2 . OPERATIONS

2 . OPERATIONS

¶a. Shuttle Processing Issues (including Spare Parts)

¶Issue

¶In 1983, NASA consolidated fifteen separate contracts and awarded a single Shuttle Processing Contract (SPC) encompassing all ground processing related to launch and landing of the Space Shuttle. There are two issues associated with this contract: (1)How sound is the concept of a unified SPC; and (2) How well has the SPC contractor actually performed? A related issue is the quality of essential logistical support, especially spare parts, provided to the contractor by NASA.

¶Findings

1. Performance under the SPC has improved since the inception of the contract. However, up to the time of the Challenger accident, contractor performance continued to be plagued by excessive overtime, persistent failures to follow prescribed work procedures, and inadequate logistical support from NASA.

2. High overtime rates have hampered SPC performance. Overtime rates had increased significantly during the six months prior ~

¶T 2 Discussion with NASA officials, Washington, D.C., August 13, 1986.

115

¶to the Challenger launch, to the point that critical personnel were working weeks of consecutive workdays and multiple strings of 11- and 12-hour days. Fatigue resulting from work patterns of this sort can constitute a threat to safety. In fact, worker fatigue was a contributing factor in a mission-threatening incident on Flight 61-C, the mission immediately prior to the January 28 Challenger launch.

3. There are numerous documented cases when contractor employees failed to comply with guidelines for carrying out assigned duties, including specific "Operations and Maintenance Instructions" (OMI's). Such failures contributed to both of the major mishaps in 1985 involving Shuttle processing-namely, the November 8, 1985, "handling ring" episode which led to significant damage to a Solid Rocket Motor segment slated for use on STS51-L, and the March 8, 1985, "payload bay access platform" episode which led to significant damage to a payload bay door. Failure to follow an OM1 also led to improper (and mission-threatening) handling of the hydrogen disconnect valve during the 51-L launch operations. All of these incidents show a lack of discipline, both with respect to following prescribed procedures and with respect to reporting violations of these procedures.

4. At the time of the Challenger accident, the lack of spare parts caused a degree of cannibalization (i.e., the removal of a part from one Orbiter to satisfy a need for a spare part on another Orbiter), which was the highest in the history of the Shuttle program and which was a threat to flight schedule and flight safety. Excessive cannibalization leads to multiple installations, retesting, added documentation, delayed access to parts, and increased damage potential. As a result, cannibalization contributes directly to excessive overtime.

5. There is no clear evidence whether or not greater involvement of the development contractors would improve Shuttle operations.

¶Recommendations

1. Because of the serious quality and safety concerns surrounding the contract, NASA should conduct a careful review of Shuttle processing, the SPC contract, and the relationship of flight hardware contractors and report its findings, recommendations, and proposed contract modifications to the Committee. NASA's reexam- ination should include a comparison of efficiency and safety under the SPC versus efficiency and safety during pre-1983 Shuttle processing operations, which heavily involved the development contractors.

2. NASA should examine the issues of spares availability and cannibalization and provide the Congress with a management and budgetary plan for correcting previous logistical problems.

3. NASA should stop routine cannibalization and develop guidelines (including appropriate control and review procedures and roles €or the SWQA office) governing permissible cannibalization.

4. The Committee recommends that NASA provide its re-invig- orated safety office with the authority to enforce scheduling that leads to safe overtime rates.

116

¶Discussion

¶In a press release dated September 5, 1986, NASA announced that it has extended the SPC with Lockheed for three additional years, beginning October 1, 1986. Admiral Truly also announced his intent to conduct a thorough review of the SPC, a process which might lead to contract amendments.

¶Lockheed's award fees at the Kennedy Space Center have not been at the highest possible levels due to mishaps and management problems. The contractor has received the following award fees for Shuttle processing at KSC:

Percent of Period From : ! ; :A Rating adjective Rating maximum Award fee mre award lee earned earned

¶First ............................................... Oct. 1, 1983 ............ $6,618,880 Excellent ............... 90.0 80 $5,295,104 Second........................................... Apr. 1, 1984 ............ 1,299,404 Good ..................... 78.5 32 415,809 Third .............................................. Oct. 1, 1984 ............ 1,308,554 (;ood ..................... 76.0 24 314,053 Fourth............................................ Apr. 1, 1985 ............ 1,308,554 Excellent ............... 91.0 84 1,099,185 Fifth............................................... Oct. 1, 1985 ............ 1,308,554 Very good ............. 89.0 76 994,501 Sixth .............................................. Apr.1,1986 ............ 1,296,664 ( 1 ) ....................... (I) (l) (')¹¹ For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. To be determined.

¶The rating scale runs from unacceptable to marginal, good, very good, excellent and superior. Two of the five ratings to date have been at the lower end of the scale.

¶At the time of the Challenger accident, Shuttle processing had suffered from inadequate spare parts for well over a year, and the problem was getting worse. The inventory of spare parts had run close to projections until the second quarter of fiscal year 1985. At that time, inventory requirements for spares began to increase faster than deliveries. A year later, the inventory should have been complete, but only 65 percent had been d e l i ~ e r e d . ' ~

¶The number of cannibalized parts was increasing at an alarming rate. Forty-five out of almost 300 required parts were cannibalized for Challenger before Mission 51-L.74 Eighty-five parts were cannibalized on 61-C, the mission preceding 51-L.75 In fact, the number of cannibalized parts on each of these 1986 missions far exceeded the number of cannibalized parts on any previous mission. In 14 missions flown in 1984-1985, the average number of cannibalized parts was 14; in the 1986 mission, the number had increased nearly five-fold to 65.

¶The cause of the spare parts crisis was budgetary decisionmaking by NASA management. In October, 1985, the logistics funding requirements for the Orbiter program, as determined by Level I11 management a t Johnson, were $285.3 million, but that funding was reduced by $83.3 million, necessitating major deferral of purchases of ~ p a r e s . ~By

6 the spring of 1986, the Shuttle logistics program 73 Rogers Commission Report, Volume 11, p. 1-16. 71 bid. 75 Cmte Hgs Transcript, July 16, 1986, p. 42. Rogers mmiasion Report, V o l u m e I, p. 173.

117

¶was about one year behind; and under the proposed flight schedule, no Orbiters would have been available as spare parts bins.

¶NASA is well aware of the spare parts problem. In fact, during the Committee's hearings, Admiral Truly testified:

I can assure you that during our downtime we're going to take a hard look at it and make sure that the flight rates that we build up to after this accident are support- able by the logistics system that we have in place.77

¶The Committee received mixed reactions on whether development contractors need to be more involved in the SPC. Proponents of this approach argue that the current separation of responsibilities between the design organizations and the processing organization has created additional interfaces which make coordination, communication, and responsiveness more complex. Further, the processing contractor may not possess the necessary technical background to recognize either system degradation resulting from multiple missions or the criticality of the hardware being tested and proces~ed.'~ The Rogers Commission report stated that the likelihood of improper Shuttle processing would probably be decreased if Rockwell, as overall development contractor, and Martin Marietta, who has a consulting role on the pre-launch processing of the External Tank, were subcontractors to Lockheed, as the other Shuttle development contractors are.T9

¶At Committee hearings, contractors reacted predictably to proposed changes in the SPC. Development contractors, such as Rockwell and Martin Marietta, told the Committee that their organizations should be vested with beginning-to-end responsibility-design, development, manufacturing, operation, and refurbishment of their respective Shuttle element.so Lockheed, on the other hand, argued that there is already a very close relationship between itself and the development contractors. For example, there is one development engineer for every four Lockheed engineers. Development contractors participate in all meetings and are required to authorize and approve anything that is anomalous to the regular documented procedure.8

¶Ultimately, SPC performance will determine the proper balance of development contractors in the processing contract. NASA, in close consultation with the Congress, will need to make an impar- tial and ongoing assessment of comparative safety and performance under a consolidated versus unconsolidated SPC. Preliminary figures from NASA seem to indicate that Shuttle processing incidents have actually declined during the more recent consolidated-contract phase.82 Further, it is likely that the fundamental problem to date with the SPC-overtime-would be exacerbated by the additional contractor coordination that would be required by greater inclusion of development contractors.

¶77 Cmte Hgs, Transcript, July 11, 1986, p. 39.

¶78 Rogers Commission Report, Volume 11, p. K-32.

¶'9 Rogers Commission Report, Volume I, p. 195.

Cmte Hgs, Transc+pt, July 15, 1986, p. 62. Cmte Hgs,Transcript, July 16, 1986, pp. 13-14.⁸⁸ Ibid. Ibid. ' 0 bid. I 1bid. Morton Thiokol, "Program Plan, Protection of Space Shuttle SRM Primary Seals," TWR- 14359,May 4, 1984. 2 NASA, documents on the SPC contract, supplied to the Committee in July, 1986; Cmte Hgs, Transcript, July 16,1986, p. 67, and Attachment C. The responsibility for high overtime rates in the SPC must be shared by both NASA and the contractor. Mr. E.D.Sargent, President of Lockheed Space Operations Company, testified:

118

One of the problems that bothers us and drives us to overtime is either unplanned work or another form of unplanned work which is a hold or abort on the pad where we have critical skills that are required to perform functions.

¶There is no doubt that late mission changes initiated by NASA are in large part responsible for Lockheed exceeding the five percent overtime target in the SPC contract.

¶But in fact overtime levels had grown from an initial SPC rate of 5.3 percent in April, 1984, to 13.9 percent in January, 1986-levels far in excess of what could be attributed solely to late mission changes. The peak monthly overtime level of 15.2 percent occurred in November, 1985. Although NASA managers a t Kennedy attribute the November rate to the Thanksgiving holiday, the overall trend in overtime is undeniable-for each of the six months prior to the launch of STS 51-L, overtime exceeded 10 percente8*

¶More important that the average overtime rates was the overtime for certain employees with critical skills. Records show that there was a frequent pattern at Kennedy of combining weeks of consecutive workdays with multiple strings of 11- or 12-hour days. For example, one Lockheed mechanical technician team leader worked 60, 96.5, 94, and 80.8 hours per week in succession during the four weeks ending January 31, 1986.85While shiftwork is commonplace in many industrial settings, few can equal a Shuttle launch's potential for inducing pressure to work beyond reasonable overtime limits.

¶Research has shown that when overtime becomes excessive, worker efficiency decreases and the potential for human error rises. Noteworthy in this regard is Lockheed's review of 264 incidents that caused property damage in 1984 and 1985. More than 50 percent of these incidents were attributable to human error, including procedural deviations, miscommunications and safety violations.86 On one occasion a potentially catastrophic error occurred just minutes before a scrubbed launch of Shuttle flight 61-C on January 6, 1986, when 18,000 pounds of liquid oxygen were inadvertently drained from the Shuttle's External Tank. The investigation which followed cited operator fatigue as one of the major factors contributing to this incident. The operators had been on duty at the console for eleven hours during the third day of working 12-hour night shifts. If the launch had not been held 31 seconds before lift off, the mission might not have achieved orbit.87

¶The adequacy of and adherence to Operations and Maintenance Instructions (OMI's) have been raised as areas of concern leading to quality and safety problems. Review of various SPC mishap reports and of the procedures leading to the launch of 51-L and earlier

119

¶Shuttle flights highlight both the need for review and update of inadequate OMI's and the need for improved contractor performance in implementing adequate O M I ' S . ~ ~

¶NASA's own review of flight 51-L showed several examples of improperly implemented procedures. The most serious error occurred when a console operator improperly closed the liquid hydrogen disconnect valve to the External Tank liquid hydrogen manifold. Although the valve appeared to function during 51-L, improper valve operation could have doomed 51-L just as surely as the failed rocket booster. As important as the failure to follow the OM1 was the fact that the valve closure problem was never documented. Without proper documentation a full assessment of the problem was not made prior to launch of 51-L.89 This lack of documentation is reminiscent of what occurred during "de-stacking" of Solid Rocket Motor segments from STS-9. Although destacking revealed water in the joints, this incident was never documented-an oversight which ultimately may have prevented an appreciation of the dangers of ice formation in booster joints during a cold-weather launch.s0 b. Pressures on Shuttle Operations

¶Issue

¶Was NASA under pressure to fly more flights? How did this pressure originate? Will it recur?

¶Findings

1. The Congress and the Executive Branch jointly developed the policy that the Space Shuttle should, in a reliable fashion and at an internationally competitive cost, provide for most of the Free World's space launch needs. By and large, both Branches failed to appreciate the impact that this policy was having on the operational safety of the system.

2. NASA was under internal and external pressure to build its Shuttle flight rate to 24 per year, primarily to reduce costs per flight, but also to demonstrate and achieve routine access to space. NASA has never achieved its planned flight rate.

¶Recommendations

1. NASA must not attempt to achieve a flight rate beyond that which (i) can be supported by the budget and staff resources available; and (ii) is consistent with the technical maturity of the Shuttle and the flexibility desired and needed in scheduling payloads. Management should ensure efficient use of resources but should not impose a flight rate on the system.

2. Once operation of the Space Shuttle resumes, the Committee should maintain a close and continuous oversight of Shuttle flight rate, planning, and operations. The Committee should ensure both that flight rate flows logically from the resources provided and that flight safety is not compromised beyond acceptable limits.

¶Kennedy Space Center Mishap Reports, No. 85-0070, April 5, 1985, and No. 86-0024, Dec. 13, 1985.

120

¶Discwwion

¶Flight Rate. The goal of the Shuttle program has been to become the Nation's primary space transportation system launching virtually all US. payloads and many foreign payloads, all at a reasonable price. Thus, there has been an explicit promise to deliver launch services.

¶Being a very complicated vehicle, the Shuttle demands a large trained workforce which must be retained between launches. In addition, there are the costs of maintaining large and complex launch facilities. Therefore, there is a large fixed cost in the Shuttle program of approximately $1.2 billion per year. By comparison the ad- ditive or marginal cost for a single fight is around $60 million (depending on how the accounting is done). Therefore, it is clear that (within limits) the cost-per-flight can be reduced by flying more flights, that is, by spreading the large fixed cost over more flights. However, it is also clear that the total cost-that is, the total amount of money that has to be appropriated-will increase as the number of flights increases because fixed costs are fixed and marginal costs must be added for each additional flight.

¶Therefore, to focus on cost-per-flight can be misleading. A lower cost-per-flight, achieved by flying more often, would allow a lower price to be charged to users, but does not lower the cost of the program. Because NASA had committed to lower the price to customers of Shuttle flights, there was a pressure to do this by increasing the flight rate. Nevertheless, NASA never achieved its planned flight rate.

¶For example, in 1976 NASA predicted 49 flights in fiscal 1984 and 58 in 1985..As late as August 15, 1983, 45 days before the start of fiscal year 1984, NASA planned 9 flights for fiscal 1984 and 12 for 1985. NASA actually flew four Shuttle flights in fiscal 1984 and 8 in 1985.91Of course management worked hard to reduce this gap between plans and performance.

¶The emphasis on reducing costs per flight and delivering launch services has caused a very basic and pervasive pressure to increase the flight rate in the Shuttle program. This is well documented in Chapter VIII of the Rogers Conimission report.92

¶Presumably, the Challenger accident has changed this situation. Recommendation VIII of the Rogers Commission states in part that "NASA must establish a flight rate that is consistent with its resource^."^ NASA's response to this recommendation hints that this may not be the case. NASA speaks of determining "the maximum achievable safe flight rate."g4 Such a flight rate would again leave no "margin in the system to accommodate unforeseen hardware problems" as the Commission found was the case before the accident.95 The NASA response makes it clear that the flight rate ~~~~~

¶9 1 Hearings before the House Committee on Science and Technology, FY 1978 NASA Authori- +ion, %p,Fmber 14, 1976, Volume I, Part 1, 394; NASA, "Space Shuttle Payload Flight Assignments. August 15, 1983. NASA "Space Jhuttle Payload Flight Assignments," November, 1%.⁹⁹ Rogers Commission Report, loc. cit. 1 Rogers Commission Report, Volume I, pp. 164-77.⁹⁹ Rogers Commission Report, loc. cit. 3 Wid., p. 201.⁹⁹ Rogers Commission Report, loc. cit. 4 NASA Response to Rogers Commission, Jul 14, 1986, pp. 30-31.⁹⁹ Rogers Commission Report, loc. cit. 5 Rogers Commission Report, Volume I, p. 17f.

121

¶will be determine based on studies and that "program enhancements . . . required to achieve the flight rate" will be implemented [emphasis added].96 This is reinforced in the NASA response to Recommendation IX where NASA says "NASA has initiated an assessment of spare parts requirements to adequately support the flight rate planning. " [emphasis added] g 7 Thus, it seems that once again a planned flight rate could become a controlling factor.

¶A finding of the Pre-Launch Activities Team is that during the preparation of 51-L for launch "Manpower limitations due to high workload created scheduling difficulties and contributed to operational problems."gs This is perhaps one of the clearest examples of the inappropriate logic at work in the system before the accident, because "manpower limitations" are not due to "high workload" in the system. Manpower and other resources are limited before the workload is planned. Problems are created when the workload assigned is inappropriate to the manpower available.

¶In a March 24, 1986, memorandum on "Strategy for Safely Returning the Space Shuttle to Flight Status," Admiral Truly reveals a better attitude toward flight rate in speaking of a "realistic and . . . achievable launch rate that will be safely sustainable." Admiral Truly also states that "the ultimate safe sustainable flight rate and the build up to that rate will be developed utilizing a 'bottoms up' approach in which all required work for the standard flow . . . is identified and that work is optimized in relation to the available work force."99

¶NASA prepared several reports for the Rogers Commission, and the Mission Planning and Operations Team (MPOT) Report indicates a good awareness of the general problem of over-ambitious flight rate planning. For example, that report states that compared to the need to devote resources to making the transition to an operational system the "increasing flight rate had the highest priority." The MPOT report continues, "In other words, it appears that the flight rate was not tied to the ability of the system to support it: but rather the system was reacting to the established flight rate. A major conclusion of the MPOT report is that "The NSTS Program should develop a bottoms-up strategy for expanding flight rate."loo In other words, flight rate cannot be imposed from above, but must be determined by available resources.

¶The disturbing fact is the trend in the NASA statements. The earlier statements (i.e., the Truly memo and the MPOT report) indicated an awareness of the danger of trying to achieve an imposed flight rate. However, as mentioned above, the most recent statement, the NASA response to the Commission, once again speaks of achieving the planned flight rate.

¶The Rogers Commission has documented the fact that before the Challenger accident the Shuttle system was approaching a state of saturation in which no more flights could be accommodated. If the accident had not occurred flight rate saturation may have eventually been reached due to bottlenecks in crew training on the mis- s 6 NASA Response to Rogers Commission, July 14, 1986, p. 31. 9'bid., p. 33. 9*Rogers Commission Report, Volume 11, p. 1-14, 99NASA Response to Rogers commission, July 14, 1986, p. 40.¹⁰⁰¹⁰⁰ Ibid., pp. 583-84. Rogers Commission Report, Volume 11, p. 5-31,

¶64-420 0 - 86 - 5 sion simulators O or because of inadequate spare parts for the Orbiter. l o 2

122

¶Availability of training time on simulators and availability of spare parts can both be improved by the application of more resources. Nevertheless, if the achievement of a planned flight rate is the overriding concern, removal of one bottleneck may only reveal another one. Eventually, pressures will be brought to bear on safety. The pressure on NASA to increase Shuttle flight rate has been complicated by the need to maintain program flexibility (which means to accommodate changes in the payloads on the manifest) and by the "developmental" nature of the Shuttle system. Manifest changes and the developmental nature of the system create problems in the planning of Shuttle missions.

¶In addition, it is interesting to note that until the training, spares, and mission planning problems are resolved, achievable flight rate may not depend on whether or not Challenger is replaced.

¶c. Impact of Pressures on Shuttle Operations

¶Issue

¶Did operating pressures adversely affect the safety of the Shuttle program?

¶Findings

1. The pressure on NASA to achieve planned flight rates was so pervasive that it undoubtedly adversely affected attitudes regarding safety.

2. The pressure to achieve planned flight rates was compressing mission preparation as earlier missions were delayed due to unforeseen problems. Had the accident not occurred there would soon have been a collision between planned launch dates and mission preparation needs which could not have been met by overtime, cannibalization, or other undesirable practices. Operating pressures were causing an increase in unsafe practices.

3. The schedule of payloads planned to fly on the Shuttle (the manifest) was frequently changed. Each change rippled through the NASA Shuttle organization and through the manifest and, especially if made shortly before launch, would increase the demands on personnel and resources in order to achieve the planned flight rate.

4. The Space Shuttle has not yet reached a level of maturity which could be called operational as that term is used in either the airline industry or the military. Each Shuttle flight is fundamentally unique, and requires unique preparations. Therefore, small changes in a mission can cause significant perturbations of mission planning and crew training.

¶Recommendations

1. The new Associate Administrator for Safety, Reliability and Quality Assurance must assure that any pressures to increase the

¶101 Ibid., Volume I, p. 170. 102 Ibid., p. 174.

123

¶Shuttle flight rate do not adversely influence mission preparation. The Associate Administrator must have the authority not only to stop a particular flight, e.g., at a Flight Readiness Review, but to stop the whole mission planning process if necessary.

2. Where appropriate, NASA should take steps to make the mission planning process standard and routine to reduce the time and resources needed to plan a mission. Before requesting more resources for the existing mission planning process (manpower, facilities, equipment) NASA should identify ways to improve the process. Discussion

¶There is no doubt that operating pressures created a n atmosphere which allowed the accident on 51-L to happen. Without operating pressures the program might have been stopped months before the accident to redesign or at least understand the SRB joint. Without operating pressure the flight could have been stopped the night of January 27. This is documented in the Rogers Commission report in Chapters V and VI.lo3 Specific manifesta- tions of launch pressure and the resultant atmosphere in the agency are described in detail in Section VIII of this report.

¶Nevertheless, it has become clear that the Shuttle launch system was not functioning well and was becoming increasingly unsafe as flight rate was increased. This is documented in Chapter VIII of the Rogers Commission report. l o 4

¶Mission Planning.-Mission planning refers to the process of defining and preparing each Space Shuttle mission. It is important to understand the mission planning process in order to understand why pressure to achieve a given flight rate could have adverse impacts. The process is lengthy, complex, and tightly interrelated. That is, many steps must be done in sequence, and many different flights have to use limited resources and facilities.

¶Mission planning begins at NASA headquarters with the customer services manager in the Office of Space Flight. Both financial and policy agreements between NASA and the customer are nego- tiated and signed. Technical documentation begins at this time although the level of mission-specific work is low.

¶After flight assignments are made by NASA Headquarters and the mission is defined, a process of continual review begins. Payloads are assigned to a particular flight 33 months prior to launch. At this time a Payload Integration Plan (PIP) is developed which includes a preliminary analysis of the mission.

¶Payload safety is the responsibility of the payload developer. He must be throughly familiar with NASA safety requirements and must certify that his payload meets them. NASA audits the certification process but performs no visual inspection of the payload for conformance to safety standards.

¶Once the cargo of a particular mission has been defined, or "baselined", the significant engineering work of mission processing actually begins. NASA refers to this as the "production process". The product of the process is the launch of a particular mission,¹⁰³¹⁰³ Ibid., pp. 59g-97. Ibid., pp. 82-151. lo4 Ibid., pp. 164-77.

124

¶but there are many other intermediate products such as flight and training software, crew activity plans, and handbooks and check- lists for the crew to take on the flight.

¶The launch production process template is displayed schematically on Figure VI-2. The template begins 15 months before the scheduled launch date (L-13, at which time a Flight Definition and Requirements Directive (FDRD) is issued. This marks one of seven defined "freeze points" of the 15 month mission-specific pre-launch activity. A freeze point simply means that a particular activity is norminally defined so that no time changes can occur without a formal process to authorize and document the change. In theory, non-mandatory changes are not made after a freeze point. As noted below, significant changes do indeed occur after the various freeze points in the schedule.

6

¶1s 14 13 12 11 10 9 8 7 6 5 4 3 2 1 s

¶I I I I I I I I I I I I I I I

¶I I I I

¶
• : -L I I I — 1

I I

¶I I I I . . I

¶I I

¶I I

¶I

¶I I

I CREW nwuw uyc I

¶1 I

¶I

¶I I

¶I

¶I

¶< . M~DoQ)yyulWN

¶I I

¶I I I

¶I I I

¶I 1 I

I I I I I Oll*T€@ SYSTEMSh W V % S I I I I I I I I I I I I I I L-10.9 I I I I

0 L.3 b.5 1-7.7

¶VI-2

126

¶At 7.7 months before launch, the Cargo Integration Review (CIR) occurs. This is a critical point in the mission definition and launch process. The customer participates in this review. All baseline requirements for flight design, flight and ground operations, and crew size are defined. The engineering requirements for a particular mission are approved. The CIR essentially separates the design process and concept documentation from the actual Orbiter processing, installation and certification of the hardware and software, and final crew training and engineering verification of the various systems on the Orbiter. Typically 10 to 20 percent of the mission-specific preparation work is accomplished by the time of the CIR, and after the CIR the process is driven by the Shuttle mission preparation milestones.

¶At L-3 months the flight operations review (FOR) takes place. This freeze point allows the customer to review all final flight operations plans. At approximately the same time the launch site flow review (LSFR) takes place, at which the timing and flow of the Shuttle and its cargo through the Orbiter processing facility (OPF), the vehicle assembly building (VAB), and to the launch pad are all reviewed and baselined. No changes should occur after this point in time, but, of course, some do.

¶At L-2 weeks the Flight Readiness Review (FRR) takes place. Its purpose is to verify the-fact that for this mission the hardware and software are ready for flight. It is here that the final commitment to a specific launch date and time is made.

¶At the FOR typically 40 to 50 percent of the work of the production process has been accomplished. At the time of the Flight Readiness Review, almost all of the work must have been accomplished because the Flight Readiness Review is not for the purpose of working out problems but merely to certify that problems have been resolved.

¶AS the targeted flight date approaches, conditions are continually reviewed and last minute changes are made as necessary through a series of meetngs and teleconferences.

¶This simplified description does not begin to reveal the details of the launch production process but study of the template should give some indication of its complexity. With over 50 percent of the work typically needing to be accomplished in the last three months before launch, and with typically 20 or more flights in work at any given time, it should be clear that last minute changes can be very disruptive and costly.

¶The developmental or non-operational status of the Shuttle also contributed to problems as the flight rate increased. Less time between flights meant that results from one flight could not be incorporated into the early planning for the next one. In other words, any change resulting from feedback from the previous flight was necessarily a last-minute change. Because of the developmental nature of the Shuttle system, such changes were to be expected. At 24 flights a year there would be about two weeks between flights. Allowing some time for flight data analysis, this would mean that results of the previous flight typically would not be available at the Flight Readiness Review. Indeed, the O-ring erosion results of flight 61-C were available only immediately before the 51-L launch.

127

¶The complex and lengthy mission planning process was under increasing pressure and was being strained to achieve the planned launch rate. Two activities that were compressed were training of the flight crew and training of the ground launch crew.

¶Training.-When training and other preparations is compressed, progam quality is likely to suffer, and errors become more likely. Given the situation with NASA's safety program-which the Rogers Commission described as "silent"-errors were less likely to be detected before harm could occur. Errors can be caused by personnel taking shortcuts with respect to established procedures. Two examples are given in the Pre-Launch Activities Team report:

The most significant error encountered was during the launch countdown. While preparing for propellant loading, the LH2 Orbiter to ET disconnect Valve was opened by the console operator. He had erroneously failed to follow the required steps in the OMI. A follow-on error was made in that this occurrence was not properly documented. Since proper documentation was not present, a full assessment of the problem was not made prior to the launch of STS 51-L. Flight data from STS 51-L indicated the valve did perform satisfactorily. Another major error occurred when the integrity seals on the ET aft restraints were broken and not reported. It is believed that the seals were broken in error, but the break of integrity was not reported in accordance with established procedures. The underlying factors contributing to these errors were not determined during the processing reviews. O

¶These errors apparently had no adverse impact on the mission, but indicate a breakdown of the discipline so necessary for a process as complex as launching a Shuttle.

¶Shuttle crew training is an important part of mission preparation. The crew of 51-L had training loads as high as 70, 63, 65, 59 and 58 hours in the several weeks before their launch. This was due to the fact that their training started some 3 weeks later than scheduled.

¶It must be noted that the crew also had 3 easy weeks during this period. During the weeks which included Thanksgiving, Christmas and New Year's they only trained 31, 27 and 49 hours, respectively. No harmful effects of compressed Shuttle crew training have been documented but common sense indicates that the situation must have been less than optimal.

¶It will be recalled that the launch of flight 61-C, which immediately preceded 51-L, was delayed several times. It was originally scheduled to launch on December 18th and eventually launched on January 6th. The Commission report describes how the launch date slips for 61-C became a scheduling factor for the training through integrated simulations for 51-L.lo6 Delay of 61-C launch pushed a bow wave of tests at the Kennedy Space Center which required 51- L prime crew and/or mission control center resources and thereby

¶105 Rogers Commission Report, Volume 11, p. 1-15 loe bid., p. 5-13, constrained the time at which integrated simulation training could be conducted. The 51-L training schedule was changed several times during the last weeks prior to launch due to launch slips of 61-C and the desire to suspend work between the Christmas and the New Year holidays. Eventually all 51-L training was accomplished with some change of spacing between the simulations. If the originally planned spacing of simulation training was optimum, then the changed spacing probably was not.

128

¶It is not clear exactly why the 51-L crew was late in starting its training, because it should have started training before the delays of the 61-C launch began. What is clear is that the crew training is a serial effort which cannot occur until software is available to drive the simulation computers. O7 The necessary software cannot be written until the specific flight configuration of the mission has been designed. This is a situation in which each event must wait on the completion of the previous one. In the case of 51-L there were delays and development of some software elements. But it is not clear that the development of these elements was in fact started on time. It is clear that there was considerable remanifesting of 51-L, for example during most of 1984 the Cargo Integration Review was scheduled to occur on September 4 but due to remanifesting this slipped and the CIR eventually occurred on J u n e 18, 1985. In April 1985 a major change was made when the Orbiter assigned to the mission was changed (from OV-104 to OV-099) and major payload changes were made. This caused a slip of launch date from November, 1985, to January, 1986. There were small middeck payload changes in October, November and December of 1985.loS

¶It is clear that these changes must have delayed the delivery of software which, in turn would delay the start of crew training. Crew training was not related to the accident, but it does seem clear that the system was breaking down (i.e., data presented in the Commission report shows that in January of 1986 the delays in the projected start of crew training were growing).log

¶Examination of the record shows that pressure to achieve the planned flight rate was forcing the crew to train later and later, which meant higher weekly training loads. This was very likely compromising the effectiveness o i the crew training and thus the safety of the missions, although no harm had been documented a t the time of the accident.

¶Manifest Changes-As described in detail above, the planning of a Shuttle mission requires more than a year of significant work, with the first major "freeze point" occurring 15 months before planned launch. A freeze point is a place in the mission planning schedule where decisions are made about the mission and its imple- mentations. In theory, these decisions are made in a cumulative fashion so that earlier decisions do not have to be changed as the mission is refined through the planning process. Indeed, if there are no changes, this is in fact the way the system works; however, there are changes.

¶107 Ibid., p. 5-38. lo8 Ibid., pp. 5-7-12, * O Q Ibid., p. 5-42.

129

¶The first freeze point occurs when the mission is officially defined and payloads are assigned to a specific Orbiter. Another major freeze point occurs approximately seven months before launch at the Cargo Intergration Review (CIR). Typically, more than 80 percent of the work necessary to prepare a mission occurs after the Cargo Integration Review. Changes in the mission after the CIR tend to be much more expensive than changes made earlier in the process. O The Rogers Commission has adequately documented the fact that changes to the Shuttle manifest were common and major. As of April, 1986, the six missions planned to follow flight 51-L which were not dedicated missions, i.e., not missions having only one customer, had a total of 30 changes or a n average of five each after the start of the production process. Eleven of these changes were major that is, they involved the exchange of different types of major payloads. l 2

¶Manifest changes can be divided into four basic categories depending on the origin of the change. Some changes are caused by hardware problems such as when the Tracking and Data Relay Satellite was found to have a problem and was deleted from flight 51-E. As there is no reason to launch a faulty satellite, NASA virtually is obligated to allow such faulty satellites to be changed out.

¶The second category of manifest change results from what could be called "customer request." For example, many communication satellites have been rescheduled at the customer's request for business reasons. Again, NASA is in a n awkward position because if the satellite is not needed, NASA would not want to be in the position of insisting that it be launched. (Although there have been cases when customers launched satellites and stored them on-orbit.)

¶A third category is caused by the belated recognition of operational constraints in the Shuttle system. For example, it has been found that a payload combination would exceed the landing weights for the transatlantic abort sites.

¶In another example of this type of change, it was found that there was no acceptable launch window for a planned combination of payloads which needed to be put in different orbits. It would seem that NASA could improve its mission planning production process to minimize this kind of manifest change by doing a better job of assessing the impact of operational constraints on payload combinations earlier in the planning process. Of course, one must allow for the late emergence of subtle operational constraints which would only be discovered as a result of deep analysis relatively late in the process. Nevertheless the MPOT report suggests that NASA sometimes carries unworkable flights on the manifest. l

¶The fourth category of manifest change is due to external factors, many of which are totally within NASA's power to deny. It appears that many of the Headquarters requests for changes are made in order to put on the manifest science experiments which

¶I I 0 NASA briefing on STS Production Process by Elaine Hofstetler-Presented to Committee Staff on May 19, 1986.

¶Rogers Commission Report, Volume I, pp. 166-73; Volume 11, pp. 5-26-29,J-33-51.

¶l 1 * NASA briefing, May 19, 1986.¹¹ For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. 1 5 Rogers Commission Report, Volume 11, p. 5-46.

130

¶are essentially payloads of opportunity. This would include the Get Away Specials (or GAS-cans). It has been considered highly desirable to give this kind of standby status to scientific experiments because they have had low priority on the manifest. That is, it is a way for such experiments to get a relatively early flight.

¶When changes are made in the manifest they tend to ripple through the system and affect not only the mission in work but also all the other missions in work. For example, changes mean rework-things need to be done over. Software for the mission may have to be rewritten. Inevitably, this causes some delay and com- presses the time available for other work scheduled downstream in the process if the launch date is to be maintained. Of course, if the flight rate is to be achieved, launch dates must be kept.

¶Other missions are affected because the reworks necessary as a result of changes will pull engineers and technicians away from other projects. For example, in January, 1986, there were 21 flights in process. Given the fact that that resources available were finite, more work on one mission means that other missions have to wait. The result is that the mission preparations for the other missions also are compressed as they wait for the proceding mission to clear the process. The world system becomes less and less resilent, there is more and more overtime, and there is temptation to take shortcuts in the process.

¶It is important to note that "manifest changes" can also be viewed as "payload flexibility" as in the case of the "GAS-cans" mentioned above. Therefore, there may be a need to decide more specifically what we intend the Shuttle system to accomplish. If maximizing flight rate is to be the overriding consideration, then flexibility will have to suffer. However, if NASA adopts to rigid a posture with regard to payload changes, customers or users may object. For example, as pointed out above, there is no point in launching a faulty satellite. Most space operations are simply not mature enough for NASA to enforce a rigid manifest.

¶It would seem that a better way to minimize the adverse impacts of manifest changes would be to simplify the mission planning process so that freeze points could be later, that is nearer to the launch date, so that consequently changes would occur relatively earlier in the process, therefore with less impact.

¶Given the history of the program, it is known that there will be changes in the manifest and that the impact of these changes will be serious. It does not seem, therefore, that it would be particularly fruitful to try to develop analytical management tools to predict the impact of changes in the existing system (an effort NASA has suggested). Rather, effort should be directed toward developing a new, improved mission planning system. Also, the MPOT report claims that the impact of changes is already predictable, and can be budgeted. *

¶Operational Status of the System.-In addition to reconsidering the priority which should be attached to maximizing flight rate, there is also a need to consider the degree to which the Shuttle itself can be made more "operational." 1'4 Ibid., p. 5-38,

131

¶The Rogers Commission Report makes much of the fact that the Shuttle is not operational. The same point was made strongly to Committee staff in interviews with personnel at Kennedy Space Center involved in launch processing. The Roger Commission made no recommendation on this matter and NASA in its reponse to the Commission has not direcly commented on it.

¶As early as 1981, senior NASA officials agreed that the Shuttle should be brought 'lto a cost-effective operational status" and that to that end Shuttle design should be "frozen".1l6

¶The Shuttle was declared operational after its fourth flight, but that the program clearly was not capable of functioning in a manner that would be called operational in any other milieu. Each Shuttle flight is, indeed, unique. Large amounts of software must be written de nouo for each flight. This is appropriate for a developmental program but clearly but clearly will not work as NASA tries to move into a truly operational phase.

¶Prior to the Challenger accident NASA had realized that the mission planning process had to be drastically improved, probably through standardization. Unfortunately, pressure to increase the flight rate was driving all available resources into speeding up the existing system. There simply were not resources available to analyze the mission planning system and see where it could be simplified.¹¹ For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function.

¶If the Shuttle is to fly routinely, the mission planning system must be reworked to that end. For example, the Commission report makes the point that the two flight simulators were a bottleneck in the astronaut training process. l a Undoubtedly this was true. What is not clear is whether there is another way. For example, would it be possible to develop specialized crews, say a group of astronauts trained to deploy communication satellites, who would need much less training to repeat identical or similar missions, thus reducing the demands on the simulators? The point is not that such savings must be found or can be found, but that they must be sought and resources must be dedicated to the search €or such savings. If, indeed, no such standardization of mission planning is possible, NASA must face up to this fact and operate the Shuttle accordingly. As mentioned above, there are disturbing signs that NASA is moving once again toward achieving the highest possible flight rate without fundamentally changing its approach to Shuttle operations.

¶Pressure to Reduce Cost and Turn-around Time.-NASA was under pressure to reduce flight costs and to reduce turn-around time between flights. In some cases they could achieve both objectives at once by eliminating work done between flights (e.g., testing and refurbishment). A NASA memo shows that such actions were being pursued as early as August, 1981, after only one Shuttle

Ibid., Volume I, p. 170-71. Memo from W. R. Lucas, Director, Marshall Space Flight Center, to James M. Beggs, Administrator, dated August 21, 1981; subject: "ET/SRB Productibility/Cost Reduction"; the relevant sentence reads: "I wholeheartedly agree with your statements that Shuttle performance requirements and design should be frozen so that we can concentrate all efforts on bringing the system to a cost-effective operational status."

¶11' Rogers Commission Report, Volume 11, p. 5-31

¶1 1 8 Ibid., Volume I, p. 170.

132

¶flight.llg Attached to the memo are lists of activities to improve the producibility and reduce the cost of the SRB and ET. These include reduction of "mandatory government inspection requirements" for SRM processing by Thiokol and reduction of SRM propellant verification testing.

¶The point is not that these particular actions were unsafe, but that even very early in the flight program there were pressures on testing and inspection activities in the program.

¶Shuttle Process Issues.-Section VI.A.2.a. of this report, on "Shuttle Processing Issues" discusses several matters such as the availability of spares, overtine, and the adequacy of OMIs. It is clear that operating pressure aggravated and issues discussed there. For example, had there been no operating pressure there would have been less pressure on spares, less overtimd, and more time either to revise OMIs or to execute them.

¶Change Control Process.-Section VI.B.1.d. on "Change Control Process discusses how the pressure to increase flight rate compromised the hardware change control process. An important factor is the developmental (i.e., not-yet-operational) nature of the Shuttle System which means that large numbers of significant hardware changes can be expected.

¶d. Other Safety Issues

¶Issue 1

¶What is the criticality of landing safety associated with programmed and abort landing sites and their local characteristics?

¶Findings

1. The Committee finds that many of the normal and abort landing safety problems will be alleviated when the Rogers Commission's and the Committee's (section V.A.l.b., this report) recommendations to upgrade the landing gear system are implemented. When the landing gear system is understood, straightforward calculations and operational rules will determine acceptable runway dimensions and conditions.

2. The Committee found no reason to fault NASA's current procedure on launch constraints based upon operational judgement and conservative rules on local conditions at planned abort and landing sites. However, since an obvious finding is that the Orbiter is a developmental system, it is axiomatic that unanticipated "dicey" circumstances will arise.

3. It was found that for the least landing gear system stress, runway preference is Edwards Air Force Base (EAFB) (concrete), KSC, and Rogers Dry Lake (EAFB "lake bed") in that order. No reason was found to invalidate the KSC runway design. The reasons for the "dry" course surface still prevail over concern about wear on tires designed for one landing. Additional constraints at KSC because of lesser lateral stabilized overrun area may be needed to bring its safety to the level of the EAFB runway.

4. The NASA Landing Safety Team's proposal to provide standard landing aids and arresting barriers at all sites and their em119 NASA Memo from W.R. Lucas, to James M. Beggs, Administrator, dated August 21, 1981.

133

¶phasis on runway surface characteristics for repetitive tire use takes on a new dimension that is in addition to the Rogers Commission's recommendations.⁵⁵ bid. . Weather, by far, is the most significant factor governing operational decisions, Orbiter damage, and landing safety. The constraint is simply that acceptable weather must be forecast with confidence within the time frame needed. Ultra-conservative rules prevail because of the predictable unpredictability of Cape weather. New and innovative local weather analysis and forecasting research is a high priority. The African Coast and southwestern United States sites enjoy more stable and predictable weather.

¶Recommendations

¶The first priority to achieve a n acceptable degree of landing safety and to have a sensible base to work from for improvement is to implement the recommendations of the Rogers Commission and the Committee on the landing gear system improvement to attain a n operational capability. Then:

Instrument the system, and schedule all landings a t Edwards runway for systematic concurrent testing until the landing gear system is understood. Write a clean sheet set of rules based on results. Determine the risk of accident with the B-747 Shuttle Carrier Aircraft (SCA) and its impact upon the Shuttle program. Extend every reasonable effort to assure a mission planning process to minimize the need for abort site landings. Reevaluate and determine the degree of risk acceptable at abort site landings and bring abort site capability up to meet that risk level. Expand astronaut matched team flight landing practice to cover all known exigencies. Propose additional training craft if necessary. Join in a venture with NOAA to invent new technology and techniques to learn new ways to understand the dynamics of Cape Kennedy weather phenomena to supplant current inad- equacy to forecast two hours ahead.

¶Discussion

¶This discussion assumes that landing gear system improvements are to be implemented. The substance of the testimony and results of the Committee investigation are fairly clear.

¶The EAFB runway will remain the primary programmed landing site for the duration of the Shuttle program simply because of the capricious nature of the Cape weather. All landing parameters favor Edwards runway as the best for safety and it approaches 100 percent predictable availability.

¶The safety of Rogers dry lake is permanently compromised because of the lake bed surface. Its firmness and surface strength are variable and the surface has considerable debris scattered on it. Should the tires blow on one strut, it would dig in and the Orbiter would not be controllable as it would be on a concrete runway with nose wheel steering and brakes. This is also true of stabilized lateral and longitudinal overrun areas of the concrete runway.

134

¶From the body of testimony, it can be deduced that given a landing gear system that meets operational requirements, acceptable weather, and an adequately trained pilot, the Orbiter can consistently achieve the acceptable level of low risk landings that was originally intended at Edwards and KSC. The worst KSC case is the heavy weight abort Return To Launch Site (RTLS) landing. Night landings at these sites add an element of risk that cannot be evaluted until day landing confidence is restored. The only astronaut testimony on night landings was not favorable.²² Rogers Commission Report, Volume I, p. 199. o

¶Landing safety a t remote abort sites presents, by far, the worst case including all facets of navigation, weather, energy management, depth of pilot training, other air traffic intrusion, alignment, approach, heavy weight high speed landing, narrow and short run- ways, and fire and rescue support, and perhaps even terrorism or sabotage. In short, the classical emergency landing is just that-an emergency landing. It will surely test the skill of the pilot. The only sure cure for abort landing exposure is a successful launch.

¶Testimony gave reference to one RTLS site (KSC), five TAL (Trans Atlantic or Trans Abort Site) sites (Casablanca, Dakar, Moron, Rota, Zaragoza), and three AOA (Abort Once Around) sites (EAFB, White Sands Northrop, KSC). At least one each of these must be available within the rules of visibility, wind, dew point, precipitation, ceiling, cloud cover, turbulence, and gusts, and provide TACAN, MLS, PAPI (Precision Approach Path Indicators), and Ball Bar lights as deemed necessary for the mission; the RTLS within 25 minutes of launch, the TAL at about 35 minutes, and the AOA in an hour and 45 minutes.

¶The Orbiter is not a good handling airplane to fly. The Orbiter landing is the most demanding task of airmanship expected of an aviator today. It is a complex and sophisticated blend of automa- tion, systems management, and manual skills:

The Orbiter re-enters with a 1100 mile cross track capability to begin the Terminal Area Management phase, 52 miles out at Mach 2.5 and 82,000 feet. Computer energy management delivers the Orbiter to the alignment circle on TACAN where the pilot takes over at three minutes out on a 19 degree glide scope aligning on PAPI lights. At 13,000 feet,⁶⁶ id. iNm.-The nozzle to case joint design is significantly different than the case field joint design w ich caused the Challenger accident. However, it is cited here because some of the prob- l e m are relevant to the failure of the aft field joint.] miles and two minutes out, he initiates flare to intercept the 1.5 degree glide slope at 275 knots. Guiding on the Ball Bar lights, he approaches and lands around 200 knots depending on his weight. At 140 to 120 knots, he begins to brake and decelerates to a stop.

¶If MLS terminal navigation is not available, the pilot can rely upon onboard radar for precision altitude and use his heads up dis- play to assist what is nominally a visual approach and landing. There is no room for computer, navigation or pilot error. Training aircraft training and practice IS an element of major importance to successful Orbiter landings under the variety of conditions facing the pilots. Unrationed crew team flight training is deemed essenlZo Rogers Commission Report, Volume V, p. 1455.

135

¶tial to landing safety. Conversely, suggested autoland systems for this application did not find much support because they would pose a whole new development and certification hazard.

¶Landing safety will make a lot more sense if and when the cloud of imminent landing gear system failure is dissipated. That has been a pervasive note through the entire testimony and investigation.

¶Issue 2

¶Has adequate provision been made for crew safety in case of inflight emergencies? That is, has adequate provision been given to launch abort options and crew escape options?

¶Findings

1. Crew escape options were considered when the Shuttle was originally designed and the basic situation has not changed. Many initially attractive options do not significantly reduce risk to the crew either because they may not reduce exposure to the principal hazards or because they add risks of their own.

2. A crew escape system for use in controlled gliding flight might be feasible and worthwhile.

3. Crew escape during the ascent phase appears infeasible.

4. Launch abort during SRB burn appears impossible but it may be possible to decrease risk to the crew after SRB separation, primarily through mission design. Recommendation

¶NASA should continue to respond to the recommendations of the Rogers Commission regarding (i) crew escape during controlled gliding flight and (ii) increasing the possibility of successful emergency runway landings. NASA should re-examine all crew survival options and report to the Committee on its findings. Discussion

¶Before addressing the particulars of the findings and recommendations regarding launch abort and crew escape a few general comments on safety and risk will establish a useful framework.

¶Any new safety equipment installed on the Orbiter will bring with it its own new risks. It will also add weight to the Orbiter and will have associated capital and operating costs. Each of these must be addressed.

¶New Risks.-Consider for example the possibility of adding ejection seats to the Orbiter. The United States A i r Force experience with ejection seats has been that they are only about 80 percent effective. The point is that ejection seats are not a panacea. Any safety equipment has a chance of failing; ejection seats in particular always have a potential of premature activation which would result in the crew being ejected when there is no need.

¶Additional Weight.-In order to accomplish its purpose, the Shuttle must put payloads, i.e., weight, in orbit. Adding weight to

¶121Briefing to Committee Staff, May 28, 1986, "Report of the First Stage Abort Options History Task Group Chartered by the Mission Planning and Operations Team '-Barney Roberts, Advanced Programs Office,Johnson Space Center.

136

¶the Orbiter reduces the payload weight that can be orbited and therefore reduces the justification for the program. This is perhaps made clearer by considering a reductio ad absurdum. Suppose one could develop a new escape system-perhaps a n ejection pod which could reduce risks to the crew by 90 percent but weighed approximately 65,000 pounds. Since the Shuttle payload capability is only about 65,000 pounds there would be no remaining payload capacity in the Shuttle, and some risk would still remain. There would be no point to installing such a system because it would be a very bad trade. Evidently, one must do an engineering cost-benefit calculation and decide if the benefit is worth the penalty for each proposed change.

¶New Costs.-The same type of cost-benefit calculation must be done in the financial dimension. It is important to emphasize that the question is not "how much is a life worth?," but rather "where can a n extra amount of funding best be spent to reduce total risk to the crew, the mission, and the Orbiter?"

¶Risks will never be zero-what NASA must do is to better understand the risks and minimize the most dangerous exposures.

¶The risk, cost and weight penalties of crew escape systems that could hope to operate effectively while the SRB are thrusting are very large. This dictates that it is much more efficient to put program resources into reducing risks by improving the reliability of the SRB's and the whole Shuttle system during the period of time that the SRB's are thrusting. For example, if one of the SRB's should develop a problem so that there was a need to separate the Orbiter from 11:e SRB's and External Tank, it is essentially impossible to do this successfully while the SRB's are still thrusting. There are potential means of terminating SRB thrust which amount to explosively opening holes in the rocket casing. The holes allow the burning gases to exit the casing at several places so that there is no net thrust. Such a mechanism has the potential of premature activation which could lead to loss of the crew and the mission. In addition, the resulting deceleration loads on the Orbiter would require significant redesign, if the Orbiter were to survive.lZ2

¶A large part of the problem is that the launch situation is very dynamic. Decisions and implementation of decisions must be made very rapidly. The decisions are binary; that is, either "go" or "no-go," and the implementation must be largely automated for speed of execution. Thus, if a premature activation begins it will almost certainly go to completion.

¶In the case of 51-L accident, the first ambiguous indication of a problem came at about 65 seconds into the mission. At 72 seconds the system was coming apart and by 74 seconds the Orbiter was destroyed. The first signs of trouble were ambiguous because indications that the Orbiter was adjusting to aerodynamic forces due to the leak in the SRB joint appear very similar to signals generated when the Orbiter responded to upper atmosphere winds. It would be very risky to initiate any kind of crew escape action based on

¶122 Cmte Hgs, Transcript, June 25, 1986, pp. 132-35,¹¹ For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. 3 - 4 1 , Former astronaut, General Thomas Stafford. testified strongly in favor of crew escape systems but seemed to represent a minority view this sort of signal. The Solid Rocket Boosters began coming off the system at 72 seconds, after which an escape system might well have been inoperable due to mechanical deformations of the Orbiter structure under the aerodynamic loads that resulted, Thus, there was a period of time of something less than 9 seconds during which some kind of escape system might have been able to help the crew. It seems clear that attempting to develop a system to respond effectively to a situation such as this would be unproductive and that it would be wiser to improve the safety and realiability of the system during this ascent phase.

137

¶After the termination of SRB thrust, immediate crew escape is difficult because the Orbiter has achieved a very high altitude. However, under a range of circumstances it is possible to fly the Orbiter back to a controlled gliding landing at a runway. Under other circumstances, for example if the main engines fail shortly after SRB termination, the Orbiter may be forced to ditch into the ocean and such a ditching is not survivable.

¶Therefore the Rogers Commission recommended, and the Committee agrees, that NASA should attempt to minimize these risks. That is, NASA should take steps to increase the probability of the Orbiter being able to fly to a landing site and NASA should attempt to develop a way for the crew to escape from controlled gliding flight, for example, if the Orbiter is approaching a ditching or a crash landing.

¶After SRB termination a principal risk is that the Orbiter could lose one, two or three main engines. Depending on when and how this occurred it might be possible to fly the Orbiter to a landing site. It may be possible and perhaps practical to increase the probability of the Orbiter successfully accomplishing this maneuver through flight design. That is, it might be possible to accept somewhat reduced payloads and achieve more conservative trajectories which would minimize the exposure of the Orbiter to ditching or crash landing if main engine failure were to occur during the accent phase.

¶If the Orbiter finds itself in a situation (due to Main Engine failure or other failure) where it cannot fly to a runway but is otherwise under control, the crew might be able to escape during the controlled gliding descent. This would apply not only during the ascent phase but also during the landing phase. For example, if the reentry trajectory were miscalculated and the Orbiter could not reach the planned landing site the crew might have adequate time to bail out. There is a change that such a bailout system could be achievable with acceptable performance penalties. Certainly this last option-crew bail-out during gliding flight-must be very carefully studied.

¶The trade offs and calculations that have to be made in the area of crew escape and launch abort are activities in which astronaut involvement would be most useful.

¶Astronauts clearly represent the principal source of flight experience and therefore can make major inputs to decisions regarding what is practical to accomplish during flight. It is pointless to add risks, weight, and cost for a system that cannot be operated by the astronauts during flight conditions. Involvement of astronauts in management is discussed in section VI. B. 2. a. of this report.

138

¶In summary, space flight will always be a bold and dangerous venture. NASA must work to better understand the risks of space flight and in particular the risks of each Shuttle launch and to reduce these to an acceptable level.

MANAGEMENT ISSUE