conducted before the Orbiter con-
is little consolation. tract was awarded, Rockwell International
Orbiter ditching was discussed by the Crew evaluated a range of ejection systems (Rockwell
Safety Panel and at Orbiter flight techniques International, Incorporated, Phase B Study,
meetings before the first Shuttle flight. The con- 1971). The table shows the results comparing
sensus of these groups was that (1) ditching is three systems: ejection seats, encapsulated ejec-
more hazardous than suggested by the early tion seats and a separable crew compartment.
Langley tests, and (2) ditching is probably not The development costs are in 1971 dollars, and
survivable. the costs and weights cited were those required
This view was reiterated in the September 9, to incorporate these systems into the developing
1982, letter from Griffin to Abrahamson: Orbiter design, not to modify an existing Orbiter.
"We also suggest no further effort be ex- The only system that could provide protection
pended to study bailout or ditching. There for more than the two-man experimental flight
is considerable doubt that either case is crew was the separable crew compartment, which
technically feasible with the present Orbiter would add substantial weight and development
design. Even if a technical solution can be cost. All of these systems had limitations in their
found, the impact of providing either ability to provide successful escape, and all would
capability is so severe in terms of cost and require advance warning of an impending hazard
schedule as to make them impractical." from reliable data sources.
The Request for Proposal, written in April,
There is no evidence that a Shuttle crew would
1971 (reference paragraph 1.3.6.2.1), states: "Pro-
survive a water impact. Since all contingency
visions shall be made for rapid emergency egress
aborts and all first stage abort capabilities that
of the crew during development test flights." Ejec-
are being studied culminate in a water impact,
tion seats were selected as the emergency escape
an additional provision for crew escape before im-
system. The objective was to offer the crew some
pact should also be considered.
protection, though limited, from risks of the test
Astronaut Paul Weitz expressed this before the
flights. The philosophy was that after the test
Commission on April 3, 1986:
flights, all unknowns would be resolved, and the
"My feeling is so strong that the Orbiter vehicle would be certified for "operational" flights.
will not survive a ditching, and that includes Conventional ejection seats similar to those in-
land, water or any unprepared surface. . . . stalled in the Lockheed F-12/SR-71 were selected
"I think if we put the crew in a position shortly after the Orbiter contract was awarded.
where they're going to be asked to do a con- They were subsequently incorporated into Co-
tingency abort, then they need some means lumbia and were available for the first four flights.
to get out of the vehicle before it contacts The ejection could be initiated by either crew
earth, the surface of the earth."3 member and would be used in the event of un-

1971 Rockwell Data on Ejection Systems


Altitude Velocity Weight Development
Type (feet) (feet/sec) (pounds) Cost

Open Ejection Seat < 60,000 <2,000 1,760 $10,000,000


B-70 Encapsulated Seat < 100,000 <3,000 5,200 $7,000,000
Separable Crew < 100,000 8,000 14,000 $292,000,000
Compartment or to
more 17,000

182
controlled flight, on-board fire or pending land- Its use would probably be practical only after
ings on unprepared surfaces. The escape se- thrust termination. It should be noted that in all
quence required approximately 15 seconds for the cases of crew escape, the Orbiter would be lost,
crew to recognize pending disaster, initiate the but in cases of Solid Rocket Booster failure or Or-
sequence and get a safe distance away from the biter ditching the vehicle would be lost anyway.
vehicle. The utility and feasibility of each method are
Although the seats were originally intended for described below.
use during first-stage ascent or during gliding An escape module can offer an opportunity for
flight below 100,000 feet, analysis showed that crew escape at all altitudes during a first-stage
the crew would be exposed to the Solid Rocket time-critical emergency if the escape system itself
Booster and main engine exhaust plumes if they is not damaged to the point that it cannot func-
ejected during ascent. During descent, the seats tion. The module must be sufficiently far from
provided good protection from about 100,000 feet the vehicle at the time of catastrophe that neither
to landing. it nor its descent system is destroyed. Incorpora-
After the Space Shuttle completed the four test tion of an escape module would require signifi-
flights it was certified for "operational" flights. But cant redesign of the Orbiter: some structural rein-
missions for the "operational" flights required forcement, pyrotechnic devices to sever the escape
more crew members, and there were no known module from the rest of the Orbiter, modifica-
ejection systems, other than an entire cabin tions to sever connections that supply power and
escape module, that could remove the entire crew fluids, separation rockets and a parachute system.
within the necessary time. The Orbiter configura- An additional weight penalty would result from
tion allowed room for only two ejection seats on the requirement to add mass in the rear of the
the flight deck. With alternative ejection concepts Orbiter to compensate for the forward shift in the
and redesign of the flight deck, this number might center of gravity. Recent estimates indicate this
have been increased slightly, but not to the full could add as much as 30,000 pounds to the weight
crew size. Thus, because of limited utility dur- of the Orbiter.4 This increase in weight would
ing first-stage ascent and inability to accom- reduce payload capacity considerably, perhaps
modate a full crew, the ejection seats were unacceptably. There is no current estimate of the
eliminated for operational flights. attendant cost.
The present Shuttle has no means for crew An escape module does theoretically offer the
escape, either during first-stage ascent or during widest range of crew escape options. The other
gliding flight. Conventional ejection seats do not two options, rocket extraction and bail-out, are
appear to be viable Space Shuttle options because only practical during gliding flight. Both methods
they severely limit the crew size and, therefore, would be useful when the Orbiter could not reach
prevent the Space Shuttle from accomplishing its a prepared runway, for they would allow the crew
mission objectives. The remaining options fall in- to escape before a very hazardous landing or a
to three categories: water ditching. Aerodynamic model tests showed
that a crew member bailing out through either
1. Escape Module. The entire crew compart- the side or overhead hatch would subsequently
ment would be separated from the Orbiter contact the wing, tail or orbital maneuvering
and descend by parachute. system pod unless he or she could exit with suffi-
2. Rocket-assisted Extraction. Many military cient velocity (> 5 to 10 feet per second) to avoid
aircraft employ a system using a variety of these obstacles. Slides and pendant rocket systems
small rocket-assisted devices to boost oc- were evaluated as means of providing this veloci-
cupants from the plane. Such a system ty, but all concepts of bail-out and rocket extrac-
could be used in the Orbiter. tion that were studied require many minutes to
3. Bail-Out System. The crew can exit get the entire crew out and would be practical
unassisted through a hatch during con- only during controlled gliding flight. The results
trolled, gliding flight. of these studies were presented at the Program
Requirements Change Board session held on
Only one of these, the escape module, offers May 12, 1983, and subsequently to the NASA
the possibility of escape during first-stage ascent. administrator, but none of the alternatives was

183
implemented because of limited capability and To understand how the booster rockets were
resulting program impacts. destroyed, one must understand the purpose of
There is much discussion and disagreement a range safety system, its functions, and the
over which escape systems are feasible, or whether special considerations that apply to Shuttle
any provide protection against a significant launches.
number of failure modes. The Eastern Space and Missile Center operates
The astronauts testifying before the Commis- a range safety system for all Department of
sion on April 3, 1986, agreed that it does not ap- Defense and NASA launch activities in the Cape
pear practical to modify the Orbiter to incor- Canaveral area. The primary responsibility of the
porate an escape module. The astronauts dis- range safety system, run by the U.S. Air Force,
agreed, however, about which of the other two is to protect people and property from abnormal
systems would be preferable. As Astronaut Weitz vehicle flights during first stage ascent.
testified: To fulfill its range safety responsibilities, the
"John [Astronaut John Young] likes the Eastern Space and Missile Center staff supervises
rocket extraction system because it does on-site launch preparations and tracks rockets and
cover a wider flight regime and allows you vehicles until they are far enough away from
to get out perhaps with the vehicle only populated areas to remove any danger. When
under partial control as opposed to complete such a danger arises during the ascent stage of
control; however, any system that adds more a launch, the vehicle may have to be destroyed
parts like rockets gets more complex. . . . to minimize harm to persons and property on the
The only kind of a system that I think is even ground. Every major vehicle flown from the Cape
somehow feasible would be maybe some Canaveral area has carried an explosive destruct
system that could be armed and fired by the range
kind of a bail-out system that could be used
subsonic." 5 safety officer.
Range safety procedures in launch activities
In its 1982 Annual Report, the Aerospace Safe- from Kennedy are governed by Department of
ty Advisory Panel listed "crew escape . . at Defense and NASA documents. The primary
launch and prior to potential ditching"6 as a regulatory publication is DOD Document
priority item that warranted further study. The 3200.11, Use, Management, and Operation of
Commission fully supports such studies. In par- DOD Major Ranges and Test Facilities.
ticular, the Commission believes that the crew
should have a means of escaping the Orbiter in
controlled, gliding flight. The Commission thinks Space Shuttle Range Safety System
it crucial that the vehicle that will carry astronauts Both Space Shuttle Solid Rocket Boosters and
into orbit through this decade and the next in- the External Tank are fitted with explosive
corporate systems that provide some chance for charges. These can be detonated on the command
crew survival in emergencies. It nonetheless ac- of the range safety officer if the vehicle crosses
cepts the following point made by Astronaut the limits established by flight analysis before
Robert Crippen: launch and the vehicle is no longer in controlled
flight. The determination of controllability is
"I don't know of an escape system that made by the flight director in Mission Control,
would have saved the crew from the par- Houston, who is in communication with the
ticular incident that we just went through range safety officer. Following an encoded "arm"
[the Challenger accident]."7 command, the existing package on the Shuttle
System is detonated by a subsequent encoded
Range Safety "fire" command.
Television coverage of the Challenger accident The range safety officer who sends the com-
vividly showed the Solid Rocket Boosters emerg- mands is the key decision maker who is finally
ing from the ball of fire and smoke. The erratic responsible for preventing loss of life and property
and uncontrolled powered flight of such large that could result if the vehicle or components
components could have posed a potential danger should fall in populated areas. The destruct
to populated areas. The responsible official ac- criteria are agreed to by NASA and the Eastern
cordingly destroyed the Solid Rocket Boosters. Space and Missile Center.

184
A range safety system for the Shuttle launches Bieringer's written statement prepared approx-
was approved in concept in 1974. Under that con- imately two hours after the accident:
cept, the capability to destroy the system in flight
"Watching the IP [impact point] displays
and optics I observed the primary and alter-
Range Safety System Components nate sources diverge significantly at about
T + 76 [76 seconds into the flight]. At about
Linear Shaped Charge the same time I heard . . . [through
monitored communications] the vehicle had
exploded. Concurrently, I saw the explosion
on the video monitor on my right. A white
cloud seemed to envelop the vehicle, small
pieces exploded out of it. The IP displays
PRI and ALT indications were jumping
around wildly. I was about to recommend
we do nothing as it appeared the entire vehi-
Linear Shaped Charge cle had exploded when I observed what ap-
Range Safety
Command Antennas peared to be an SRB [Solid Rocket Booster]
SRB Linear Shaped Charges
stabilized and flying toward the upper left
Drawing shows position of linear shaped charges and range corner of the display. As it appeared stabil-
safety command antennas on Solid Rocket Boosters and Ex-
ternal Tank.
ized I felt it might endanger land or ship-
ping and as the FT [Fxternal Tank] had ap-
parently exploded I recommended to the
SRSO [senior range safety officer] we send
functions. I sent ARM, waited about 10
seconds, and sent FIRF. . . . FIRF was sent
from the ground was to be installed in the form
at about 110 [seconds]."8
of radio detonated explosive charges triggered by
encoded signals. Such a range safety package ap- During the flight and prior to the accident,
peared necessary for a variety of reasons based tracking and control functions performed normal-
upon the initial Shuttle design that included ejec- ly. There were no communications problems
tion seats. If the crew were to eject, the unmanned throughout the range or with the NASA flight
vehicle would be uncontrollable and thus a much dynamics officer in Mission Control, Houston.
greater danger than a manned system.
Range safety data displays did not provide
After the first four test flights, however, the useful information immediately after the accident.
ejection seats were deactivated. Retaining the The range safety officer depended upon the video
range safety package when the crew could no displays for evidence concerning the performance
longer escape was an emotional and controver- of the Solid Rocket Boosters. Without that infor-
sial decision. In retrospect, however, the mation, the range safety officer would not have
Challenger accident has demonstrated the need sent the destruct signals. Detailed studies from
for some type of range safety measure. Since the Marshall had indicated that Solid Rocket
current range safety system does not allow for Boosters would tumble if prematurely separated.
selective destruction of components, the Commis- That assumption made possible the prediction of
sion believes that NASA and the Air Force should impact points. When the Challenger Solid Rocket
critically re-examine whether the destruct package Boosters separated after the explosion, however,
on the External Tank might be removed. they continued powered, stabilized flight and did
not tumble, contrary to the expectations upon
Range Safety Activities, January 28, 1986 which range safety rules had been based. Without
The range safety officer for the Challenger the live television pictures, the range safety of-
flight on January 28 was Maj. Gerald F. ficer would not have known about the unexpected
Bieringer, U.S. Air Force. He reported that the performance of the boosters.
mission was normal until about 76 seconds after The Eastern Space and Missile Center and
launch. The following description is from Maj. NASA have appropriately initiated a comprehen-

185
sive review of the Shuttle range safety re- Findings
quirements and their implementation. The events 1. The Space Shuttle System was not designed
of the Challenger accident demonstrate the need to survive a failure of the Solid Rocket Boosters.
for a range safety package of some type on the There are no corrective actions that can be taken
Solid Rocket Boosters. However, the review if the boosters do not operate properly after
should examine whether technology exists that ignition, i.e., there is no ability to separate an
would allow combining the range safety function Orbiter safely from thrusting boosters and no
for the Solid Rocket Boosters with a thrust ter- ability for the crew to escape the vehicle during
mination system, and whether, if technically first-stage ascent.
feasible, it would be desirable.
Neither the Mission Control Team nor the
Postflight Analysis 51-L crew had any warning of impending
disaster.
The Mission Control Center in Houston had
no more warning of the impending disaster than Even if there had been warning, there were
the range safety officer had. All information that no actions available to the crew or the Mis-
might be useful in recognizing problems that the sion Control Team to avert the disaster.
crew or the mission control flight team could do
something about is available to flight controllers Landing: Another Critical Phase
during the launch, but that information con-
stitutes only a fraction of the electronic data being The consequences of faulty performance in any
telemetered from the Shuttle. To ensure that dynamic and demanding flight environment can
nothing was overlooked during the launch, be catastrophic. The Commission was concerned
Johnson flight controllers conducted a thorough that an insufficient safety margin may have ex-
analysis of the telemetry data on January 29 and isted in areas other than Shuttle ascent. Entry and
30, 1986. landing of the Shuttle are dynamic and demand-
Their review of the recorded events revealed ing with all the risks and complications inherent
that the chamber pressure inside the right Solid in flying a heavyweight glider with a very steep
Rocket Booster began to differ from that of the glide path. Since the Shuttle crew cannot divert
left booster approximately 60 seconds after lift off. to any alternate landing site after entry, the land-
A sampling of that information is available to a ing decision must be both timely and accurate.
flight controller during ascent, but the internal In addition, the landing gear, which includes
pressures of the boosters are normally not wheels, tires and brakes, must function proper-
monitored during the first stage. The readings ly. These considerations will be discussed for both
are used only to indicate whether the crew can normal and abort landings.
expect an on-time or slightly delayed separation
of the boosters from the Orbiter and External
Abort Site Weather
Tank. The difference in pressure during the brief The acceptability of the weather at abort land-
ascent of Challenger was small, and pressures ing sites, both inside and outside the continental
were within acceptable limits. United States, is a critical factor in the launch
The replay of the data also indicated that the decision process. The local weather minima for
vehicle flight control system was responding prop- the actual launch are necessarily restrictive. The
erly to external forces and continued to control minima for acceptably safe abort landings are
the Shuttle until the accident. No unusual mo- even more restrictive. Of course, the wider the
tion responses occurred, and inside the cockpit range of acceptable weather conditions, the
there were no alarms. There are no indications greater the possibility of launch on any given day.
that the crew had any warning of a problem As a result of past efforts to increase the likelihood
before the fire and the disintegration of the Space of launch, abort landing weather criteria are cur-
Shuttle. rently less restrictive than the criteria for planned
landings.
The program also allows consideration of
launching with a light rain shower over the Ken-
nedy runway. Although engineering assessments

186
indicate that the tile damage that would result The tires are rated as Criticality 1 because loss
would not affect Shuttle controllability, it would of a single tire could cause loss of control and
be a serious setback to the program in terms of subsequent loss of vehicle and crew.
budget and schedule. This rule is designed to Based upon approach and landing test ex-
allow the program to weigh the probability of a perience, crosswind testing was added to the
return-to-launch-site abort and decide whether Space Shuttle tire certification testing. To date,
it is worthwhile to launch and accept the risk of Orbiters have landed with a maximum of 8 knots
a setback because of tile damage should a return- of crosswind at the Kennedy runway resulting in
to-launch-site abort be required. This risk appears heavy tire wear: both spinup wear that occurs ini-
to be unnecessary. tially at touchdown and crosswind wear induced
The programmatic decision to accept worse by side forces and differential braking. While
weather for an abort landing, in a situation where dynamometer tests indicated that these tires
other conditions are also less than optimal, is not should withstand conditions well above the design
consistent with a conservative approach to flight specification, the tests have not been able to
safety. The desire to launch is understandable, simulate runway surface effects accurately. A
and abort landings are indeed improbable. Langley Research Center test track has been used
However, if an abort is required, it is irrelevant to give a partial simulation of the strains caused
that it was unlikely. An emergency, the loss of by a landing at Kennedy. This test apparatus will
a Space Shuttle Main Engine, has already oc- be upgraded for further testing in the summer
curred to produce the necessity. Abort situations of 1986 in an attempt to include all the repre-
will require landing under emergency conditions sentative flight loads and conditions.
on limited runways with Orbiter weights higher The tires have undergone extensive testing to
than normal. The difficulties should not be examine effects of vacuum exposure, temperature
compounded by high crosswinds or reduced extremes, and cuts. They also have undergone
visibility. The Commission recommended that leakage, side force, load, storage, and durability
this subject be reviewed, and those reviews are tests. The tires have qualified in all these areas.
currently underway. To date, tests using the simulated Kennedy
runway at Langley indicate that spinup wear by
Orbiter Tires and Brakes itself will not lead to tire failure. Tests using the
The Aerospace Safety Advisory Panel has Kennedy test surface do indicate that spinup wear
shared NASA's concern over the Orbiter wheels, is worse if the tire is subjected to crosswind. For
tires and brakes since the beginning of the Shut- this reason, the crosswind allowable for normal
tle program. This is summarized in its 1982 An- landings is limited to 10 knots. This restriction
nual Report. also permits a safe stop if the nosewheel steering
"The landing gear including wheels, tires, system fails. The limitation is being reviewed to
and brakes is vital for safe completion of any see if it is too high for abort landings involving
mission. With the future flights going to nosewheel steering failure. Testing has not been
higher weights and lower margins, possibly conducted to ensure that excessive crosswind wear
even negative margins, it is imperative that will not be a hazard when landing on the various
existing capabilities be fully explored, hard surface runways with maximum crosswinds
documented and improved where and failed nosewheel steering.
necessary."9 Main tire loads are increased substantially after
nosewheel touchdown because of the large
Orbiter Tires downward wing force at its negative angle of at-
Orbiter tires are manufactured by B.F. tack. The total force on each side can be nearly
Goodrich and are designed to support a Space 200,000 pounds, which exceeds the capability of
Shuttle landing up to 240,000 pounds at 225 knots a single tire. In fact, the touchdown loads alone
with 20 knots of crosswind. The tires have a can exceed the load bearing ability of a single tire.
34-ply rating using 16 cords. Though they have The obvious result is that if a single tire fails
successfully passed testing programs, they have before nosegear touchdown, the vehicle will have
shown excessive wear during landings at Ken- serious if not catastrophic directional control
nedy, especially when crosswinds were involved. problems following the expected failure of the ad-

187
jacent tire. This failure case has led to a Criticality response from the Shuttle program management
1 rating on the tires. Before nosegear touchdown, was not a redesign of the brakes, but an exten-
control is maintained through the rudder. sion of required runway length from 10,000 to
However, it loses effectiveness as the speedbrake 12,500 feet. Thus, the brakes for many years have
is opened and the vehicle decelerates. After been known to have little or no margin, even if
nosegear touchdown, simulations have shown they performed as originally designed.
that directional control is possible using the There are four brake assemblies, one for each
nosewheel steering system for most subsequent main landing gear wheel. Each assembly uses
failures, but not for some cases in which four rotors and three stators, the stators being at-
crosswinds exceed the current flight rule limits. tached to a torque tube. Carbon pads are attached
Because of the consequences of this failure, crew to provide the friction surface. The Orbiter brakes
members strongly recommend that the nosewheel were designed to absorb 36.5 million foot-pounds
steering system be modified to achieve full of energy for normal stops and 55.5 million foot-
redundancy. pounds of energy for one emergency stop. The
Tire side loads have been difficult to measure brakes were tested and qualified using standard
and subsequently model because of test facility dynamometer tests.
limitations. Two mathematical models were Actual flight experience has shown brake
developed from early dynamometer tests and ex- damage on most flights. The damage is classified
trapolation from nosewheel tire tests. New by cause as either dynamic or thermal. The
dynamic tests of main gear tires show a more flex- dynamic damage is usually characterized by
ible side response, which has been incorporated damage to rotors and carbon lining chipping, plus
into the latest mathematical model. A reasonably beryllium and pad retainer cracks. On the other
accurate model is required both for nosewheel hand, the thermal damage has been due to
steering engineering studies and for crew train- heating of the stator caused by energy absorp-
ing simulators. tion during braking. The beryllium becomes duc-
The Orbiter tire in use meets specifications and tile and has a much reduced yield strength at
has been certified through testing. However, temperatures possible during braking. Both types
testing has not reproduced results observed on of damage are typical of early brake development
Kennedy runways. To date, the only blown tire problems experienced in the aviation industry.
has been caused by a brake lockup and the Brake damage has required that special crew
resulting skid wear. procedures be developed to assure successful
Several improvements have been considered to braking. To minimize dynamic damage and to
increase protection against the high-speed blown- keep any loose parts together, the crews are told
tire case. One would add a skid at the bottom to hold the brakes on constantly from the time
of the main gear strut to take the peak load dur- of first application until their speed slows to about
ing nosegear touchdown; another would add a 40 knots. For a normal landing, braking is ini-
roll-on-rim capability to the main gear wheel. tiated at about 130 knots. For abort landings,
None of the possible improvements has been braking would be initiated at about 150 knots.
funded, however, nor has any been seriously Braking speeds are established to avoid exceeding
studied. the temperature limits of the stator. The earlier
In summary, two blown tires before nosegear the brakes are applied, the higher the heat rate.
touchdown would likely be catastrophic, and the The longer the brakes are applied, the higher the
potential for that occurrence should be mini- temperature will be, no matter what the heat rate.
mized. NASA has directed testing in the fall of To minimize problems, the commander must get
1986 to examine actual tire, wheel, and strut the brake energy into the brakes at just the right
failures to better understand this failure case. rate and just the right time before the beryllium
yields and causes a low-speed wheel lockup.
Orbiter Brakes At a Commission hearing on April 3, 1986,
The Orbiter brake design chosen in 1973 was Astronaut John Young described the problem the
based on the Orbiter's design weight. It used Shuttle commander has with the system:
beryllium rotors and stators with carbon lining. "It is very difficult to use precisely right
However, as the actual Orbiter weight grew, the now. In fact, we're finding out we don't real-
1!
ly have a good technique for applying the and to perform destructive testing. The testing
brakes. . . . We don't believe that astronauts results are expected to conform more closely to
or pilots should be able to break the flight conditions because landing gear dynamics
brakes."10 have been included. Early tests have confirmed
Missions 5, 51-D and 61-C had forms of ther- the energy levels for the abort braking profile with
mal stator damage. The mission 51-D case a modified brake, and future tests may provide
resulted in a low-speed wheel lockup and a subse- confidence in the normal braking profile.
quent blown tire at Kennedy. The mission 61-C The Aerospace Safety Advisory Panel recog-
case did not progress to a lockup but came very nized NASA's efforts in its 1985 Annual Report:
close. The amount of brake energy that can be "A carbon brake review was conducted by
obtained using normal braking procedures is NASA in early December, 1985, and re-
about 40 million foot-pounds before the first stator sulted in agreement to procure a carbon
fails. The mission 61-C damage occurred at 34 brake system for the Orbiter. . . . There is
million foot-pounds but had not progressed to the concern by the STS [Space Transportation
lockup condition. Inspection of failed stators System] management about the availabili-
clearly shows the ductile failure response of the ty of resources to support the development
beryllium, and, hence, it appears that this failure of the carbon brakes given the many com-
mechanism cannot contribute to a high-speed peting requirements and the projected con-
lockup and subsequent tire failure. It should be strained budget during the 1986 period. The
noted that the brake specification called for a program management considers the de-
maximum energy of 55 million foot-pounds. velopment of the carbon brake system to be
Qualification testing of the abort braking profile of the highest priority . . . and the Panel sup-
showed that 55 million foot-pounds was the point ports this position as it has in the past."11
of first stator failure. During qualification tests,
the brakes continued to operate until all stators Because of the brake problems encountered in
failed, providing about another 5 million foot- the program, two reviews have been conducted
pounds of energy. Based upon the thermal by NASA. The third review will take place dur-
response of beryllium under load, it appears that ing the summer of 1986. The review board
the early heavy braking required for transatlan- members have studied all of the Orbiter brake
tic abort landings produces more than the 40 data and have compared Orbiter problems to in-
million foot-pounds that have resulted in thermal dustry problems. Improvements suggested have
failure of the brakes during the normal braking been implemented. It is the consensus of NASA
profile. No numbers are certain, however, and and industry experts that high priority should be
clearly the qualification testing did not point out placed on correcting Orbiter brake problems, and
the current thermal problems. that brake redesign should proceed with emphasis
The assumed normal and abort brake energy on developing higher energy and torque capacity.
limits for the current design should be Concern within the program about the entire
reinvestigated. The 61-C damage resulted from deceleration system (landing gear, wheels, tires,
only 34 million foot-pounds of energy. If this brakes and nosewheel steering) has been the sub-
same brake design is to continue to fly, the mis- ject of numerous reviews, meetings and design
sion 61-C damage should be fully understood, efforts. These concerns continued to be expressed
and destructive testing should be accomplished by the Aerospace Safety Advisory Panel in 1982:
to establish the short runway (transatlantic abort "Studies of Shuttle landings to date show
landing) brake limit and appropriate abort land- that tire, wheel and brake stresses are ap-
ing planning factors. proaching limits." 12
NASA is considering stator improvements, in-
cluding steel or thicker beryllium stators, and has "Short runways, with inadequate over-
undertaken a carbon brake program that would runs, are cause for concern, for instance, a
provide a major margin improvement and less transatlantic abort to Dakar." 13
dynamic damage because of fewer parts. Addi- The issues are difficult, and the required
tional testing is currently underway, and more technology is challenging, but most agree that it
is planned, to evaluate these brake modifications is appropriate and important that NASA resolve

189
each of these problems. A conservative approach ministration and International Civil Aviation
to the landing phase of flight demands reliable Organization specification requirements. Accord-
performance by all critical systems. ing to NASA, it was the best runway that the
world knew how to build when the final design
Kennedy Space Center Landings was determined in 1973.
The original Space Shuttle plan called for In the past several years, questions about
routine landings at Kennedy to minimize turn- weather predictability and Shuttle systems per-
around time and cost per flight and to provide formance have influenced the Kennedy landing
an efficient operation for both the Shuttle system issue. Experience gained in the 24 Shuttle land-
and the cargo elements. While those considera- ings has raised concerns about the adequacy of
tions remain important, other concerns, such as the Shuttle landing and rollout systems: tires,
the performance of the Orbiter tires and brakes, brakes and nosewheel steering. Tires and brakes
and the difficulty of accurate weather prediction have been discussed earlier. The tires have shown
in Florida, have called the plan into question. excessive wear after Kennedy landings, where the
When the Shuttle lands at Edwards Air Force rough runway is particularly hard on tires. Tire
Base, California, approximately six days are wear became a serious concern after the landing
added to the turnaround time compared with a of mission 51-D at Kennedy. Spinup wear was
landing at Kennedy. That is the time required three cords deep, crosswind wear (in only an
to load the Orbiter atop the Shuttle carrier air- 8-knot crosswind) was significant and one tire
craft, a specially modified Boeing 747, and to eventually failed as a result of brake lock-up and
ferry it back to Florida for processing. skid.
Returning the Orbiter to Kennedy from Ed- This excessive wear, coupled with brake
wards costs not only time but also money: near- failure, led NASA to schedule subsequent land-
ly $1,000,000, not including the cost of additional ings at Edwards while attempting to solve these
ground support equipment, extra security and problems. At the Commission hearing on April
other support requirements. Further, the people 3, 1986, Clifford Charlesworth, director of Space
necessary to accomplish the turnaround tasks Operations at Johnson, stated his reaction to the
must be drawn from the staffs at Kennedy and blown-tire incident:
Vandenberg Air Force Base, California. They are "Let me say that following 51-D . . . one
the same people needed for the preparation for of the first things I did was go talk to then
subsequent flights. program manager, Mr. Lunney, and say we
Returning the Orbiter also imposes an addi- don't want to try that again until we under-
tional handling risk to the vehicle in both the stand that, which he completely agreed with,
loading operation and the ferry flight itself. En- and we launched into this nosewheel steer-
countering light precipitation during the ferry ing development." 14
flight has caused substantial damage to the Or-
biter thermal protection system. These costs and There followed minor improvements to the
risks, however, are minimal when compared with braking system. The nosewheel steering system
those of a Space Shuttle mission. was also improved, so that it, rather than differen-
The Kennedy runway was built to Space Shut- tial braking, could be used for directional con-
tle design requirements that exceeded all Federal trol to reduce tire wear.
Aviation Administration requirements and was These improvements were made before mis-
coordinated extensively with the Air Force, sion 61-C, and it was deemed safe for that mis-
Dryden Flight Research Center, NASA Head- sion and subsequent missions to land at Kennedy.
quarters, Johnson, Kennedy, Marshall and the Bad weather in Florida required that 61-C land
Army Corps of Engineers. The result is a single at Edwards. There were again problems with the
concrete runway, 15,000 feet long and 300 feet brakes, indicating that the Shuttle braking system
wide. The grooved and coarse brushed surface was still suspect. Mr. Charlesworth provided this
and the high coefficient of friction provide an all- assessment to the Commission:
weather landing facility. "Given the problem that has come up now
The Kennedy runway easily meets the intent with the brakes, I think that whole question
of most of the Air Force, Federal Aviation Ad- still needs some more work before I would

190
be satisfied that yes, we should go back and going to overcome the weather unpre-
try to land at the Cape."15 dictability." 16
The nosewheel steering, regarded as fail-safe, Once the Shuttle performs the deorbit burn,
might better be described as fail-passive: at worst, it is going to land approximately 60 minutes later;
a single failure will cause the nosewheel to castor. there is no way to return to orbit, and there is
Thus, a single failure in nosewheel steering, no option to select another landing site. This
coupled with failure conditions that require its means that the weather forecaster must analyze
use, could result in departure from the runway. the landing site weather nearly one and one-half
There is a long-range program to improve the hours in advance of landing, and that the forecast
nosewheel steering so that a single failure will must be accurate. Unfortunately, the Florida
leave the system operational. weather is particularly difficult to forecast at cer-
Eight flights have been launched with plans to tain times of the year. In the spring and summer,
land in Florida. Of those, three have been thunderstorms build and dissipate quickly and
diverted to California because of bad weather. unpredictably. Early morning fog also is very dif-
Moreover, it is indicative of the dynamic weather ficult to predict if the forecast must be made in
environment in Florida that twice in the pro- the hour before sunrise.
gram's history flights have been waved off for one In contrast, the stable weather patterns at Ed-
orbit to allow for weather conditions to improve wards make the forecaster's job much easier.
enough to be acceptable for landing. Thus, even Although NASA has a conservative philos-
if NASA eventually were to resume routine ophy, and applies conservative flight rules in
operations at Kennedy, experience indicates the evaluating end-of-mission weather, the decision
Orbiter will divert into Edwards more than 30 always comes down to evaluating a weather
percent of the time. NASA must therefore plan forecast. There is a risk associated with that. If
to use Edwards routinely. This requires reserv- the program requirements put forecasters in the
ing six days in the post-landing processing position of predicting weather when weather is
schedule for the Orbiter's ferry trip back to unpredictable, it is only a matter of time before
Florida. It also requires redundancy in the ferry the crew is allowed to leave orbit and arrive in
aircraft. The single Shuttle carrier aircraft, with Florida to find thunderstorms or rapidly form-
some one-of-a-kind support items, is presently the ing ground fog. Either could be disastrous.
only way to get the Orbiter from California back The weather at Edwards, of course, is not
to its launch site in Florida. always acceptable for landing either. In fact, only
days prior to the launch of STS-3, NASA was
Landinig Site Changes forced to shift the normal landing site from
Edwards to Northrup Strip, New Mexico,
Scheduled Actual
Mission Wavc-offs Reason Landing Landing because of flooding of the Edwards lakebed. This
Flooding Edwards Northrup
points out the need to support fully both Ken-
STS-3 1
Strip, nedy and Edwards as potential end-of-mission
(New
Mexico)
landing sites.
STS-7 2 Rain/ceiling Kennedy Edwards In summary, although there are valid program-
STS 41-C 1 Rain/ceiling Kennedy Edwards matic reasons to land routinely at Kennedy, there
STS 61-C 5 Rain/ceiling Kennedy Edwards
are concerns that suggest that this is not
wise under the present circumstances. While
The most serious concern is not that the planned landings at Edwards carry a cost in dollars
weather in Florida is bad, but that the at- and days, the realities of weather cannot be
mospheric conditions are frequently unpre- ignored. Shuttle program officials must recognize
dictable. Captain Robert Crippen testified before that Edwards is a permanent, essential part of the
the Commission on April 3, 1986: program. The cost associated with regular,
"I don't think the astronaut office would scheduled landing and turnaround operations at
disagree with the premise that you are much Edwards is thus a necessary program cost.
safer landing at Edwards. There are some Decisions governing Space Shuttle operations
things you could do, as was indicated, to must be consistent with the philosophy that un-
make Kennedy better, but you're never necessary risks have to be eliminated. Such deci-

191
sions cannot be made without a clear understand- Rocketdyne, based on the results of the fleet
ing of margins of safety in each part of the system. leader engine test program.
Unfortunately, margins of safety cannot be The life-limiting items on the high-pressure
assured if performance characteristics are not pumps are the turbine blades, impellers, seals and
thoroughly understood, nor can they be deduced bearings. Rocketdyne has identified cracked tur-
from a previous flight's "success." bine blades in the high-pressure pumps as a
The Shuttle Program cannot afford to operate primary concern. The contractor has been work-
outside its experience in the areas of tires, brakes, ing to improve the pumps' reliability by increas-
and weather, with the capabilities of the system ing bearing and turbine blade life and improv-
today. Pending a clear understanding of all land- ing dynamic stability. While considerable
ing and deceleration systems, and a resolution of progress has been made, the desired level of
the problems encountered to date in Shuttle land- turbine blade life has not yet been achieved. A
ings, the most conservative course must be fol- number of improvements achieved as a result of
lowed in order to minimize risk during this the fleet leader program are now ready for in-
dynamic phase of flight. corporation in the Space Shuttle Main Engines
used in future flights, but have not been im-
plemented due to fiscal constraints.18 Immediate
Shuttle Elements implementation of these improvements would
allow incorporation before the next Shuttle flight.
The Space Shuttle Main Engine teams at Mar- The number of engine test firings per month
shall and Rocketdyne have developed engines that has decreased over the past two years. Yet this
have achieved their performance goals and have test program has not yet demonstrated the limits
performed extremely well. Nevertheless the main of engine operation parameters or included tests
engines continue to be highly complex and critical over the full operating envelope to show full
components of the Shuttle that involve an element engine capability. In addition, tests have not yet
of risk principally because important components been deliberately conducted to the point of failure
of the engines degrade more rapidly with flight to determine actual engine operating margins.
use than anticipated. Both NASA and Rocket- The Orbiter has also performed well. There
dyne have taken steps to contain that risk. An is, however, one serious potential failure mode
important aspect of the main engine program has related to the disconnect valves between the Or-
been the extensive "hot fire" ground tests. Un- biter and the External Tank. The present design
fortunately, the vitality of the test program has includes two 17-inch diameter valves, one con-
been reduced because of budgetary constraints. trolling the oxygen flow, and the other the
The ability of the engine to achieve its pro- hydrogen flow from the tank to the Orbiter's three
gramed design life is verified by two test engines. Each of the disconnect valves has two
engines. These "fleet leader" engines are test fired flappers that close off the flow of the liquid
with sufficient frequency that they have twice as hydrogen and oxygen when the External Tank
much operational experience as any flight engine. separates from the Orbiter. An inadvertent
Fleet leader tests have demonstrated that most closure by any of the four flappers during nor-
engine components have an equivalent 40-flight mal engine operation would cause a catastrophe
service life. As part of the engine test program, due to rupture of the supply line and/or tank.
major components are inspected periodically and New designs are under study, incorporating
replaced if wear or damage warrants. Fleet modifications to prevent inadvertent valve
leader tests have established that the low-pressure closures. Redesigned valves could be qualified,
fuel turbopump and the low-pressure oxidizer certified and available for use on the Shuttle's next
pump have lives limited to the equivalent of 28 flight.
and 22 flights, respectively. The high-pressure While the External Tank has performed flaw-
fuel turbopump is limited to six flights before lessly during all Shuttle flights, one area of con-
overhaul; the high-pressure oxidizer pump is cern pertains to the indicators for the two valves
limited to less than six flights.17 An active pro- which vent the liquid hydrogen and liquid oxy-
gram of flight engine inspection and component gen. These valves can indicate they are closed
replacement has been effectively implemented by when they might be partially open. This condi-

192
tion is potentially hazardous, since leaks of either Maintenance Instructions are in need of an
gaseous oxygen or hydrogen prior to launch, or overall review and update, and the performance
in flight, could lead to fires. This could, in turn, of Operations and Maintenance Instructions
lead to catastrophic failure of the External Tank. needs to be improved.
NASA is currently studying design modifications
to the valve position indicators. This effort could Missed Requirements
be expedited and the redesigned indicators in- At the time of launch, all items called for by
stalled before the next flight of the Shuttle. the Operational Maintenance Requirements and
Specifications Document were to have been met,
waived or excepted. The 51-L audit review has
Processing and Assembly revealed additional areas where such re-
quirements were not met and were not formally
During the processing and assembly of the waived or excepted:
elements of flight 51-L, various problems were 1. A formal post-flight inspection of the for-
seen in the Commission's review which could bear ward External Tank attach plate was not
on the safety of future flights. documented.
2. A forward avionics bay closeout panel was
Structural Inspections not verified as installed during Orbiter
During the 51-L processing, waivers were rollover/stacking operations (the area was
granted on 60 of 146 required Orbiter structural properly configured prior to flight with in-
inspections. Seven of these waivers were second- stallation of a locker).
time waivers of inspections. 3. Flight 51-L was launched with only one of
A formal structural inspection plan for the two crew hatch microswitches showing the
Shuttle fleet had not been fully developed, and proper indication. This condition was
not all of the 146 inspections had been scheduled documented by a Problem Report and was
for the 51-L processing. In order to minimize the deferred; no waiver was obtained, however.
flight delay until the implementation plan could 4. Post-flight hydraulic reservoir sampling was
be fully developed, the waivers were documented, not performed prior to connection of
requested and granted by Level II at Johnson. ground hydraulic support equipment at
The structural inspection requirements are Dryden Flight Research Facility, but was
relatively new and not completely mature. A performed in the Orbiter Processing
working group was formed in December 1985, Facility.
to expedite a structural inspection plan. A plan 5. During Auxiliary Power Unit hypergolic
now exists for future structural inspections. The loading operations, the Number 2 tank
Commission believes that these inspections should evacuation prior to loading was not main-
not be waived. The fleet of Orbiters has no coun- tained above 20 inches of mercury for five
terpart anywhere in the world. There is no data minutes as required (19.8 inches main-
base relative to reusable spacecraft. The Orbiter's tained for 2 hours). This incident was
operating environment is totally different from documented as an acceptable condition by
that of airliners, and the program must closely Kennedy, Johnson and Launch Support
track the effects of the Orbiters' age and use.19 Service, but no waiver was submitted.
6. Landing gear voids were not replenished
Records and crew module meters were not verified
Throughout the Commission's review of the ac- during final vehicle closeouts. The addi-
cident, a large number of errors were noted in tional requirement to replenish the landing
the paperwork for the Space Shuttle Main gear voids during launch countdown was
Engine/Main Propulsion System and for the Or- performed.20
biter. The review showed, however, that in the
vast majority of cases the problem lay in the Inspection by Proxy
documentation itself and not in the work that was Another aspect of the processing activities that
actually accomplished. The review led the Com- warrants particular attention is the Shuttle Proc-
mission to conclude that the Operations and essing Contractor's policy of using "designated

193
verifiers" to supplement the quality assurance Loss of bricks from the flame trench was also
force. A designated verifier is a senior technician experienced during the launch of STS-1 (April,
who is authorized to inspect and approve his own 1981) and STS-2 (November, 1981) from Pad A,
and his fellow technicians' work in specific non- though at locations closer to the centerline of the
flight areas, instead of NASA quality assurance vehicle. Since the brick was blown out of the
personnel inspecting the work. The aviation in- flame trench and away from the vehicle, there is
dustry follows this practice in performing verifica- no evidence to indicate that the loose brick might
tions for the Federal Aviation Administration. have endangered the 51-L vehicle, but it may be
The Shuttle Processing Contractor has about 770 possible for damage to occur if the condition re-
designated verifiers (nearly 15% of the work mains uncorrected. The Pad B fire brick is to be
force).21 The NASA quality assurance inspection replaced by refractory concrete, as was done on
program no longer covers 100 percent of the in- Pad A.
spection areas. Due to reduced manpower,
NASA personnel now inspect only areas that are
considered more critical. Thus the system of in-
dependent checks that NASA maintained through
several programs is declining in effectiveness. The Involvement of Development
effect of this change requires careful evaluation Contractors
by NASA.
The Space Shuttle program, like its
Accidental Damage Reporting predecessors Mercury, Gemini, Apollo, Skylab
While not specifically related to the Challenger and Apollo-Soyuz, is clearly a developmental pro-
accident, a serious problem was identified dur- gram and must be treated as such by NASA. In-
ing interviews of technicians who work on the Or-
deed, the chief differences between the Shuttle
biter. It had been their understanding at one time
and previous developmental programs are that
that employees would not be disciplined for ac- the Shuttle is principally a transportation system
cidental damage done to the Orbiter, provided and employs reusable hardware. Reusability im-
the damage was fully reported when it occurred. plies a new set of functions such as logistics sup-
It was their opinion that this forgiveness policy
port, maintenance, refurbishment, lifetime con-
was no longer being followed by the Shuttle Proc- cerns and structural inspections that must be
essing Contractor. They cited examples of addressed by the program.
employees being punished after acknowledging
In order to enhance post-flight "turnaround"
they had accidentally caused damage. The techni-
schedule and efficiency, NASA is striving to im-
cians said that accidental damage is not con-
plement processing procedures accepted by the
sistently reported, when it occurs, because of lack
transportation industry. While this effort is useful,
of confidence in management's forgiveness policy
there is not an exact industry analogy to the Or-
and technicians' consequent fear of losing their
biter vehicles' flight operations, because each
jobs. This situation has obvious severe implica-
successive Shuttle mission expands system and
tions if left uncorrected.
performance requirements. Consequently, the
Shuttle configuration is evolving as design
Launch Pad 39B changes and improvements are incorporated. The
demands of individual payloads can cause signifi-
cant additional developmental changes.
All launch damage and launch measurement
These developmental aspects make significant
data from Pad B ground systems anomalies were
demands, which can be met only by the follow-
considered to be normal or minor with three ex-
ing strategies:
ceptions: the loss of the springs and plungers on
the booster hold-down posts; the failure of the 1. Maintain a significant engineering design
gaseous hydrogen vent arm to latch; and the loss and development capability among the
of bricks from the flame trench. These three items Shuttle contractors and an ongoing engi-
are treated in Appendix I, the NASA Pre-Launch neering capability within NASA.
Activities Team Report (May, 1986). None con- 2. Maintain an active analytical capability
tributed to the accident. so that the evolving capabilities of the
194
Shuttle can be matched to the demands During External Tank propellant loading in
on the Shuttle. preparation for launch, the liquid hydrogen
17-inch disconnect valve was opened prior to
The Shuttle's developmental status demands that
reducing the pressure in the Orbiter liquid
both NASA and all its contractors maintain a
hydrogen manifold, through a procedural error
high level of in-house experience and technical
by the console operator. The valve was opened
ability.
with a six pounds per square inch differential.
All Shuttle contractors and their corresponding
This was contrary to the critical requirement that
NASA project organizations expressed concern
the differential be no greater than one pound per
about the organization of contractor services.
square inch. This pressure held the valve closed
When Shuttle operations were begun, the prime
for approximately 18 seconds before it finally
development contractors had total responsibility
slammed open abruptly. These valves are ex-
for all Shuttle activities. The concept of a single
tremely critical and have very stringent tolerances
Shuttle Processing Prime Contractor was adopted
to preclude inadvertent closure of the valve dur-
as NASA policy in 1981, and implemented in
ing mainstage thrusting. Accidental closing of a
1983 when a team led by Lockheed Space Opera-
disconnect valve would mean catastrophic loss of
tions was selected. The Lockheed team includes
Orbiter and crew. The slamming of this valve
Lockheed Missiles & Space Company, respon-
(which could have damaged it) was not reported
sible for processing the Orbiter; Grumman Aero-
by the operator and was not discovered until the
space Corporation, responsible for operation and
post-accident data review. Although this incident
maintenance of the launch processing system;
did not contribute to the 51-L incident, this type
Pan American World Airways, charged with in-
of error cannot be tolerated in future operations,
troducing and maintaining airline methods and
and a policy of rigorous reporting of anomalies
techniques in the processing system; Morton
in processing must be strictly enforced.
Thiokol, Inc., responsible for processing the Solid
During the pre-launch processing and post-
Rocket Boosters and External Tank; and Rocket-
flight refurbishment of the Orbiter, Rockwell
dyne, responsible for processing the Shuttle main
the development contractor acts largely as an
engines.
adviser to the Shuttle Processing Contractor.
Lockheed's performance as Shuttle Processing
Martin Marietta has a similar role regarding the
Contractor is judged on the basis of a NASA
pre-launch processing of the External Tank. In
grading system using agreed criteria. In
contrast, NASA directed the Shuttle Processing
September, 1984, the company was marked down
Contractor to subcontract with Rocketdyne and
for failure to form a coordinated contractor team.
Thiokol for the processing and refurbishment of
As a result of that grading, Lockheed earned for
the main engines and the Solid Rocket Motors,
that period an award fee of about one-quarter of
respectively. If Rockwell and Martin Marietta,
one percent of cost, on a maximum fee scale at
as the development contractor, had a similar
that time of one percent of cost. Lockheed re-
direct involvement with their elements of the
viewed the findings of NASA's grading and did
Shuttle system, the likelihood of difficulties caused
not quarrel with its major thrust.
by improper processing would probably be de-
The award fee presently is a composite of in-
creased. Furthermore, all Shuttle elements would
centives to be earned on mission success and cost
benefit from the advantages of beginning-to-end
control. It can vary along a scale of one to 14 per-
responsibility vested in individual contractors,
cent of cost. The Shuttle Processing Contractor
each responsible for the design, development,
was earning, at the time of the Challenger acci-
manufacturing, operation, and refurbishment of
dent, about six percent of cost, or nearly mid-
their respective Shuttle elements.
point on the scale.
Although the performance of the Shuttle Proc-
essing Contractor's team has improved con-
siderably, serious processing problems have oc-
curred, especially with respect to the Orbiter. An
example is provided by the handling of the critical
17-inch disconnect valves during the 51-L flight
preparations.

195
References
1
Letter from Gerald D. Griffin, LO-82-90, September 9, 1982.
2
NASA Memo, April 14, 1986, PC 076109-076113.
3
Commission Hearing Transcript, April 3, 1986, pages
2439-2440.
4
Commission Work Session, Mission Planning and Opera-
tions Panel, April 14, 1986, JSC, page 138.
5
Commission Hearing Transcript, April 3, 1986, pages
2436-2437.
6
Page 28.
7
Commission Hearing Transcript, April 3, 1986, page 2429.
8
Visual Aid, Range Safety Officer Statement, Commission
Work Session, March 24, 1986, JSC, PC 02267-02268.
9
Page 15.
10
Commission Hearing Transcript, April 3, 1986, page 2474.
11
Page 41.
12
Pages 7-8.
13
Page 8.
14
Commission Hearing Transcript, April 3, 1986, page 2554.
15
Commission Hearing Transcript, April 3, 1986, page 2555.
16
Commission Hearing Transcript, April 13, 1986, page 2485.
17
Rocketdyne Report, BC 86-38, President Comments on the
Space Shuttle Challenger Accident Development and Production
Panel, April 2, 1986, pages 170, 171, 260-268.
18
Rocketdyne Report, BC 86-38, pages 315-324.
19
NASA Pre-Launch Activities Team Report, Appendix D,
page 188.
20
NASA Pre-Launch Activities Team Report, Appendix D,
page 186.
21
Commission Work Session, Pre-Launch, March 4, 1986,
page 206.

196
Recommendations

The Commission has conducted an ex- The Commission urges that the Administrator
tensive investigation of the Challen- of NASA submit, one year from now, a report
ger accident to determine the prob- to the President on the progress that NASA has
able cause and necessary corrective made in effecting the Commission's recommen-
actions. Based on the findings and determinations dations set forth below:
of its investigation, the Commission has
unanimously adopted recommendations to help
assure the return to safe flight.

Design. The faulty Solid Rocket Motor joint and The certification of the new design should
seal must be changed. This could be a new design include:
eliminating the joint or a redesign of the current
joint and seal. No design options should be Tests which duplicate the actual launch con-
prematurely precluded because of schedule, cost figuration as closely as possible.
or reliance on existing hardware. All Solid Rocket Tests over the full range of operating con-
Motor joints should satisfy the following ditions, including temperature.
requirements:
Full consideration should be given to conduct-
The joints should be fully understood, tested ing static firings of the exact flight configura-
and verified. tion in a vertical attitude.
The integrity of the structure and of the seals Independent Oversight. The Administrator of
of all joints should be not less than that of the NASA should request the National Research
case walls throughout the design envelope. Council to form an independent Solid Rocket
Motor design oversight committee to implement
The integrity of the joints should be insensitive the Commission's design recommendations and
to:
oversee the design effort. This committee should:
Dimensional tolerances. Review and evaluate certification require-
Transportation and handling. ments.
Assembly procedures.
Inspection and test procedures. Provide technical oversight of the design, test
Environmental effects. program and certification.
Internal case operating pressure. Report to the Administrator of NASA on the
Recovery and reuse effects. adequacy of the design and make appropriate
Flight and water impact loads. recommendations.
198
II
Shuttle Management Structure. The Shuttle to the use of astronauts in management positions.
Program Structure should be reviewed. The proj- These individuals brought to their positions flight
ect managers for the various elements of the Shut- experience and a keen appreciation of operations
tle program felt more accountable to their center and flight safety.
management than to the Shuttle program organi- NASA should encourage the transition of
zation. Shuttle element funding, work package qualified astronauts into agency management
definition, and vital program information fre- positions.
quently bypass the National STS (Shuttle) Pro-
gram Manager. The function of the Flight Crew Operations
director should be elevated in the NASA orga-
A redefinition of the Program Manager's respon- nization structure.
sibility is essential. This redefinition should give
the Program Manager the requisite authority for Shuttle Safety Panel. NASA should establish an
all ongoing STS operations. Program funding STS Safety Advisory Panel reporting to the STS
and all Shuttle Program work at the centers Program Manager. The charter of this panel
should be placed clearly under the Program should include Shuttle operational issues, launch
Manager's authority. commit criteria, flight rules, flight readiness and
risk management. The panel should include
Astronauts in Management. The Commission representation from the safety organization, mis-
observes that there appears to be a departure from sion operations, and the astronaut office.
the philosophy of the 1960s and 1970s relating

Ill
Criticality Review and Hazard Analysis. to flight to ensure mission success and flight safe-
NASA and the primary Shuttle contractors ty. An Audit Panel, appointed by the National
should review all Criticality 1, 1R, 2, and 2R Research Council, should verify the adequacy of
items and hazard analyses. This review should the effort and report directly to the Administrator
identify those items that must be improved prior of NASA.

IV
Safety Organization. NASA should establish an The responsibilities of this office should include:
Office of Safety, Reliability and Quality
The safety, reliability and quality assurance
Assurance to be headed by an Associate Ad-
functions as they relate to all NASA activities
ministrator, reporting directly to the NASA Ad-
and programs.
ministrator. It would have direct authority for
safety, reliability, and quality assurance Direction of reporting and documentation of
throughout the agency. The office should be problems, problem resolution and trends
assigned the work force to ensure adequate over- associated with flight safety.
sight of its functions and should be independent
of other NASA functional and program
responsibilities.

199
V
Improved Communications. The Commission A policy should be developed which governs
found that Marshall Space Flight Center project the imposition and removal of Shuttle launch
managers, because of a tendency at Marshall to constraints.
management isolation, failed to provide full and
timely information bearing on the safety of flight Flight Readiness Reviews and Mission
51-L to other vital elements of Shuttle program Management Team meetings should be
management. recorded.

NASA should take energetic steps to eliminate The flight crew commander, or a designated
this tendency at Marshall Space Flight Center, representative, should attend the Flight
Readiness Review, participate in acceptance
whether by changes of personnel, organiza-
tion, indoctrination or all three. of the vehicle for flight, and certify that the
crew is properly prepared for flight.

VI
Landing Safety. NASA must take actions to im- Committing to a specific landing site requires
prove landing safety. that landing area weather be forecast more
The tire, brake and nosewheel steering systems than an hour in advance. During unpredict-
must be improved. These systems do not have able weather periods at Kennedy, program of-
sufficient safety margin, particularly at abort ficials should plan on Edwards landings. In-
landing sites. creased landings at Edwards may necessitate
a dual ferry capability.
The specific conditions under which planned
landings at Kennedy would be acceptable
should be determined. Criteria must be
established for tires, brakes and nosewheel
steering. Until the systems meet those criteria
in high fidelity testing that is verified at
Edwards, landing at Kennedy should not be
planned.

VII
Launch Abort and Crew Escape. The Shuttle Make all efforts to provide a crew escape
program management considered first-stage abort system for use during controlled gliding flight.
options and crew escape options several times
during the history of the program, but because Make every effort to increase the range of flight
of limited utility, technical infeasibility, or pro- conditions under which an emergency runway
gram cost and schedule, no systems were im- landing can be successfully conducted in the
plemented. The Commission recommends that event that two or three main engines fail early
NASA: in ascent.

200
VIII
Flight Rate. The nation's reliance on the Shut- NASA must establish a flight rate that is consis-
tle as its principal space launch capability created tent with its resources. A firm payload assignment
a relentless pressure on NASA to increase the policy should be established. The policy should
flight rate. Such reliance on a single launch include rigorous controls on cargo manifest
capability should be avoided in the future. changes to limit the pressures such changes exert
on schedules and crew training.

IX
Maintenance Safeguards. Installation, test, and With regard to the Orbiters, NASA should:
maintenance procedures must be especially
rigorous for Space Shuttle items designated Develop and execute a comprehensive
Criticality 1. NASA should establish a system of maintenance inspection plan.
analyzing and reporting performance trends of Perform periodic structural inspections when
such items. scheduled and not permit them to be waived.
Maintenance procedures for such items should Restore and support the maintenance and
be specified in the Critical Items List, especially spare parts programs, and stop the practice of
for those such as the liquid-fueled main engines, removing parts from one Orbiter to supply
which require unstinting maintenance and another.
overhaul.

Concluding Thought

The Commission urges that NASA continue to receive The Commission applauds NASA's spectacular achieve-
the support of the Administration and the nation. The ments of the past and anticipates impressive achievements
agency constitutes a national resource that plays a critical to come. The findings and recommendations presented in
role in space exploration and development. It also pro- this report are intended to contribute to the future NASA
vides a symbol of national pride and technological successes that the nation both expects and requires as the
leadership. 21st century approaches.

201
Presidential Commission on the Space
Shuttle Challenger Accident

William P. Rogers, Chairman Head, Department of Aeronautics and Astro-


Former Secretary of State under President Nix- nautics, at Massachusetts Institute of
on (1969-1973), and Attorney General under Technology. Member of the National Academy
President Eisenhower (1957-1961), currently a of Engineering, he was a recipient of the Excep-
practicing attorney and senior partner in the law tional Civilian Service Award, USAF, in 1973
firm of Rogers & Wells. Born in Norfolk, New and the NASA Public Service Award in 1980. He
York, he was awarded the Medal of Freedom in holds a Doctorate in Science from Massachusetts
1973. He holds a J.D. from Cornell University Institute of Technology.
(1937) and served as LCDR, U.S. Navy
(1942-1946). Dr. Richard P. Feynman
Physicist. Born in New York City, he is Pro-
Neil A. Armstrong, Vice Chairman fessor of Theoretical Physics at California In-
Former astronaut, currently Chairman of the stitute of Technology. Nobel Prize winner in
Board of Computing Technologies for Aviation, Physics, 1965, he also received the Einstein
Inc. Born in Wapakoneta, Ohio, Mr. Armstrong Award in 1954, the Oersted Medal in 1972 and
was spacecraft commander for Apollo 11, July the Niels Bohr International Gold Medal in 1973.
16-24, 1969, the first manned lunar landing mis- He holds a Doctorate in Physics from Princeton
sion. He was Professor of Aeronautical Engineer- (1942).
ing at the University of Cincinnati from 1971 to
1980 and was appointed to the National Com- Robert B. Hotz
mission on Space in 1985. Editor, publisher. Born in Milwaukee,
Wisconsin. He is a graduate of Northwestern
David C. Acheson University. He was the editor-in-chief of ^z'a^'ora
Former Senior Vice President and General Week & Space Technology magazine (1953-1980).
Counsel, Communications Satellite Corporation He served in the Air Force in World War II and
(1967-1974), currently a partner in the law firm was awarded the Air Medal with Oak Leaf
of Drinker Biddle & Reath. Born in Washing- Cluster. Since 1982, he has been a member of
ton, DC, he previously served as an attorney the General Advisory Committee to the Arms
with the U.S. Atomic Energy Commission Control and Disarmament Agency.
(1948-1950) and was U.S. Attorney for the
District of Columbia (1961-1965). He holds an Major General Donald J. Kutyna, USAF
LL.B. from Harvard University (1948) and Director of Space Systems and Command,
served as LT, U.S. Navy (1942-1946). Control, Communications. Born in Chicago, Il-
linois, and graduate of the U.S. Military
Dr. Eugene E. Covert Academy, he holds a Master of Science degree
Educator and engineer. Born in Rapid City, from Massachusetts Institute of Technology
South Dakota, he is currently Professor and (1965). A command pilot with over 4,000 flight
202
hours, he is a recipient of the Distinguished Serv- sion at Stanford University. Consultant to
ice Medal, Distinguished Flying Cross, Legion Aerospace Corporation, Rand Corporation and
of Merit and nine air medals. the National Science Foundation, he is a member
of the American Physical Society, American
Dr. Sally K, Ride Geophysical Union, and the American
Astronaut. Born in Los Angeles, California, Astronomy Society. He holds a Doctorate in
she was a mission specialist on STS-7, launched Physics from the University of Illinois (1962).
on June 18, 1983, becoming the first American
woman in space. She also flew on mission 41-G Dr. Albert D. Wheelon
launched October 5, 1984. She holds a Doctorate Physicist. Born in Moline, Illinois, he is cur-
in Physics from Stanford University (1978) and rently Executive Vice President, Hughes Aircraft
is still an active astronaut. Company. Also a member of the President's
Foreign Intelligence Advisory Board, he served
Robert W. Rummel as a consultant to the President's Science Advisory
Space expert and aerospace engineer. Born in Council from 1961 to 1974. He holds a Doctorate
Dakota, Illinois, and former Vice President of in Physics from Massachusetts Institute of
Trans World Airlines, he is currently President Technology (1952).
of Robert W. Rummel Associates, Inc., of Mesa,
Arizona. He is a member of the National Brigadier General Charles Yeager, USAF
Academy of Engineering and is holder of the (Retired)
NASA Distinguished Public Service Medal. Former experimental test pilot. Born in Myra,
West Virginia, he was appointed in 1985 as a
Joseph F. Sutter member of the National Commission on Space.
Aeronautical engineer. Currently Executive He was the first person to penetrate the sound
Vice President of the Boeing Commercial barrier and the first to fly at a speed of more than
Airplane Company. Born in Seattle, he has been 1,600 miles an hour.
with Boeing since 1945 and was a principal figure
in the development of three generations of jet air- Dr. Alton G. Keel, Jr., Executive Director
craft. In 1984, he was elected to the National Detailed to the Commission from his position
Academy of Engineering. In 1985, President in the Executive Office of the President, Office
Reagan conferred on him the U.S. National of Management and Budget, as Associate Direc-
Medal of Technology. tor for National Security and International Af-
fairs; formerly Assistant Secretary of the Air
Dr. Arthur B. C. Walker, Jr. Force for Research, Development and Logistics;
Astronomer. Born in Cleveland, Ohio, he is and Senate Staff. Born in Newport News,
currently Professor of Applied Physics and was Virginia, he holds a Doctorate in Engineering
formerly Associate Dean of the Graduate Divi- Physics from the University of Virginia (1970).

203
Presidential Commission Staff
Dr. Alton G. Keel, Jr. Executive Director White House
Thomas T. Reinhardt Executive Secretary MAJ, USA/OMB

Special Assistants
Marie C. Hunter Executive Assistant to Rogers & Wells
the Chairman
M. M. Black Personal Secretary to OMB
Vice Chairman &
Executive Director
Mark D. Weinberg Media Relations White House
Herb Hetu Media Relations Consultant
John T. Shepherd NASA Tasking Coordination CAPT, USN (Ret)/Atty.

Administrative Staff

Stephen B. Hyle Administrative Officer ETC, USAF


Patt Sullivan Administrative Assistant NASA
Marilyn Stumpf Travel Coordination NASA
Joleen A. B. Bottalico Travel Coordination NASA
Jane M. Green Secretary NASA
Lorraine K. Walton Secretary NASA
Vera A. Barnes Secretary NASA
Virginia A. James Receptionist Contract Support

Investigative Staff

William G. Dupree Investigator, Development DOD IG


and Production
John B. Hungerford, Jr. Investigator, Development ETC, USAF
and Production
John P. Chase Investigator, Pre-Launch MAJ, USMC/DOD IG
Activities
Brewster Shaw Investigator, Pre-Launch ETC, USAF/NASA
Activities Astronaut
John C. Macidull Investigator, Accident FAA/CDR, USNR-R
Analysis
Ron Waite Investigator, Accident Engineering
Analysis Consultant
John Fabian Investigator, Mission COL, USAF/Former
Planning and Operations Astronaut
Emily M. Trapnell Coordinator, General FAA Atty.
Investigative Activities
Randy R. Kehrli Evidence Analysis DOJ Atty.
E. Thomas Almon Investigator Special Agent, FBI
Patrick J. Maley Investigator Special Agent, FBI
John R. Molesworth, Jr. Investigator Special Agent, FBI
Robert C. Thompson Investigator Special Agent, FBI
Dr. R. Curtis Graeber Human Factors Specialist ETC, USA/NASA
Michael L. Marx Metallurgist NTSB

204
Writing Support

Woods Hansen Editor Free Lance


James Haggerty Writer Free Lance
Anthony E. Hartle Writer COL, USA/USMA
William Bauman Writer CAPT, USAF/USAFA
Frank Gillen Word Processing Supervisor Contract Support
Lawrence J. Herb Art Layout Free Lance
Willis Rickert Printer NASA
Lynne Komai Design Contract Support

Documentation Support

Clarisse Abramidis Case Manager DOJ


Fritz Geurtsen Project Manager DOJ
John Dunbar Contract Representative Contract Support
Valarie Lease Support Center Supervisor Contract Support
Stephen M. Croll Correspondence Support Contract Support

Independent Test Observers

Eugene G. Haberman Rocket Propulsion Lab USAF


Wilbur W. Wells Rocket Propulsion Lab USAF
Don E. Kennedy TRW Ballistic Missile Pro Bono
Office
Laddie E. Dufka Aerospace Corp Pro Bono
Mohan Aswani Aerospace Corp Pro Bono
Michael L. Marx Metallurgist NTSB

205
Appendix A

Commission Activities

An Overview cerns regarding low temperature effects on the


joint and seal. To investigate this disturbing
President Reagan, seeking to ensure a development, additional closed sessions were
thorough and unbiased investigation of the scheduled for February 13th and 14th at Ken-
Challenger accident, announced the formation of nedy. The February 13, 1986, session was an ex-
the Commission on February 3, 1986. The man- tensive presentation of film, video and telemetry
date given by the President, contained in data relating to the Challenger accident. It pro-
Executive Order 12546, required Commission vided the Commission the first evidence that the
members to: Solid Rocket Motor joint and seal may have
malfunctioned, initiating the accident.
(1) Review the circumstances surrounding the The session on February 14th included
accident to establish the probable cause or NASA and contractor participants involved in the
causes of the accident; and discussion on January 27, 1986, not to launch
(2) Develop recommendations for corrective 51-L. After testimony was received, an executive
or other action based upon the Commis- session of the Commission was convened. The
sion's findings and determinations. following statement was subsequently issued by
the Chairman on February 15, 1986, reflecting
Following their swearing in by Chairman the conclusion and view of the Commission:
Rogers on February 6th, Commission members
immediately began a series of hearings during
"In recent days, the Commission has been
which NASA officials outlined agency procedures
investigating all aspects of the decision
covering the Shuttle program and the status of
making process leading up to the launch of
NASA's investigation of the accident.
the Challenger and has found that the proc-
Shortly thereafter, on February 10th, Dr. Alton
ess may have been flawed. The President has
G. Keel, Jr., Associate Director of the Of-
been so advised.
fice of Management and Budget, was appointed
Executive Director. Dr. Keel began gathering a "Dr. William Graham, Acting Adminis-
staff of 15 experienced investigators from various trator of NASA, has been asked not to in-
government agencies and the military services, clude on the internal investigating teams at
and administrative personnel to support Commis- NASA, persons involved in that process.
sion activities. "The Commission will, of course, continue
During a closed session on February 10, 1986, its investigation and will make a full report
the Commission began to learn of the troubled to the President within 120 days."
history of the Solid Rocket Motor joint and seals.
Moreover, it discovered the first indication that The role of the Commissioners thus changed
the contractor, Morton Thiokol, initially recom- from that of overseers to that of active in-
mended against launch on January 27, 1986, the vestigators and analysts of data presented by
night before the launch of 51-L, because of con- NASA and its contractors.
206
The Commission itself divided into four in- was needed to establish the design, manufactur-
vestigative panels: ing and processing baseline configuration of the
Shuttle vehicle for STS 51-L. A data base was
1. Development and Production, responsi-
established for the examination and analysis of
ble for investigating the acquisition and
information related to all flight elements and
test and evaluation processes for the
segments. From these data and a compilation of
Space Shuttle elements;
possible and observed deviations from the norm,
2. Pre-Launch Activities, responsible for
scenarios that might have led to the accident were
assessing the Shuttle system processing,
developed. Tests and analyses were then per-
launch readiness process and pre-launch
formed to determine the specific scenarios most
security; likely to have caused loss of Challenger.
3. Mission Planning and Operations,
Early in March, at the request of the Chair-
responsible for investigating mission
man, this group assembled and directed the Com-
planning and operations, schedule
mission's independent team of technical observers
pressures and crew safety areas; and
with extensive experience in Solid Rocket Motor
4. Accident Analysis, charged with analyz-
technology and accident investigation to validate
ing the accident data and developing both
and interpret the tests and analyses performed on
an anomaly tree and accident scenarios.
the Thiokol motor by NASA and Thiokol.
By February 17th, the panel organization had The Development and Production Panel,
been finalized and, on February 18th, Chairman chaired by Joseph Sutter, centered its investiga-
Rogers described the Commission's new approach tion on the production and testing activities of
before Congress. Working groups were sent to the Shuttle element contractors. Starting at
Marshall, Kennedy and Thiokol to analyze data Johnson, the panel and staff investigators looked
relating to the accident and to redirect efforts. at how these contractors and their NASA counter-
NASA's investigation was also reorganized to parts interact.
reflect the structure of the Commission's panels. They next traveled to the Wasatch plant of
A series of public hearings were planned on Thiokol in Promontory, Utah. Thiokol person-
February 25th, 26th and 27th to assure an orderly nel briefed the group on the details of the design,
and fair presentation of all the facts that the Com- manufacturing, verification and certification of
mission had discovered concerning the launch the Solid Rocket Motors. Similar sessions took
decision making process for flight 51-L. At these place in April in Downey, California, at the head-
hearings, additional information about the launch quarters of Rocketdyne, Inc., the Shuttle main
decision was obtained from the testimony of engine contractor; in Canoga Park, California,
Thiokol, Rockwell and NASA officials. Details at the facilities of Rockwell International, the Or-
about the history of problems with the then biter contractor; in Michoud, Louisiana, at the
suspect Solid Rocket Motor joints and seals also plant of Martin Marietta, the External Tank con-
began emerging and served to focus the Commis- tractor; and in Berea, Kentucky, at the facilities
sion's attention on a need to document fully the of Parker Seal Company, the manufacturers of
extent of knowledge and awareness about the the O-ring seals of the Thiokol Solid Rocket
problems within both Thiokol and NASA. Motors.
Following these hearings, a substantial portion In addition, the panel traveled to Marshall to
of the investigative efforts of the Commission was learn about Marshall's interaction with Thiokol
conducted by the separate panels in parallel with and to discuss issues that had been raised during
full Commission hearings. the visits to the contractors' plants.
The Accident Analysis Panel, chaired by Ma- The Pre-Launch Activities Panel, chaired by
jor General Donald Kutyna, made several trips David Acheson, centered its investigation at Ken-
to both Kennedy and Marshall and traveled to nedy where the Shuttle elements are assembled
Thiokol facilities in Utah to review photographic and all other final launch preparations are com-
and telemetric evidence as well as the results of pleted. This panel, in conjunction with the Mis-
the salvage operation and to oversee the tests be- sion Planning and Operations Panel, chaired by
ing conducted by NASA and Thiokol engineers. Dr. Sally Ride, met with its NASA counterparts
The Accident Analysis Panel followed stand- in early March. This series of meetings identified
ard investigative procedures. An extensive effort for the Commission the various aspects of the pre-
207
launch process that required thorough review, not ty, reliability and quality assurance functions; and
only for the purpose of the Challenger accident the assembly of the right Solid Rocket Booster
investigation but also to increase safety margins for STS 51-L. Subsequent investigative efforts by
for the future. this group were directed in the area of the effec-
Later in March the Pre-Launch Panel again tiveness of NASA's organizational structure, par-
met at Kennedy to receive the NASA Team's ticularly the Shuttle program structure, and
preliminary reports and to focus on the spare allegations that there had been external pressure
parts issue and Solid Rocket Booster assembly on NASA to launch on January 28th.
operations. Panel members also met with contrac- More than 160 individuals were interviewed
tor personnel involved in Shuttle processing and and more than 35 formal panel investigative ses-
Kennedy security work. sions were held generating almost 12,000 pages
After the joint meeting at Kennedy with the of transcript (Table 1 and Table 2). Almost 6,300
Pre-Launch Activities Panel, the Mission Plan- documents, totaling more than 122,000 pages,
ning and Operations Panel traveled to Johnson and hundreds of photographs were examined and
to begin working with its NASA counterparts and made a part of the Commission's permanent data
to initiate its own investigative efforts. A specific base and archives. These sessions and all the data
focus of its work was the mission planning and gathered added to the 2,800 pages of hearing
crew preparation for STS 51-L and details of transcript generated by the Commission in both
NASA's safety, reliability and quality assurance closed and open sessions.
programs. Later meetings at both Johnson and In addition to the work of the Commission and
Marshall dealt with range safety, weather criteria the Commission staff, NASA personnel expended
for launch, flight delays and hardware testing. a vast effort in the investigation. More than 1,300
While the work of the individual panels and employees from all NASA facilities were involved
their investigative staffs was ongoing, a general and were supported by more than 1,600 people
investigative staff began a series of individual in- from other government agencies and over 3,100
terviews to document fully the factual background from NASA's contractor organizations. Par-
of various areas of the Commission's interest, in- ticularly significant were the activities of the
cluding the telecon between NASA and Thiokol military, the Coast Guard and the NTSB in
officials the night before the launch; the history the salvage and analysis of the Shuttle wreckage.
of joint design and O-ring problems; NASA safe-

Table 1
Commission Investigative Interviews
Interviews of January 27, 1986
Teleconference (8:15 PM EST)
Participants
Ben Powers John Schell William Macbeth Jerry E. Mason
Frank Adams Keith Coates Brian Russell Robert Lund
Larry Wear George Hardy Jack Kapp Joseph Kilminster
James Smith Jud Lovingood Ron Ebeling Roger Boisjoly
Boyd Brinton Jack Buchanan Calvin Wiggins Arnold Thompson
Robert Schwinghamer Allan McDonald Larry Sayer Jerry Peoples
William Reihl Carver Kennedy Joel Maw James Kingsbury
Wayne Littles Cecil Houston Kyle Speas
John Q. Miller Lawrence Mulloy Jerry Burn
John McCarty Stanley Reinartz Don Ketner

208
Interviews of Personnel
Involved in Stacking of
of Right SRB for Flight 51-L
Howard Fichtl Ed O'Neal Mike Sestile Jim Gardner
Jack Roberts Leslie Lake Granville Goad John Taris
Curtis J. Newsome Buddy Rogers David Mumpower Kenneth Koby
Mark Vigil Mario Duran Robin Nix Allen R, Hyde
Bob Heinbaugh Jim St. John Glenn Charron Jerry Wilkerson
Howard Christy Billy Massey Stewart Dalton Alex McCool
Jackie Walden Mike Sieglitz Sharron Whitaker Charles D. Newman
Alvie Hicks Jim Jordan

Interviews on Ice on Pad


Thomas Moser
John Peller

Interviews on Security
Marvin Jones
Herbert Weisner

Interviews on History of SRB


Joint Design and Problem
Leon Ray Robert Lindstrom James Kingsbury Ben Powers
Alex McCool James Brier Sam Lowry Michael Mann
Jerry Peoples Jesse Moore Stanley Reinartz Richard Kohrs
Glenn Eudy Joseph Kilminster Calvin Wiggins Maurice Parker
Ben Powers Arnold Thompson Mark Salita Keith Coates
John Miller Irving Davids Joe Pelham John Schell
Bill Rice Arnold Aldrich Phillip Dykstera James W. Thomas
Bill Horton Hans Mark Ed Dorsey Boyd Brinton
Jerry Cox Glynn Lunney Roger Boisjoly James Abrahamson
Bill Bush Walt C. Williams Brian Russel Jerry Mason
Paul Wetzel George Hardy Jack Kemp Jack Kapp
David Winterhalter Larry Mulloy Robert Lund Ronald Ebeling
William Hamby Fred Uptagrafft Howard Mclntosh Arnold Aldrich
Michael Weeks Richard Cook Glenn Eudy Hazel Saunders
Paul Herr Walter Dankhoff Robert Gaffin

Interview on Launch Coverage


Camera Failures
Charles Alsworth

Interviews on Outside Pressure


To Launch
Michael Weeks Phil Culbertson Jerry E. Mason Karen Ehlers
Jesse Moore George Hardy Arnold Aldrich George Johnson
Charles Kupperman Larry Mulloy Lawrence Wear James Beggs
Shirley Green Joseph Kilminster John Q, Miller William R. Graham
Vera Herschberg Stanley Reinartz James Smith Richard Cook
Richard Smith Robert Lund Norman Terrell Ben Powers

209
Interviews on Safety, Reliability and Quality Assurance
David Brown Jackie C. Walker Howard Gittens Wayne Frazier
Richard M. Henritze Benny Nunnelly Brian Russell Norman R. Schulze
James O. Batte George Butler Haggai Cohen Stanley Reinartz
Arthur M. Carr Henry P. Smith Harry Quong Milton Silveira
Wiley C. Bunn Wesley Hawkins Dallas N. Vickers
David Austin John Maxson

Interviews on Management Structure


Dick Kohrs James Smith Jerry Cox Richard A. Colonna
Jesse Moore Arnold Aldrich Jerry Griffin Walt C. Williams
Dr. Hans Mark John J. McCarty Stanley Reinartz George Bridwell
William Hamby Scott Simpkinson James Kingsbury George Johnson
Michael Weeks James Brier Thomas J. Lee Richard Cook
Lawrence Wear Jud A. Lovingood William F. Taylor Michael Mann
John Q, Miller Bill Bush
William Lucas

Interviews on Human Factors


Louis E. Toole Jenny Howard Ray Hallard Gregory Haywood Williams
James B. Hill Greg Oliver Ken McCrary Robert L. Brayant
Leonard J. Riche Robert Yackovetsky Joe Kenneth Patterson Keith Coates
Heather M. Mitchell Morton O'Hare

Interview on Wreckage Reconstruction


Terry Armentrout

Interview on Crew Activities


George Abbey

210
Table 2

Commission Panel Sessions


Date Location Subject

Accident Analysis Panel


March 3, 4, 5 Marshall Accident Data Review, Fault Tree Analysis
March 6, 7 Kennedy Film & Wreckage Review
March 11 Kennedy Coordination with NASA Task Force
March 12, 13 Marshall Accident Data Review, Fault Tree Analysis, Test
Requirements
March 19 Thiokol-Utah Test Coordination
March 26 Marshall Test Review
April 10, 11 Marshall Test Review
April 14, 15, 6, 17 Marshall Final Review

Design, Develop ment and Production Panel


March 5 Johnson Preliminary Briefing
March 17 Thiokol-Utah Fact-Finding Session
March 18 Thiokol-Utah Design-Production
April 2 Rocketdyne California Main Engines
April 3 Rocketdyne & Rockwell California Development Orbiter
April 4 Rockwell California Orbiter
April 7 Marshall Development and Production
April 8,9 Martin Marietta-Louisiana Development External Tank
April 11 Parker Seal Kentucky O-rings

Pre-Launch Activities Panel


March 4, 5, 6 Kennedy Training, Workload, Schedule, Spares, Pre-Launch
Investigation Update, Security
March 17, 18, 19 Kennedy Manpower, Spare Parts, Shuttle Processing, Security,
Hold-down Post Spring 51-L, Booster Flow,
Salvage Status, SRB Recovery, Launch Readiness
Process

Mission Planning and Operations Panel


March 4, 5 Kennedy Preliminary Briefing
March 11, 12 Johnson Crew Activity Planning, Training, Abort Modes,
Safety, Manifesting
March 20 Johnson Objectives Review
March 24, 25 Johnson Range Safety, Mission Operations, Landing Opera-
tions, Weather, Tile Damage, Main Engines,
Safety, Reliability and Quality Assurance
March 31, April 1 Johnson Payload Safety, Hardware Testing, Training, 51-L
Flight Design
April 7 Marshall Safety, Reliability and Quality Assurance
April 8, 9 Johnson Workload, Software, Manifesting, Landing
Considerations
April 14, 15 Johnson Ascent/Entry Envelope, Abort Option History,
Safety, Reliability and Quality Assurance

211
Executive Order 12546, dated February 3, 1986, which established
the Presidential Commission on the Space Shuttle Challenger Accident

EXECUTIVE ORDER

PRESIDENTIAL COMMISSION ON THE


SPACE SHUTTLE CHALLENGER ACCIDENT

By the authority vested in me as President by the

Constitution and statutes of the United States of America,

including the Federal Advisory Committee Act, as amended

(5 U.S.C. App. I), and in order to establish a commission of

distinguished Americans to investigate the accident to the

Space Shuttle Challenger, it is hereby ordered as follows:

Section 1. Establishment. (a) There is established

the Presidential Commission on the Space Shuttle Challenger

Accident. The Commission shall be composed of not more than

20 members appointed or designated by the President. The

members shall be drawn from among distinguished leaders of the

government, and the scientific, technical, and management

communities.

(b) The President shall designate a Chairman and a

Vice Chairman from among the members of the Commission.

Sec. 2. Functions. (a) The Commission shall investi-

gate the accident to the Space Shuttle Challenger, which

occurred on January 28, 1986.

(b) The Commission shall:

(1) Review the circumstances surrounding the accident

to establish the probable cause or causes of the accident; and

(2) Develop recommendations for corrective or

other action based upon the Commission's findings and

determinations.

(c) The Commission shall submit its final report to the

President and the Administrator of the National Aeronautics

and Space Administration within one hundred and twenty days of

the date of this Order.

212
Sec. 3. Administration. (a) The heads of Executive

departments and agencies shall, to the extent permitted by

law, provide the Commission with such information as it may

require for purposes of carrying out its functions.

(b) Members of the Commission shall serve without

compensation for their work on the Commission. However,

members appointed from among private citizens of the

United States may be allowed travel expenses, including

per diem in lieu of subsistence, to the extent permitted

by law for persons serving intermittently in the government

service (5 U.S.C. 5701-5707).

(c) To the extent permitted by law, and subject to the

availability of appropriations, the Administrator of the

National Aeronautics and Space Administration shall provide

the Commission with such administrative services, funds,

facilities, staff, and other support services as may be

necessary for the performance of its functions.

Sec. 4. General Provisions. (a) Notwithstanding the

provisions of any other Executive Order, the functions of

the President under the Federal Advisory Committee Act which

are applicable to the Commission, except that of reporting

annually to the Congress, shall be performed by the Adminis-

trator of the National Aeronautics and Space Administration,

in accordance with guidelines and procedures established by

the Administrator of General Services.

(b) The Commission shall terminate 60 days after


submitting its final report.

THE WHITE HOUSE,

February 3, 1986.

213
Appendix B

Commission
Documentation System

Overview The Commission was able to meet its commit-


ment to ensuring the integrity of this extensive
collection of information; all information pertain-
One of the Commission's initial concerns was ing to the investigation can be easily located and
to make certain that Commission members and its origin readily traced.
staff would have ready access to the tens of
thousands of pages of technical information, hear-
ing transcripts, witness interviews, and cor-
The Commission Information
respondence relating to the Challenger accident. Management System
Several aspects of the investigation made gather-
ing, controlling, and cataloging such information The Commission developed procedures to
a formidable task. One was the massive volume assure that it received all documents requested
of information collected. In addition, the fairly from NASA and other sources and that all
short response time required of the Commission documents and other correspondence were prop-
made it imperative that all information be im- erly processed.
mediately and completely accessible. Finally, the
Commission needed to make sure that it could Document Control
account for and retrieve every piece of informa- The Commission had control procedures and
tion that it collected and generated. systems to track all types of documents relevant
to the investigation. Specific procedures were
To address those issues, the Commission
used to process (1) Commission requests for in-
enlisted the support of the Justice Department's
formation from NASA, and NASA's responses;
Office of Litigation Support, Civil Division.
(2) NASA Task Force Reports; (3) other corre-
With existing capabilities, the Office of Litiga- spondence to and from the Commission; (4) other
tion Support mounted a rigorous cataloging ef- documents obtained by the Commission; and (5)
fort, developed and implemented a document reports and transcripts generated by the
control system, created the automated data bases, Commission.
and established a Commission documents Sup- The document control system ensured that all
port Center for document processing and research requests, documents, transcript and interview
activities. tapes, and other source materials were properly
The resulting system enabled the Commission accounted for, and became part of the Commis-
to manage the volume and assortment of infor- sion's permanent records and data base.
mation received and generated in the course of
the investigation, and provided Commission staff Documents Requested from NASA
with rapid access to needed information. The Most documents relevant to the investigation
system was designed to enable access to either came directly from NASA in response to Com-
hard copy or microfilm for future research after mission requests. The Commission requested
the Commission completed its work. documents from NASA in writing or verbally at

214
hearings. The Commission followed up verbal re- terview, or meeting so that they could correct any
quests with written requests. mistakes made in transcription.
To handle the flow of paper, the Commission Quick entry of the transcripts into the data base
assigned a staff member to be document coor- allowed timely search of transcript records on a
dinator. The document coordinator assigned word-by-word basis.
every written request a unique control number.
The number identified the date of the request and Processing of Documents and Tapes by
its order of occurrence on that date. the Support Center
NASA set up a complementary system. The As described in the previous section on docu-
NASA coordinator received and logged Commis- ment control, the Commission forwarded most
sion request letters, assigned unique NASA track- documents to the Support Center for microfilm-
ing numbers to each item or group of documents ing, coding, inclusion in the computer data base,
requested, and followed up to ensure that NASA and filing in the library. These documents includ-
staff responded promptly and fully. ed NASA reports and documents, selected cor-
When documents were received from NASA respondence, and other documents received by
corresponding to each numbered request, one the Commission.
copy of each was sent to the Support Center for
microfilming, analysis (coding), and inclusion in Assignment of Control Numbers
the computer data base. When the Support Center received a docu-
ment. Center staff immediately applied a unique
Correspondence
preliminary control (PC) number to each page
Each individual piece of nonpersonal mail
of the document. This number was a sequential
arriving at the Commission was assigned a cor-
number to indicate where the original copy of the
respondence control number. Technical staff
document would be located in the library files.
evaluated correspondence for investigative value.
On a microcomputer-based system, staff captured
Microfilming
critical information about each correspondence
After control identifiers were assigned. Center
item, including correspondence control number,
staff microfilmed the document and placed the
date of receipt, addressee, author, type of cor-
original hard copy in the library. The Center
respondence, and response date and type.
made daily deliveries of completed microfilm reels
Other Documents to the microfilm processing facility, which pro-
The Commission also received many duced two copies of each reel.
documents other than those requested from The Support Center maintained one copy in
NASA. These included relevant materials that the microfilm library, and used it to respond to
Commission members themselves had gathered information requests from Commission members
or generated, those from NASA and from the and staff.
various NASA contractors as a result of Com- The second copy was used to produce hard
mission investigative activities, and incoming cor- copies of the documents for coding purposes.
respondence that staff decided would be of use
to the investigation. These documents were also
entered into the Commission's data base, and Coding and Data Entry of Microfilmed
relevant correspondence was also entered into the Documents
microcomputer tracking system. The purpose of coding was to develop a com-
prehensive computerized index of all microfilmed
Transcripts and Commission-Generated documents. Using hard copies produced from
Documents microfilm, each document was reviewed and
The Commission used a court reporting firm bibliographic, control, and subject matter infor-
to transcribe hearings, interviews, and meetings. mation was recorded on a coding form designed
The firm created magnetic computer tapes with specifically for the Commission investigation.
the full text of the transcripts and delivered the The bibliographic information included items
tapes to be loaded into the computer data base. such as document title and date, and names and
The firm also provided hard copies of the organizations of people mentioned in the
transcripts to all participants of the hearing, in- documents. The control information included the

215
preliminary control number, microfilm number Libraries
and other information useful in identifying and
locating documents. Documents and Microfilm
To capture information on subject matter, As noted above, the Support Center main-
coders read each document and noted what sub- tained libraries of Commission documents.
jects were mentioned. The coders used a list of One contained the microfilmed versions of the
"subject terms" developed specifically for Com- more than 122,000 pages of materials indexed on
mission purposes. Each subject term had a unique the document data base. The microfilm was filed
six-character identifier. Every document was by reel number and cross-referenced to the
assigned at least one such subject code. Docu- preliminary control number assigned to the
ments that covered many subjects were assigned original hard copy of each document. Micro-
multiple codes. filmed documents could be quickly located
Data entry operators keyed the index informa- through the computer search capability and hard
tion from the completed coding forms onto copies printed, if desired.
magnetic tape to be loaded into the computer data
The second library contained hard copies of
base.
transcripts and other Commission generated
From the date a document was received, it was
documents (those documents stored in the full-
microfilmed, filed in the hard copy and microfilm
text data base), plus the originals of the micro-
libraries, coded, and entered on the computer
filmed documents, which could be located by
data base within one week. Throughout the proc-
using the preliminary control number.
ess, there were numerous quality checks to en-
sure the readability of the microfilm, the accuracy
of the document coding, and the overall integri- Other Materials
ty of the data base. The Commission also maintained a library of
video tapes of presentations, hearings, photo-
Creation and Data Entry of Index Informa- graphic and film records relating to the accident
tion from Transcripts and Commission itself, and the salvage operations. These tapes
Generated Documents were filed chronologically by date received and
For the Commission generated documents and labeled according to subject. Use of these
the transcripts, index information was captured materials was controlled through a library check-
and entered into the computer. This information out system.
included date of the hearing or report; names of Audio tapes of interviews were labeled and
all attendees. Commission members or witnesses; maintained at the Support Center. These were
and other cross-reference data. filed chronologically by interview date and con-
The index information was added to the full- trolled through a library check-out system.
text versions on the magnetic computer tapes, and
loaded into the computer data base.
Use of the Data Bases
Creation of the Computer Data Base
Through the processes described above, the The Support Center provided personnel to per-
Commission created two computer data bases. form searches of both the document data base
The first called the document data base, named (INQUIRE) and the full-text data base (JURIS).
INQUIRE contained the index (bibliographic, Access to INQUIRE and JURIS was gained
control, and subject matter information) of all from terminals at the Support Center and the
microfilmed documents, representing more than Commission offices.
100,000 pages. Detailed information on the use of these
The second called the full-text data base, systems is available in the following OLS
named JURIS contained the full text of (1) documentation: "INQUIRE Users Manual,"
transcripts of all Commission hearings, inter- "JURIS Users Manual," and "Challenger Data
views, and panel meetings; and (2) Commission Bases Sample Searches for JURIS and
reports, hearing digests, and affidavits. INQUIRE."

216
The Document Data Base Accessible piled to assist historians and others in using and
Through INQUIRE gaining access to this large and very important
The INQUIRE system allowed rapid retrieval collection.
and review of the index information that con- These materials were provided to the National
stituted the document data base. Archives in accordance with the procedures
Users who wanted to locate documents on a described in FPMR 101-11.4, "General Records
particular subject (such as O-ring erosion) could Schedules," published by the National Archives
search the document data base using the and Records Administration, and specifically
bibliographic information or subject codes cap- Schedule 24 which focuses on "Temporary Com-
tured for each document. INQUIRE provided missions, Committees, and Boards Records."
a listing of all documents matching the criteria
specified in the search. The user could then decide
which of the listed documents would be useful
Materials Provided
The following materials were turned over to
and, using the document number provided, ob-
the Archives at the conclusion of the investigation:
tain a copy of the document from the library.
The Commission's Report, including all
The user could ask INQUIRE to list a variety
appendices;
of information on selected documents, including
the preliminary control number (used to locate All materials requested and received by
the Commission from NASA and its con-
the material in the library), date, title, and docu-
tractors, including the NASA Task Force
ment type. INQUIRE could also print all the
reports;
subject terms associated with each selected docu-
All documents provided to the Commis-
ment (not just the subject term(s) that matched
sion and its staff at hearings, meetings,
the search criteria), and all the names mentioned
presentations, and interviews;
in the text. Users could also choose the order in
The entire microfilm collection contain-
which INQUIRE listed the documents (e.g.,
ing those materials (both in open-reel and
chronologically by document date, alphabetical-
cartridge format), as well as a file-level
ly by author name, or numerically by document
index to each reel;
number).
All transcripts of hearings, panel meetings
The Full-Text Data Base Accessible and interviews;
Through JURIS Summaries of all hearing transcripts and
significant interview transcripts;
The Department of Justice developed JURIS
Indices to the INQUIRE (document)
specifically for retrieval of full-text information,
data base, listing all of the documents by
and designed it for easy use by nontechnical per-
document number, date, and subject
sonnel. Users could ask JURIS to locate all
term;
documents containing specific words or phrases.
All correspondence and respective
Users could specify multiple words or phrases,
responses, as well as indices to the entire
and could include index information as one of the
correspondence collection sorted by
search criteria. Users could request that JURIS
author, correspondence type, and date of
print a list of documents that were selected, or
receipt;
print the full text of the documents.
Computer tapes containing the entire IN-
QUIRE data base prepared for and used
Final Disposition of Commission by the Commission in the course of its
investigation;
Report and Investigation-Related Complete set of the request letters sent by
Materials the Commission to NASA, the resulting
Action Item forms, and the responsive
The entire collection of documents and memoranda that closed out each of those
microfilm is permanently housed in the National Action Items;
Archives. In addition, several different indices All press releases produced by the
and other supporting documentation were com- Commission;

217
All video and audio tapes received by the Public Access
Commission, including indices to those To gain access to the Commission's
two collections; and documents, requests can be made to:
All planning and instructional materials Office of the National Archives
related to the creation and use of the IN- National Archives and Records
QUIRE and JURIS data bases. Administration
Washington, DC 20408

218
Appendix C

Observations Concerning the


Processing and Assembly of
Flight 51-L

The following examples of Operational allowable limit. The decay rate was
Maintenance Requirements and Specifications recorded as 0.98 pounds per square inch
Document violations were noted during the Com- per minute; however, a recalculation of the
mission's inquiry:' data revealed that the decay rate was ac-
tually 1.4 pounds per square inch per
1. The Operational Maintenance Re-
minute. The calculated allowable decay
quirements and Specifications Document
rate was 1.35 pounds per square inch per
indicated that the External Tank liquid
minute maximum.
hydrogen and liquid oxygen ullage
pressure control and redundancy verifica- 6. The leak check steps for test port Number
tion using simulated transducers was a re- 4, after installation of the plug, were in-
quirement for this processing. However, advertently omitted from the Operations
the entire sequence was marked "not per- & Maintenance Instructions.