Comments and opinions in this article are the sole responsibility of Bennett Blumenberg and do not reflect the views of any organization, government or private, that is mentioned in this research. The author does not have any relationship, public or private, with the organizations referenced in this article.
Author and research - Bennett Blumenberg.
Editorial and Proof Reading Services - Bruce Blake of Advanced Hybrid Aircraft.
Where necessary, digital images have been edited to improve contrast, color palette and resolution so as to maximize the 'reading' of visual data. With the great variety of monitors now available, do not forget to try out different screen settings if fonts appear 'too small' for reading comfort. This web page was coded for 1280 x 800 which is a wide screen (landscape) format. Printout will be 34 pages in 11 x 8.5 inch format.
This article is one module of a research project into the realities behind the disaster of Air France, Flight 447. It is offered as a model for a dysfunctional relationship between management and engineers in the world of cutting edge aircraft and space shuttle design. The corporate world would never release the results of such investigations. The United States government deserves sincere praise that their investigations into Space Shuttle missions that had disastrous endings has been placed in the public record. Air France Flight 447 crashed into the Atlantic Ocean while on a flight from Rio de Janeiro to Paris, May 31 - June 1, 2009. As this manuscript is also self contained, it is released ahead of the Flight 447 research as Tribute to the United States Space Shuttle Program: publication date, August 3, 2011; editorial revisions, August 8, 2011. First ETA for the Flight 447 publications is ~October 1, 2011. Please bookmark this page and occasionally check back.
July, 2011 witnessed the last flight of the Shuttle Space Program of the United States. Orbiter Atlantis flawlessly completed the 13 day STS-135 mission to resupply the International Space Station. The budget crisis in the United States is the stated reason for the cancellation of funding for all future manned space flight missions. The American Space Shuttle Program suffered two tragedies with the loss of all space shuttle components and crew members in both instances. This web page recounts these two tragedies and is dedicated to the men and women of NASA from astronauts to office cleaning crews and secretaries who have served this program with courage and dedication. They exemplify the best of America, and we hope their successors may return to space before many years elapse. The scientific and engineering knowledge obtained from the research conducted on the Space Shuttle Missions is priceless and has expanded our insight immeasurably. The world will reap the benefits for decades to come.
“The creed of manned spaceflight is you never fly with a known problem. Never. Get that word never. So . . . when the main ring is burned and the back-up ring is scorched in a joint and you don’t stop the goddamn thing right there and fix it, regardless of whether it be a band-aid fix or any other kind of fix, you have made a cardinal sin. You many times fly with unknown unknowns, but you do not fly with known unknowns.” - Chris Kraft, former director of JSC, 1991.
“. . there’s something drastically wrong when something that you think isn’t supposed to get any damage at all sustains that kind of damage, and you conclude it’s okay.” Mulloy, NASA Marshall Space Flight Center
"In a lot of material we have received, one reads that the designers, presumably both the corporate designers and the NASA supervisors, believe the joint was designed to compress and seal in the gas tight under combustion pressure. And it turns out very quickly in the joint history that it did the opposite. It opened up. I just don't understand why the program then decided to go into a lot of little fixes to see if you could compensate for the fundamental error" - David Acheson, one of members of the Presidential Commission that investigated the Space Shuttle Challenger Tragedy...
The solid rocket motor used in the shuttle was divided into several segments, each joint required a seal to prevent leakage of the high-temperature, high pressure combustion gases. Thiokol favored the Titan III C rocket which was considered state-of-the-art and very reliable. In the Challenger tragedy, disintegration of the entire vehicle began after an O-ring seal in the right solid rocket booster (SRB) failed at liftoff. This O-ring failure caused a break in the solid rocket booster joint that it sealed. This event allowed pressurized hot gas from within the solid rocket motor to reach the outside and impact the adjacent SRB attachment hardware and external fuel tank. At this point the right side SRB's aft attachment separated and the external fuel tank underwent a complete structural failure.
“The subsequent investigation revealed that NASA's managerial style and decision making procedures contained severe deficits. NASA managers had known about serious flaws in O-ring design since 1977 but they were never properly addressed. Critical information continued to be ignored or shunted aside through the hours of launch preparation when engineer warnings about launching in 31ºF (-1ºC) temperature of morning hours on January 28, 1986 were ignored. “The seals of all of the SRB joints were required to contain the hot high-pressure gases produced by the burning solid propellant inside, forcing it out the nozzle at the aft end of each rocket. Thiokol engineers argued that if the O-rings were colder than 53 °F (12 °C), they did not have enough data to determine whether the joint would seal properly”. O-rings were Critical 1 components of the space shuttle which means it is forbidden to rely on a backup. Nonetheless, NASA's reply to Thiokol's concerns was that if the primary O-ring failed, the secondary O-ring would still seal. As dawn rose on January 28, ice had accumulated over the launch pad. Exerting extreme pressure to maintain the NASA manifest (schedule) for this shuttle mission, NASA managers pressured Thiokol management and a launched was approved at 11:38 AM as ice began to melt.
Tragically, the primary O-ring had become so hard due to the cold that it could not seal in time, and the secondary O-ring was not in a proper seated position due to metal bending. There was now no barrier to the released gases and both O-rings had vaporized across 70º arc. Aluminum Oxides from the burned solid propellant had sealed the damaged joint but that barrier could not hold against the flame. These events occurred before Challenger cleared the launch tower.
Challenger_cross section of the joints between rocket segments SRB. Legend: A - steel wall thickness 12.7 mm, B - base O-ring gasket, C - backup O-ring gasket,
D - Strengthening-Cover band, E - insulation, F - insulation, G - carpeting, H - sealing paste, I - fixed propellant Original diagram - Kapitel / Wikipedia
At T+37 seconds into the flight, and for the next 27 seconds, Challenger experienced the strongest wind shear events yet seen at launch in the space shuttle program. These shattered the temporary Aluminum Oxide seal and removed the last barrier to the flame from the burning fuel that was rushing through the joint. The plume near the aft attach strut on the right side SRB was visible at T+58.788 seconds. The plume became defined and intense and at T+60.238 seconds the right side of the SRB had begun to detach from the shuttle. There was visual evidence of the flame erupting through the joint and impacting the external fuel tank. At T+64.660, visual evidence was apparent that a leak had begun in the external hydrogen tank and pressure began to drop within two seconds. Neither the astronauts nor NASA flight controllers were yet aware of the developing disaster.
Challenger launch / flame from burning fuel is visible "Advance for Use, Jan.28, 2011" - NASA Image Archve
At T+72.284, the right SRB pulled away from the strut attaching it to the external tank, and Challenger underwent a severe lateral acceleration to the right. The crew was now aware of an abnormal situation. AT T+73.124, the breakup of Challenger began. The liquid hydrogen tank failed and was pushed into the liquid oxygen tank. The right SRB rotated and struck the the intertank structure. The vehicle began to come apart at T+73.162 at 48,000' as the external tank disintegrated. Abnormal aerodynamic forces with load factors ~400% of designed limits, quickly tore apart the space craft.
There was no fireball as was first thought. The visible cloud was composed of vapor and gases released from the liquid oxygen and liquid hydrogen propellant creating a fireball (deflagration). The robustly constructed crew cabin and SRBs survived the breakup of the launch vehicle at 48,000' and the SRBs were detonated by mission control. The detached crew cabin was observed to exit the cloud of gases at T+75.237. Flying along a ballistic trajectory it reached a peak altitude of 65,000'. The crew cabin was in one piece and entered free fall with forces unlikely sufficient to cause a major injury. Some of the astronauts were alive and conscious at this stage because: a) 3 of 4 Personal Egress Packs had been activated and the remaining unused air supply was consistent with the expected consumption during a 2:45 post breakup trajectory. Pilot Mike Smith had been able to move electrical system switches, perhaps in an attempt to restore electrical power to the cabin. How long the crew could have maintained consciousness depended upon cabin air pressure integrity. The cabin hit the ocean surface at 207 mph with a deacceleration impact of 200G which is far beyond survivability.
For many of us the Challenger and Columbia tragedies are more than listings in a space history textbook. Within the shuttle program, American courage and passion at its finest was articulated to explore, and understand the unknown (and yes, execute some military missions along the way). This space program was distilled into a disciplined, committed federal program which ensured that planning, and mission execution would happen at the highest level of government and scientific priority. Whenever thinking and writing about the Challenger and Columbia disasters there is a tearful feeling inside that always appears and is slow to dissipate. In both space program disasters, the investigations were forced to question the professionalism of government and industry management when important decisions interfaced with management and engineer culture, politics, media and public perceptions. The wide applicability of this material needs to be understood. The Presidential Commission that investigated the Challenger disaster has made their materials available to the public with a depth of disclosure that is not common for government agencies, and never occurs in the corporate business space. The next few pages are material from an exceptional book: NASA publication “Power to Explore: History of MSFC, Chapter IX, The Challenger Accident, pp 339 – 387.
What is revealed are the human factors: pride, jealousy, ego, competition, how chickens advance in the hen coup pecking order, intimidation by authority.
The material in this section of the article is taken from Chapter Nine in POWER TO EXPLORE: HISTORY OF Marshall Space Flight Center - complete reference is listed in the Reference Section below. A lingering concern at Marshall Space Center and Thiokol led to new studies and near confirmation that “joint rotation could prevent the secondary O-ring from sealing. Marshall reclassified the joint from criticality 1R to criticality 1 which means No Redundancy. “Failure could result in “loss of mission vehicle and crew due to metal erosion, burn-through, and probable case burst resulting in fire and deflagration.” Nonetheless, this report then appeared to argue against itself. Almost all the engineers at Marshall and Thiokol believed the joint was safe and redundant 'most of the time'. There were 8 static firings and 5 flights where the O-ring along provided a secure, safe seal; and the joint was similar to that in the Titan III which had only one O ring. Furthermore, sometimes the secondary O-ring would seal and therefore in operations, the joint had redundancy. This latter point should have been set aside as mute. The new criticality designation was meant to emphasize the awful consequences of the joint failing, and the need for utilization of the highest available standards when manufacturing and testing this component. Internal documents were now using both criticality designations for the primary O-ring. Thiokol refused to change the designation at their end and some NASA managers went on the record as agreeing with Thiokol's assessment. Engineers were acting as if the joint had redundant seals as a matter of deliberate design. Management personnel, both in and outside of NASA, were confused as their testimony before the presidential investigation revealed.
Nonetheless because of the need to increase payloads for military shuttle missions, work was underway on a long term change with a new lightweight plastic SRB case. NASA's design was a filament-wound case with graphite fiber-epoxy matrix composite casewalls and steel joints. The joints would incorporate a 'capture feature', a steel lip on the tang that would fit over the inner flange of the clevis and eliminate joint rotation. Hercules Inc. submitted a design for this capture feature, and NASA chose them in May 1982 to develop the filament-wound case as a subcontractor to Morton-Thiokol. Many engineers, especially at Morton-Thiokol seemed not to understand joint rotation but work continued and the first full scale, static firing of the new design occurred in October, 1984. In seven static firings, there were O-ring problems on four joints.
In 1983, Fuller O'Brien Company stopped making the asbestos filled putty and NASA's new supplier was Randolph Products Company. Randolph's putty was was more difficult to pack during assembly and less able to provide thermal protection during launch. The leak test involved injecting high pressure nitrogen into the cavity between the primary and the back-up O-ringss, a procedure somewhat like inflating a tire. Only the Randolph putty would withstand this low pressure and hide a faulty O-ring. Pressure was raised to 100 psi on STS-9, November, 1983 but the Randolph putty continued to hamper tests and produced leak check failures. After a failed check, there was an expensive procedure in which the solid rocket motors were destacked and the joint re-assembled. To minimize having to use this protocol, and yet also to continue to verify the O-rings, engineers decided to raise the leak check pressure to 200 psi for case to case joints on STS 41-B on January 1984, and to 200 psi for all joints on STS 16-D (Flight #16) in April, 1985. However, this higher pressure blew gaps in the putty. These voids were usually ~1” wide and directed jets of combustion gas to sections of the primary O-ring. The erosion produced was confirmed during dissambly of the recovered motors. What to do? The high pressure verification tests were very important, yet they created dangerous gaps in the putty which – theoretically – would jeopardize all O-rings. At 200 psi, more than 50% of the missions had blow-by or erosion on field case (steel) joints. (It seesm that data on possible damage of the graphite fiber-epoxy matrix, composite casewalls is absent.) At the nozzle joints at 200 psi, problems were evident on 88% of the flights. Inexplicably, engineers did not then fully analyze this pattern, nor perform basic statistical test the would correlate leak pressure and joint anomalies.
Worries increased. In February 1984 (10th mission), the primary O-rings eroded in two case to case joints and one case to nozzle joint. In one instance, the erosion was 20% of the diameter. Engineers in the NASA SRB Office were critical of Thiokol planning and the testing of environmental conditions. They emphasized that finding a solution was urgent because the putty was a thermal barrier that prevented burning O-rings subsequent to a catastrophic failure. Nonetheless, the Marshall Flight Center Review Board for the next mission STS-13 (41-C) decided to fly noting that at 3000 psi, O-rings can maintain joint sealing with a simulated erosion of 0.095 inch when the maximum possible erosion on STS-13 is 0.090 inch. There is a terrible aspect of Orwellian double think in this decision. Marshall Space Flight Center had redefined the performance criteria to one that defined an acceptable amount of erosion, where previously within the rating of criticality 1, no erosion was acceptable. No one recommended that flights be halted until O-ring erosion could be eliminated. The context for a tragedy waiting to happen had been officially signed off and set in place.
In March 1984, Marshall and Thiokol presented their argument for accepting O-ring erosion to a Level 1 Flight Readiness Review at Marshall. Hans Mark, NASA Deputy Administrator and General James Abrahamson, Associate Administrator for Space Flight attended the review and both signed off on the Marshall and Thiokol argument. Mark did issue an Action Item for May that required Marshall to perform a formal review of the Solid Rocket Motor case to case, and case to nozzle joint sealing procedures. In May 1984, Thiokol issued a preliminary notice for improvements but until August 1985, NASA allowed Thiokol to proceed without a plan to eliminate O-ring corrosion. The engineering consensus remained that the joints were safe because flights with O-ring anomalies were successful. Ground tests at Thiokol used a subscale model of an SRB joint which fired a 5” solid rocket in 3 second bursts into a chamber housing a section of an O-ring. Different putty and O-ring materials did demonstrated O-ring corrosion. The realism of the tests was debated. Voids in the putty were judged the reason for erosion faults. (In tests without putty, there was no O-ring damage.) Combustion gas would not melt an O-ring enough to produce a leak.
By the fall of 1984, priority had shifted to finding an alternative putty. SRB manager Mulloy stated that “maximum erosion possible” was “less than erosion allowable.” Unbelievably, the following variables were barely considered: a) use of subscale model; b) reliance upon a test bed environment to make critical decisions about the real world flight environment; and c) a real world environment in which temperatures below the threshold for 'cold' would occur.
Mission 51-C in January 1985 was the shuttle program's coldest launch at that date. Two primary O-rings in case to case field joints had erosion. Primary rings in two field and both nozzle joints had soot blow-by. Heretofore unseen blow by erosion, resulted from combustion gases burning an unsealed O-ring and flowing beyond it. For the first time, a secondary O-ring acquired heat damage. At Marshall, Mulloy sent Thiokol a certified urgent request an for an erosion briefing. At the meeting of the SRB Board on February 8, 1985, Thiokol engineers discussed in detail the new types of O-ring damage and for the very first time also talked about the effects of temperature on O-ring resiliency. For the joint to seal, the O-ring had to travel rapidly across its groove and both rings had to flatten quickly to fill the opening gap. Thiokol believed that low temperature made the putty stiffer and less tacky, and the O-ring smaller in diameter and harder, thus was the sealing process slowed and the probability of erosion enhanced. The Orwellian universe surfaced once again when the extreme Mission 51-C weather was dismissed as so rare as to be unlikely to re-occur (ie - “if I don't want it to happen, it shall not happen”). The damage to the secondary O-ring was not discussed as a problem that revealed flaws in the primary O-ring, but was re-defined to prove that the joint had a redundant seal (think positive, there is always something 'good' to report.). At the Marshall Center Shuttle Projects Office Board, all motor problems requiring action before the next launch were listed as 'closed'; and their Final Report did not mention any SRB failures or abnormalities. At Marshall headquarters Level 1 Board, temperature issues were ignored and thermal distress beyond the O-ring was 'acceptable risk because of limited exposure and redundancy.” No one had performed basic statistical tests to assess the correlation between temperature and/or leak check pressure and O-ring performance. Relying upon the data at hand, the decision to fly was understandable.
Nonetheless, the gods continued to provide signals that all was 'not right'. Each of the four flights after 51-C had O-ring problems. During the April 51-B mission, the left nozzle joint primary O-ring had not sealed, had severe erosion; and the secondary O-ring had also eroded. These findings should have been very troubling. The primary O-ring had always sealed; and the secondary O-ring had never before experienced erosion.
The Level 1 flight readiness reviews had now become ritualistic. As the shuttle had proven flight worthy and had been designated operational, what serious questions remained? Granted Marshall engineers had imposed a formal launch constraint for all subsequent missions including 51-L, BUT SRB Project Manager Mulloy filed formal waivers that lifted the constraint for each of six flights through 51-L. Marshall apparently did not report constraint and waivers to Level II Shuttle Managers in Houston as required. Only one copy of its monthly Open Problems Report was sent to a Level II flight control engineer (and a summary only to Rockwell, the Shuttle integration contractor.) Particularly insidious was the computer model created at Thiokol to evaluate O-ring erosion. Using only data from previous missions and tests, none of which had a catastrophic failure, it predicted that chances were “improbable” that hot gases would burn through a sealed primary O-ring or that hot gases blowing past a primary would melt through the secondary O-ring.” An added insult came from the engineers who worked on the solid rocket motor and concluded that the mission 51-B problems were due to to a faulty leak check procedure that reported ~ 100 psi and thereby masked a faulty O-ring. “The Thiokol report also took solace from how the primary O-ring erosion had been “within historical levels” and the damage on the secondary
had been “within the demonstrated sealing capability of eroded O-rings.” The company concluded that “this anomaly is not considered a launch constraint.”
In spite of the apparent scenario of endlessly 'dropping the ball' and then doing the three monkey ritual, the Marshall Space Flight Center decided to find a permanent solution to these O-ring problems. By the end of August, 1985 the Marshall task force had proposed 63 possible joint modifications that included 43 changes for the field joints. In July, Marshall ordered 72 steel case segments with the capture feature from the Ladish Company. Thiokol, meanwhile, continued to verify the existing design. They reported that at 75º F, the O-ring lost contact for 2.4 seconds. At 50ºF, joint rotation made it more likely that the secondary O-ring would fail late in the ignition phase. Nonetheless, Thiokol told Marshall that it had no reason to believe that the primary O-ring seal would ever fail.”
In a briefing that took place at NASA headquarters on August 18, 1985, Marshall and Thiokol finally made a formal responses to the April 1984 Action. (“Nero fiddled while Rome burned.”) “The experts observed that only 5 of 111 primary O-rings in field joints and 12 of 47 primary O-rings in nozzle joints eroded. O-ring erosion resulted from blow-holes in the putty, increased frequency of voids, and heat damage resulted from defective putty, higher leak check pressure, and greater engine pressure. Nonetheless, Thiokol argued that data from static firings, Shuttle flights, subscale tests, and the O RING computer model verified the safety of the design. Erosion could be no worse than 51–B; even “worst-on-worst case predicted erosion” was “within [the] demonstrated sealing capacity of [an] eroded O-ring. . . The review rated the field joint as the “highest concern” and described the criticality change from 1R to 1. Erosion could damage the primary seal and joint rotation could cause the secondary O-ring to fail. The experts believed that “the primary O-ring in the field joint should not erode through but if it leaks due to erosion or lack of sealing, then the secondary seal may not seal the motor.”
The motor engineers and managers also presented plans for improving the joints. Marshall and Thiokol planned to introduce short-term changes for the field joint; they would qualify an alternate putty source, use thicker shims to ensure O-ring compression, and replace the 0.280-inch-thick O-rings with thicker 0.292-inch rings that would provide an extra safety margin, add insulation strips in the joint to prevent hot gas circulation, and insert a third O-ring. NASA would introduce long-term changes in 27 months, including the capture feature already proven on the filament wound case; this would reduce joint rotation and ensure redundancy. The review concluded that leak checks and careful assembly made it “safe to continue flying [the] existing design.” Nevertheless NASA’s reconfiguration and redesign efforts needed “to continue at an accelerated pace to eliminate SRM seal erosion.” After the Challenger accident some aspects of this Level 1 review were criticized for lack of clarity and failure to emphasize cold temperatures as the single most important factor that affected O-ring resiliency, but the Presidential Commission did conclude that the O-ring erosion history as presented was sufficient to require corrective actions prior to the next flight.
Thiokol did not respond in kind and the task force had only 5 full time engineers out of 2500 working at Thiokol. Their in-house O-ring expert Boisjoly was crystal clear about the dangers inherent in the present situation where “joint rotation could yield a “catastrophe of the highest order—loss of human life.” He protested that the problem required “immediate action” but that support was “essentially nonexistent at this time.” . . “On 1 October, 1985 Robert Ebeling, manager of the group, signaled “HELP! The seal task force is constantly being delayed by every possible means” and “this is a red flag.” Engineers were complaining about excessive paperwork requirements as yet another cause of slowdown. He thought “MSFC is correct in stating that we do not know how to run a development program.” A proposed referee test was accepted by Thiokol but never implemented. The Marshall Space Flight center was aware of this situation and in the fall of 1985 offered to help the O-ring Task Force obtain more authority and resources but nothing came of their efforts.
The bottom line may have been Thiokol's incentive-award fee contract where MSC did not offer Thiokol any incentives to spend money to fix problems likely to cause mission failure. Further into the incredible is that such an incentive would have to be part of a legal contract or else human life was set aside as a near trivial concern! In contrast, the contract incentive fee for timely delivery and cost savings could total as much as 14% of the total contract value. The reward for a fine safety record had to be topped-out at 1% of the total contract value. The only penalty provision was a fine to be applied after a mission failure. Why was it necessary to have a sociologist highlight these very important aspects of the contract which resulted in: a) disincentives to Thiokol to fix problems that would cause flight delay; and b) provided Marshall with almost no means to sanction Thiokol's pace and quality of work. Insidious details about the contract disincentives came to light. Preparatory work for upcoming missions always had priority over redesign and test of hardware. In order to get extra money to speed up the work of the O-ring task force, Thiokol would have to submit a request that acknowledged the failure of their own design.
In the fall of 1985 Marshall stated to the Presidential Commission that no one at Thiokol had communicated serious concerns to them about safety or bureaucratic obstacles. No official at Marshall saw the memos that were drafted by the O-ring task force that expressed alarm about delays. Stanley Reinartz, manager of the Shuttle Project Office testified that he believed that after August 1985 Thiokol's position was that everything was “fine and safe” for launching while the O-ring issues were worked on in parallel. Testimony was given that when briefed on the O-rings, Marshall personnel seemed at times to not pay attention, pay little attention to what was said and did not heed the warnings that were emphasized. Moreover, shuttle flights continued while the static flights of Qualification Motor 5 were delayed for several months. These firings would test the filament wound case with its capture feature, a matter assumed to be of extreme priority that was now not scheduled until February 13, 1986. Thiokol continued to verify that the case joints were not hazardous in spite of two cases of O-ring nozzle erosion (Mission 51-I), nozzle ring erosion with blow back past primary O-ring (Mission 61-A), primary O-ring erosion on both nozzle joints with blow back(Mission 61-B), and nozzle joint erosion, blow-by and field joint erosion on Mission 61-C. At the Level 1 review that certified Challenger for flight, Mulloy's presentation listed Mission 61-C issues yet concluded there were no major problems or O-ring issues. Mulloy later admitted that “since the risk of O-ring erosion was accepted and indeed expected, it was no longer considered an anomaly to be resolved before the next flight.” (!! Word fail here .. this is a classic example of Orwellian double think. 'There is a problem as expected, therefore there is no problem of any urgency.'
On December 12, 1985 Kingsbury the Marshall Director of Science and Engineering requested that Thiokol reduce its open items including O-ring items. Monthly reports about the O-rings were discontinued. On January 23, 1986 a Marshall report stated that “Mulloy later admitted that “since the risk of O-ring erosion was accepted and indeed expected, it was no longer considered an anomaly to be resolved before the next flight because Thiokol had filed a plan to improve the seals.” Later, Marshall Space Flight Center told the Presidential Commission that the closure was in error and they had not approved it.
Coincident with this confusing closure of reporting, NASA went looking for a second source of rocket motors because Thiokol's competitors wanted a piece of the NASA action, and Congress wanted to ensure a steady supply of rocket motors for the Shuttle's forthcoming military missions. Bidding rules were yet another barrier against finding effective and 'safe' upgraded motor joints. The government would Not provide qualification funds for new rocket designs to Thiokol competitors. Each firm would have to invest ~$100 million in facilities, test equipment and prototypes without any guarantee of a contract. However, competition was encouraged because NASA could publish Thiokol's blue prints and then request lower bids from the competition, an approach that was overlooked in the Presidential Commission inquiry. Meanwhile, Thiokol's task force continued to work and slog ahead. “Neither Thiokol nor the Marshall Level III project managers,” concluded the presidential commission, “believed that the O-ring blow-by and erosion risk was critical” and both thought that “there was ample margin to fly with O-ring erosion.”
Because the overall evaluation was positive, “Marshall, the presidential commission observed, minimized problems in flight readiness reviews and failed to report the launch constraint and waivers, the controversy about temperature and O-ring resiliency, and the O-ring anomalies of later flights. This silence, however, evolved from confidence that the joint was not hazardous rather than from some conspiracy to cover up problems.” This viewpoint – that defective engineering was the bottom line behind a slowly growing monster of ineptitude, was believed most strongly by one of the most prominent members of the Presidential Commission, Professor Richard P. Feymann, a physicist and winner of a Nobel Prize. Feyman noted that the standards of the O-ring project showed “gradually decreasing strictness.” In a terrible aspect of confusion, the standard by which to judge the O-rings had now become the success of the previous flight, rather than the bench lab tests, their analysis and computer models. “Thus a successful flight with erosion was proof of the reliability of the O-rings and justification for another launch, rather than a warning of a potential catastrophe and a sign to stop and fix the problem. . . . Project engineers failed their managers, neglecting to perform even elementary statistical analysis of the relationships between O-ring anomalies and such factors as temperature and leak check pressure.”
Evening Teleconference and the Terrible Decision to Launch Back to Top
On the evening of January 27, 1986 before the scheduled launch of Mission 51-L the next morning, Marshall contractor project managers and engineers held an impromptu telephone conference. Temperatures were record setting cold and the Thiokol engineers argued that that would aggravate the O-ring problem. Thiokol and Marshall Space Center managers rejected the recommendation not to launch. Earlier in the day of January 27, extremely high cross winds forced NASA to postpone the launch of Mission 51-L for the fourth time. An overnight low of 18ºF was predicted for the evening of January 27, 1986. Responding to a request from Marshall, Thiokol engineers decided that the predicted evening temperatures were far below any with which the team had experience, and they arranged the telecon with Marshall. Bad phone lines delayed the conference until 8:45 PM after Thiokol had faxed hand written charts to Marshall. Marshall officials did not know that at the other end of the line in Utah were the Senior VP for Wasatch operations and VP and GM for Wasatch space operations. As usual for a Level III Review, no officials from Houston or NASA headquarters were present.
Thiokol engineers wanted to show that the extreme cold could prevent the O-rings from sealing. “They observed that cold temperature would thicken the grease surrounding rings, and stiffen and harden the O-rings; these factors would slow the movement of the primary O-ring across its groove and reduce the probability of a reliable seal. Sealing with a cold O-ring, the contractor reasoned, “would be likened to trying to shove a brick into a crack versus a sponge.” If hot gases blew past the primary O-ring after the joint had opened, the probability of the secondary O-ring sealing would decrease. The engineers also presented a history of erosion in field case joints. They pointed out that the previous coldest launch, 51–C in January 1985, had occurred at 53ºF, and that the predicted launch-time temperature of 29ºF was far outside Shuttle experience. Moreover 51–C had eroded O-rings and its blow-by deposits of charred grease and O-ring rubber had been jet black, which was an ominous sign that the primary O-ring had nearly failed.
However, the entire story was not clear. There were four static tests at cold temperatures that did not show any blow-by. There was one such test that did have blow-by at 75º . Thiokol engineers concluded that air temperature at launch time should be at least 53ºF . Marshall's response was not calm. Mulloy noted that NASA had no launch commit criteria for the joint’s temperature and that the eve of a launch was a bad time to invent a new one. He asked, “My God, Thiokol, when do you want me to launch, next April?” Marshall's managers genuinely doubted that the predicted cold would increase the risk factors over that of previous flights. Marshall believed in two parameters: a) that motor pressure was so great and increased so rapidly that combustion would almost instantly force even a cold primary O-ring into place;" and b) that under the worst case conditions, the secondary joint would seal the O-ring. When pressed for quantitative analysis, Thiokol O-ring expert Boisjoly did not have statistical tests.”
Nonetheless, a simple two variable plot of temperature and O-ring damage would have dramatically shown: a) that of 24 flights before the 51-L mission, twenty (20) missions had temperatures of 66º F or above and only three (3) of these had problems with field joint O-rings; but b) all four flights with temperatures below 63º F had problems with field joint O-rings, 3.6 standard deviations below the average launch temperature of 68.4 F. (Why were such basic graphs not generated by hand at this time, a procedure that would take less than one half hour if personnel were working slowly?) The launch of Mission 51-L within the predicted cold environment for January 28, 1986 was far outside the experience of previous Shuttle missions and very risky but the inadequate data analysis presentation by Thiokol could not carry much weight in the last and final launch conference. The 'world' of aeronautical and space program engineering has long ago cut away decision making processes that were not backed up by quantitative data analysis.
Furthermore, it seemed that basic interpretative protocols had been forgotten. “During the teleconference Thiokol and Marshall were distracted by comparison of dissimilar data. They equally weighted static tests and Shuttle flights although each had different forms of putty packing. They pooled erosion data for the two case-to-case and case-to-nozzle joints, thereby confusing different causal systems, since case joints were sensitive to temperature, but not to leak check pressure, and nozzle joints were sensitive to leak check pressure but not to temperature. Without distinguishing between fundamental sources of O-ring damage, Thiokol’s rationale seemed insubstantial. Ultimately the teleconference focused on only two data points, 51–C and 61–A, and the contradictory evidence caused debate to dwindle after more than an hour.”
The Thiokol caucus in Utah went off line to caucus. A planned five minute discussion lasted 30 minutes. Two engineers from the O-ring task force repeated their warnings, then realized that managers were not listening and they went silent. The four Thiokol VPs realized that they could not prove that the launch of Mission 51-L was more dangerous than previous launches. The teleconference resumed at 11 PM, reported back that the data were inconclusive and therefore Thiokol recommended that the launch proceed. “The rationale was the same as previous launches: despite the problems of joint rotation and cold temperature, the primary O-ring could withstand three times the erosion of 51–C and the secondary O-ring provided redundancy. Level III manager Reinartz asked for dissenting comments, and, hearing none, ended the teleconference.” Later it came out that at least two Marshall engineers opposed the cold weather launch on January 28, 1986 but reports to their superiors were never acted upon. Engineers at Marshall were reluctant to bypass the chain of command.
In testimony given to the Presidential Commission, Thiokol officials complained that the usual roles of contractor and the Marshall Space Flight Center had been reversed. In this situation with Mission 51-L, the contractor Thiokol had to prove that his hardware was not ready to fly, that beyond any doubt it was not safe to launch. Thiokol could not do so with quantitative rigor. Thiokol told the Presidential Commission that managers changed their recommendation because “we had to prove to them that we weren’t ready, and so we got ourselves in the thought process that we were trying to find some way to prove to them it wouldn’t work, and we were unable to do that. We couldn’t prove absolutely that that motor wouldn’t work. . . But the commission’s final report stated that “Thiokol management reversed its position and recommended the launch of 51–L, at the urging of Marshall and contrary to the views of its engineers in order to accommodate a major customer.”
In later testimony to Senate subcommittee, Mulloy summarized thus: “We at NASA,” he said, “got into a group-think about this problem. We saw it, we recognized it, we tested it, and we concluded it was an acceptable risk. . . . When we started down that road we were on the road to an accident.” Indeed the teleconference was a classic case of “group think,” a form of decision making in which group cohesion overrides serious examination of alternatives.”
Nonetheless, the talk dribbled on. At 11:30 PM as the evening of January 26 was ending, Shuttle Rocket Booster Project Manager Mulloy and Shuttle Projects Manager Reinartz at Marshall called Level II Manager Arnold Aldrich at the JSC. They only discussed ice on the launch pad, booster recovery ships and agreed the launch should proceed. They Did Not mention the teleconference of earlier in the evening nor discussed O-rings!. At 5 AM on the morning of January 28, 1986, Reinartz met with Lucas and Kingsbury (Chief of Marshall's Science and Engineering) and informed them of Thiokol's concerns, the firms' initial recommendations to delay the launch and the final decision to, nonetheless, launch. These phone calls were severely criticized by the Presidential Commission.
See Evil but Report No Evil continued. Between 7 and 9 AM on the morning of January 28, 1986, the crew at Cape Canaveral recorded the temperature at the icicle draped Launch Pad 39B as 8º F!! but did not report this finding because that action was outside their directives. At 9AM, the NASA Management Team which included Level I, II and III Managers, discussed the ice but did not discuss the O-rings and concluded that conditions were safe to launch. At Huntsville Alabama, Powers told a colleague that he believed that Challenger astronauts did not have more than a 50-50 chance of surviving the launch and that he was very worried. The aft field joint on the right side motor would fail in less than 60 seconds after launch and destroy the Challenger."
OR ...
A second and different viewpoint is provided by the retrospective in Allan McDonald’s book “Truth, Lies and O-Rings”.Cold temperature is singled out as the major culprit in the Challenger explosion. However, McDonald also repeatedly states that the joint design was flawed and this was the primary problem. How could that be accurate when Parker Hannifin, one of the world’s leading authorities on O-Ring design, states in his handbook ORD 5700 paragraph 4.0 that “It has been said that O-rings are ‘the finest static seals ever developed.’ Perhaps the prime reason for this is because they are almost human proof …. If the gland has been designed and machined properly”. In the World of If, something fundamental always goes wrong because 'If' is the devil that plays by its own rules. A fundamental engineering design flaw had been ignored by the engineering departments of Morton Thiokol and NASA’s Marshall Space Flight Center. This flaw was ignored for years, in spite of numerous warnings both from the SRM’s and engineers who flagged the problem.
Although the theme of Allan McDonald’s book “Truth, Lies and O-Rings” is that cold temperature was the major culprit in the Challenger explosion, the dramatic revelations in the book are McDonald's repeated admissions that the primary joint design was fatally flawed and this was the primary problem. When pressurized, the joint opens up and the O-ring gland becomes grossly improperly configured. Cold O-rings may well aggravate this condition but a lot of things aggravate an incorrect O-ring gland configuration.
Page 31 – “The Filament Wound Case field-joints included a metal-capture lip on the tang side of the joint that significantly reduced the rotation, or opening, of the joint during pressurization at ignition. It was a unique arrangement that was part of the Hercules design for the FWC.” The Filament Wound Case itself was a composite cylinder that reduced SRM weight. These were part of a first task force recommendation in September 1985 to solve the O-ring dilemma, an excellent suggestion that was made much too late to be implemented.
Page 61 – “However, if the rapid deflection of the joint during pressurization prevented O-ring contact with the metal, then all bets were off. …. Furthermore, any significant amount of erosion directly on the sealing surface would probably result in a continuously leaking joint that would eventually lead to a catastrophe.”
Page 69 – “In September 1985, the task force submitted its first recommendation to NASA Marshall for solving the O-ring seal problem: to incorporate the capture-feature in the field-joint.”
Page 217 – “The original analysis of the joint, which had been conducted back in the mid-1970’s, indicated that seal redundancy was maintained, because the joint closed during pressurization. It wasn’t until after considerable hardware had been fabricated and tested that it was realized that the joint didn’t close during pressurization; it actually opened.”
Pages 288 & 289 – “Thiokol’s senior management … calling a meeting in late February 1986 …Jack Kapp’s speech was effective, because Jack was the first one to be promoted in the new organization, chosen to be Director of Engineering Design for the redesign effort – even though some twelve years earlier he had been most responsible for the poor SRB field-joint design in the first place…..it had been his analysis that said the joint should close during pressurization, when in reality the joint opened. That mistake was known by MTI and NASA management and should have been corrected long before any Shuttle was ever flown.”
Page 290 – “Even though the design had been developed in the mid-1970’s with the best analytical tools available in the industry at the time, the fact remained that Thiokol’s original analysis indicated the joint would close during pressurization when, in fact, early hydro-tests indicated that it really opened. This was the most fatal flaw in the SRB design….” that guaranteed that sooner or later a fatal catastrophe at shuttle launch would occur.
“The loss of the Challenger Crew and the destruction of the Challenger Space Shuttle were the result of almost a decade of collective denial, cognitive dissonance, ignored warnings and a fundamental breakdown of engineering ethics.”
FWC is an acronym for Filament Wound Case. FWC were composite cylinders which reduced SRM weight. Hercules Aerospace was developing the FWC SRM design for NASA Marshall Space Flight Center and their use would have significantly improved Space Shuttle performance.
The lesson here for Airbus and all manufacturers of aircraft and space vehicles is huge. We hope that this defective management process has been seriously studied at Airbus these past two years with a deep resolve that it will never be present in corporate assembly plants. When the BEA and Airbus Final Reports are released, we shall know what level of management self assessment was undertaken.
COLUMBIA COMPOSITE INSULATION PANEL HITS WING Back to Top
The Columbia space shuttle orbiter blew up upon re-entry in 2003 as it desperately tried to escape a fuel tank explosion. Insulation broke off the external fuel tank and impacted the carbon-carbon composite, wing edge panel. Upon re-entry, superheated air entered the wing and a fuel tank explosion followed. The world was shocked when NASA disclosed that the shuttle had no astronaut escape system for situations such as this because the likelihood of an accident of this type had been judged to be near zero. This was an unforgivable deficit when it was learned that several crew members were still alive when the orbiter impacted the ocean surface.
Columbia Minute by Minute Timeline Chart - CSA Mechanical and EngineeringAbstacts.
Original CNN url is unavailable and is not archived by the Wayback Machine (Internet Archive).
The weather was near perfect on February 1, 2003 as the Columbia shuttle began re-entry after an important and successful 16 day research mission. Braking rockets were fired at 8:15 AM local time and everything appeared fine until 8:53AM when ground control noticed that they were no longer receiving hydraulic and temperature data from Columbia. It was decided this was a trivial, unimportant problem and the Columbia crew was not alerted. At 8:56 AM, Sensors showed a rise in temperature and pressure on the shuttle's left side landing gear.
At 8:58 AM, data was lost from three temperature sensors on Columbia's left wing. At 8:59 AM, mission control data stream ceases from all left side temperature sensors and flight control notifies the Columbia crew. At 9:00 AM, flight control loses all data from Columbia which is now traveling at Mach 18 at 207,135' altitude. At 9:16 AM, President Bush and Tom Ridge, Director of Homeland Security are notified. At 11 AM. Columbia and all crew are officially designated as lost and the flag at the Kennedy Space Center is lowered to half mast. From Mission Control's point of view, the Columbia crew had a seven minute time frame within which to react to the rapid developing crisis.
Not well known is that composites were used in additional important components in addition to one of the four materials (RCC) in the Thermal Protection System. In order to increase military payload capacity, NASA had decided to “develop a filament-wound [FWC] case with graphite fiber-epoxy matrix composite casewalls and steel joints. The joints would incorporate a “capture feature”, a steel lip on the tang that would fit over the inner flange of the clevis and eliminate joint rotation.” Hercules Inc proposed the design for the capture feature and they were chosen in May, 1982 over Morton-Thiokol. As indicated above, the FWC was formerly proposed in 1985 at a date that was much too late to be incorporated into the Challenger O-ring redesign.
On January 17, 2003, NASA engineers reviewing the video of Columbia's launch noticed that a 20” piece of hardened composite insulation foam had broken off the main fuel tank and impacted the shuttle's left wing. Poor angle and a blurry image did not allow for damage estimates. NASA management refused an engineer request for outside assistance, although they did consult with Boeing management and concluded there was no safety concern.
Columbia external fuel tank and wing / model Photo - CAIB US
Critically important during reentry, the shuttle's Thermal Protection System surface can reach 3,000F. It uses four different materials in varying amounts, one of which is a carbon-carbon composite: a high temperature reusable surface insulation (HRSI); b) low temperature reusable surface insulation (LRSI); c) felt reusable surface insulation (FRSI) and d) reinforced, carbon-carbon composite (RCC). The black HRSI tiles cover areas where temperatures reach 1200 tp 2300 F. The white LRSI tiles cover lower temperature areas where surface temperatures will be between 700 and 1200 F. The felt surface insulation (FRSI) and reinforced carbon-carbon materials (RCC) are used in small amounts.
Columbia external fuel tank pod / model Photo - CAIB US
During the January 16, 2003 launch of Columbia, the foam from the bipod of the external fuel tank detached and struck the left wing. The reinforced carbon-carbon structures on the wing's leading edge were damaged, as well as some HRSI tiles. These damages allowed plasma to penetrate the wing, and disintegrate the underlying aluminum which severely damaged the wing's basic structure. “The foam of the bipod ramp is BX-250, polyurethane foam applied with CFC-11 chlorofluorocarbon. It is applied by hand to cover outside of the tank fittings to prevent ice and frost from forming on the surface. The foam also helps protect from engine and aerodynamic heating. The foam is made of light material to reduce the weight. The wing of the shuttle is covered with a tough carbon panel. It was hard to imagine how such a light material could damage the wing of the shuttle,” so severely that hot plasma could penetrate the wing structure. Yet that is apparently what did happen. Enough pieces of the leading edge of Columbia's left wing were found to confirm that the leading edge was heavily eroded from extreme heat. This extreme heat erosion was not found on other wing parts.
Prior to this incident, NASA had paid no attention to impact behavior of heat shield materials even though engineers knew that such damage was unavoidable. Four shuttle launches prior to Columbia had foam pieces falling from the bipod area. Challenger in 1983, Columbia in 1990 and 1992 and Atlantis in 2002. On the list of inexcusables that emerged from this tragedy was the absence of a protocol to do a variety of shuttle repairs while in space. EVAs for a variety of engineering and research objectives had long been integrated into mission objectives so there is no justification for the omission of EVAs to repair shuttle damage and thereby increase the safety factors of the mission. NASA mission control had rejected the suggestion to check Columbia's wing in space when it was confirmed that foam had detached at launch because there was no procedure in place for repair the wing if that was deemed necessary. Would it have been impossible to create a repair scenario 'on the spot', rather than trust the landing completely to the gods, particularly since Columbia was the first shuttle built and had been flying since 1981? Ironically, the original retirement date for Columbia would have been set for sometime in 2006, but then was extended to 2015.
Although the vulnerability of heat shield materials to impact was known, ceramic tiles and carbon-carbon edges had never been tested for impact response! Damage to heat shield materials had occurred on every space shuttle flight but had been defined as a 'maintenance – turn around' issue. (There was some rudimentary, incomplete testing in 1999 when the composition of the foam was changed.) Surrealistic as this may sound, there was no proper testing protocol available to NASA at this time. After the accident, NASA shot a block of foam at a carbon-carbon panel and to the shock of everyone present, a 16” square hole was produced! As of 2009, a proper testing protocol had still not been developed. Composite aircraft are far more vulnerable to impact than those built of metal alloys but there is no proper protocol to investigate this on a large scale.
Tests were run at the Southwest Research Institute where foam fired from an air gun at ~500 mph punched a hole in the reinforced carbon material. In other tests with different firing speeds, the foam also caused visible cracks on the tested RCC panels that were so severe that they could lead to shuttle breakup during re-entry. Once again, it was demonstrated that there is no substitute for detailed testing that duplicates the real environment as closely as possible. “Hard to imagine “ . . . does not cut it!
Atlantis Liftoff, STS-27, December 2, 1988 / Third Military Classified DOD Mission Photo - NASA Image eXchange (NIX)
. 
.. 
_debris.currents_61x54.jpg)
. . .
640x512_ NASA.jpg)
