Hardware Development and Production

¶a. Problems in Hardware Certification Issue I

¶Have all elements of Space Shuttle flight hardware been ade- quately certified? Findings

The overall design and certification processes prescribed by NASA for each major element of Space Shuttle flight hardware are very comprehensive.
Prior to the STS 51-L accident, in spite of the comprehensive nature of NASA's prescribed design and certification processes, in- sufficient testing had been conducted to permit a n adequate under- standing by either Morton-Thiokol or NASA regarding the actual functioning of the Solid Rocket Motor joint. Also, the Solid Rocket Motor had not been adequately certified to meet the natural and induced environmental conditions that are stated in NASA's design standards. The issue of whether or not standards were adequate is discussed in Section VII.
The deficiencies in Solid Rocket Motor testing and certifica- tion persisted in spite of many reviews of the program by panels of experts: (1)within the manufacturer; (2) within NASA; and (3) from independent, outside groups.
These deficiencies in testing and certification of one major ele- ment of the Space Shuttle system raise the possibility that other elements of flight hardware (or other sub-elements of the Solid Rocket Motor) could have similar deficiences.
If NASA is unable to explain why the deficiences in Solid Rocket Motor testing and certification went undetected by the ex- isting comprehensive set of processes and procedures, the agency will not be able to protect against a similar breakdown in its system of checks and balances in the future. Recommendations
NASA should devote more attention to determining why the deficiencies in Solid Rocket Motor testing and certification went undetected, so that appropriate action can be taken to uncover latent problems in existing hardware and to prevent similar prob- lems in future development programs.
NASA and its contractors should thoroughly reassess the ade- quacy of all the testing and certification that has been conducted to date on each element of Space Shuttle flight hardware. Where defi- ciencies are found, they must be corrected. Issue 2

¶Does the Space Shuttle Main Engine have adequate operating margins, and is the "fleet leader'' concept adequate to ensure safe operation?

¶Findings

The Space Shuttle Main Engine is an impressive, technologi- cal achievement. However, it also is one of the higher risk ele- ments of the Space Shuttle system. Anomalous component perform- ance or premature engine shutdown could prove catastrophic to the Space Shuttle and its crew.
Some NASA officials familiar with the Space Shuttle Main Engine believe that it should be operated at a throttle setting of 109 percent only in an emergency; others believe the engine could be safely operated at 109 percent on a routine basis.
It is widely accepted that the Space Shuttle Main Engine would be safer if its operating margins (for temperature, pressure, operating time, etc.) were increased.
The Committee agrees with the sense of Dr. Feynman's con- cerns with respect to NASA's current "fleet leader" concept for certifying Space Shuttle Main Engine components, such as high pressure turbopumps, for flight.
On a case by case basis, NASA regularly violates its own certi- fication requirements by permitting individual engine components to be used for flight even though they have accumulated an operat- ing time in excess of 50 percent of the two fleet leaders (i.e., in vio- lation of the "2X" rule). Recommendations
NASA should continue its active development program for the Space Shuttle Main Engine. The program should be focused more on increasing operating margins.
Because of the safety concerns raised by some knowledgeable officials, NASA should give serious consideration to restricting use of the 109 percent engine throttle setting to emergency situations only. If NASA decides that it needs to use the 109 percent throttle setting for other than emergency situations, the space agency should take whatever actions are required to ensure that adequate margins are present to maintain safety.
NASA should closely scrutinize each of the concerns raised by Dr. Feynman regarding the agency's "fleet leader" concept for cer- tifying Space Shuttle Main Engine components. The agency should also closely reassess its practice of selectively violating its "2X" rule for some Main Engine flight hardware elements.

¶b. Recurrent Hardware Problems Issue

¶What resolutions of inadequacies revealed in the landing gear, tires, wheels, brakes, and nose wheel steering of the landing and deceleration system are required? Findings

The Orbiter landing gear, tires, wheels, brakes, and nose wheel steering, as a system, is experimental, designed to criteria outside any other experience, and uses unique combinations of ma- terials. The original design performance specifications for speed and landing weights are routinely exceeded. The original design did not consider asymmetrical braking for cross wind steering as the normal case, although it has become standard practice. Stresses which were not taken into account in the design have surfaced in as yet a very small real world sample.

As a consequence, Orbiter landings appear high risk even under ideal conditions, which seldom occur. Exceptional procedural and skill demands are placed upon the pilots to nurse the brakes and tires through every landing. Landing rules have had increas- ing constraints imposed that hamper operational flexibility and usefulness of the Orbiter.
Brake and tire damage have been evident since early on in the program. The Rogers Commission seems very correct in finding the current landing gear system unacceptable. Resolution of land- ing gear system problems can no longer be put off. Recommendations

¶The Committee recommends that NASA

Assemble all of the fragmented studies, analyses, and conclu- sions on landing gear problems and integrate them into one engi- neering description of the system as it is now intended to be used. This should include consideration of the basic strength of the struts themselves and their attachments.
Write a new system specification and match the proposed design improvements to an acceptable reliability and certification specification.
Design a test and certification program adequate to meet cri- teria to fly and to continue well into future operations until under- standing and confidence in the landing gear system is attained.
In anticipation of requirements for a new brake specification, accelerate a program to provide:

Increased brake mass and/or heat sink, Substantial increase in energy absorption, Evaluation which weighs the experimental nature of the pro- posed 65 million foot pound carbon brake and its impact on the system against the penalty of weight of known materials (e.g. steel) for operational confidence.

Write updated subsystem specifications to upgrade the landing gear system to acceptable levels of performance to respond to the Rogers Commission's recommendations. Issue 2

¶What actions should be taken relative to other recurrent prob- lems with flight hardware? Finding

¶There have been many instances of in-flight anomalies and fail- ures of other elements of Space Shuttle hardware, some involving mission critical pieces of equipment. Some of these past problems have been corrected while others have not. Recornmendat ion

¶NASA should ensure that before reinstituting Space Shuttle flight operations, it fully understands and has corrected all instances of serious in-flight anomalous behavior or failures involv- ing mission critical pieces of flight hardware.

¶c. Other Engineering Concerns Issue

¶What action should be taken relative to other engineering con- cerns regarding critical elements of Space Shuttle flight hardware? Finding

¶In recent years, serious engineering concerns have been raised regarding the safety of some elements of Space Shuttle flight hard- ware, such as the 17 inch flapper valve and the heat exchanger feeding the liquid oxygen tank. Recommendations

NASA should ensure that, as a part of its current review of Space Shuttle safety, it identifies, thoroughly evaluates, and then takes appropriate action on all serious engineering concerns raised regarding mission critical elements of Space Shuttle flight hard- ware.
NASA should give special attention to both the cost and risks of using Filament Wound Case Solid Rocket Boosters for very heavy Space Shuttle payloads versus the cost and programmatic impacts of simply transferring those payloads to expendable launch vehicles.

¶d. Desirable Tests Not Yet Approved Issue 1

¶Is the current ground test program for the SSME adequate to provide a complete understanding of the engine's operating charac- teristics acd safety margins? Findings

The Committee supports the Findings and Conclusions of the Development and Production Team concerning the SSME, particu- larly the concern that "Hardware availability and the potential of damage to hardware and facilities resulting from tests malfunc- tions have constrained . . . [full margin] . . . testing during the ground test program."
The Committee shares Dr. Feynman's concern that there has been a slow shift toward decreasing safety in the SSME program.
There is not a sufficient understanding of SSME blade cracks and fractures. Recommendations
The Committee concurs with the Development and Production Team conclusion that overtesting, limits testing, and malfunction- testing in the SSME program should be re-emphasized to demon- strate full engine capability.
NASA should prepare and submit to the Committee a cost- benefit analysis of testing a SSME to destruction including: (a) utilizing additional SSME test stands; (b) utilizing additional hard- ware for the ground test program; and (c) the value of such a test.

A vigorous study of fracture behavior should be conducted to minimize the hazard of cracked SSME blades and to increase the reliability and safety margin of blades. New blades and/or new policies for duration of blade use should be incorporated prior to the next Shuttle launch. Issue 2

¶Is the leak/combustion threat of the External Tank's hydrogen pressure valve a hazard warranting testing? Findings

The Committee supports the Rogers Commission concern re- garding the hazard posed by the liquid hydrogen vent and relief valve.
The Committee supports the intent of the ET prime contrac- tor, Martin Marietta, to pursue outdoor wind tunnel testing to eliminate the liquid hydrogen vent/relief valve hazard. Recommendation

¶NASA, in conjunction with the appropriate contractor, should consider designing and conducting an ET liquid hydrogen leak/ burn test to determine if corrective actions should be taken prior to the next Shuttle flight. Issue 3

¶Does the present Range Safety System (RSS) on the External Tank present an unreasonable risk? Finding

¶There is substantial controversy over the relative benefits and risks of the present RSS on the External Tank. Recommendation

¶The Committee believes the Administrator should prepare and submit to the Committee a comprehensive review of RSS require- ments.

¶e. Production/Refurbishment Issues Issue I

¶Should 100 percent X-ray inspection of the propellant and insula- tion for the Solid Rocket Motors (SRM) be resumed? Findings

Previous X-ray inspection led to only one SRM being rejected for Shuttle use.
There is no non-destructive inspection method which can guarantee a defect-free SRM. X-ray inspection cannot detect "kiss- ing" voids in which the SRM insulation is touching the SRM steel casing but is not bonded to it. Debonded insulation at the end of an SRM segment could provide burning propellant gases with a path to the SRM steel casing and could result in loss of vehicle and crew. X-ray inspection can detect propellant cracks and large voids which if undetected could also result in a catastrophic situation.

Although there is no guarantee that X-ray inspection has been a particularly effective method of detecting propellant and insula- tion SRM flaws, it remains one of the best available methods to monitor the SRM manufacturing process. Recommendations
NASA should consider reinstating full X-ray inspection of the propellant and insulation for all motors used on succeeding flights until new, more accurate inspection methods can be developed and implemented and there is unquestionable confidence in the SRM production process.
NASA, in conjunction with the appropriate contractors, should investigate the development of new, more accurate inspec- tion techniques which can detect "kissing" voids and other poten- tial defects that cannot be detected by X-ray inspection. Issue 2

¶Are all production and other activities involving Criticality 1 and 1R hardware at prime and secondary contractor facilities labeled as "critical" processes? Findings

Critical processes are formally identified and controlled by NASA. All processes are classified and controlled by the contrac- tor's Process Change Control Board.
The O-ring used in the case joint is critical to the sea:ing in- tegrity of the joint, yet it is not designated as a "critical" process by either the Parker Seal Co. or Hydrapack, the manufacturer and supplier respectively. This raises the possibility that other Critical- ity 1 and 1R hardware components are also not appropriately des- ignated by their manufacturer as "critical" processes. Recommendations
NASA should require the manufacture of critical items, such as the O-rings, to be designated "critical" processes. Contractors should formally notify their employees involved in critical manu- facturing processes of the serious nature of particular production processes.
NASA should conduct a thorough review to ensure that all manufacturing processes involving Criticality 1 and 1R hardware components of prime and secondary contractors are appropriately designated "critical" processes. Issue 3

¶Do O-ring repairs compromise safety? Finding

¶The Committee supports the Development and Production Team Finding and Conclusion that the "limit of five repair joints per 0- ring is an arbitrary number'' and that "repair of inclusions and voids in the rubber , . . appears to be an area of potential prob- lem."

¶Recomrnendation

¶NASA should review its O-ring repair policy and contractor repair practices in terms of their effects on O-ring performance and safety. Such review should be completed prior to the resumption of Shuttle flights if, as anticipated, the new SRB joint design uses 0- rings. Issue 4

¶What impact does growth of SRM case size have upon booster and Shuttle performance and safety? Finding

¶The Committee concurs with the Development and Production Team Finding that "Remeasurement of two used SRM case seg- ments indicated both tang and clevis sealing surfaces have in- creased in diameter beyond the anticipated design limits." Recommendation

¶NASA and the appropriate contractor should resolve through analysis and testing prior to the next Shuttle flight the cause of SRM case size growth and its impact upon booster and Shuttle per- formance, reliability of refurbished SRM case segments, and safety.

¶f: Review of NASA 's Redesign/RecertificationPlan Issue

¶Is NASA's SRM redesign and hardware recertification plan a viable and realistic one which will result in a safer, more reliable Space Transportation System? Findings

NASA's SRM redesign plan is a step in the right direction. Moving the proposed launch date beyond June 1987 is a responsible and realistic decision. The membership of the SRM Redesign Team is representative of qualified individuals in and outside of NASA. With the expert assistance of the specially appointed National Re- search Council (NRC) Independent Oversight Group, the new SRM design should be a significantly safer and more reliable Shuttle ele- ment.
NASA's current hardware recertification plan is also a step in the right direction. The use of independent review contractors dis- tinguishes this recertification plan from earlier reviews. However, given the failure of previous reviews to discover the deficient SRB joint certification, the Committee is concerned there is still the pos- sibility that the recertification effort may not reveal other certifica- tion deficiencies, if indeed they exist. The plan also raises concern about the qualifications of independent reviewers to evaluate cer- tain elements given the uniqueness of particular Shuttle compo- nents.
The joint was never fully tested as a separate element of the SRM. The various forces that act on the joint during stacking, launch, and flight are difficult, if not impossible, to duplicate in a test of the joint under all conditions that could be experienced during launch and flight.

It is unclear what function the new Safety Office will perform in the redesign of the SRB field joint and other critical elements of the Shuttle, as well as NASA's recertification plan. Recommendations
The Committee recognizes the national need to return the Shuttle to flight status as soon as reasonably possible. As noted in NASA's July 14, 1986, report to the President, safety will deter- mine the launch schedule. However, NASA should consider the proposed launch date of early 1988 as a flexible one which should be slipped further if necessary. The Shuttle should not be launched again until NASA can assure that safety criteria have been met.
In establishing a test program to certify the new Solid Rocket Motor design, NASA should consider the feasibility of including in combination and in the proper sequence all of the thermal and structural loads expected to be experienced by the Solid Rocket Motor during ignition, lift-off, and flight.
The independent review contractors participating in the hard- ware recertification plan should utilize sufficient specific technical expertise to insure adequate recertification of all elements of the STS.
The Committee requests that the new Office of Safety, Reli- ability and Quality Assurance conduct an independent assessment of the SRB field joint redesign efforts. In addition, the new office should also be integrally involved in reviewing all other critical component redesign efforts and NASA's recertification plan.

Operations a. Shuttle Processing Issues

¶Issue

¶In 1983, NASA consolidated fifteen separate contracts and awarded a single Shuttle Processing Contract (SPC) encompassing all ground processing related to launch and landing of the Space Shuttle. There are two issues associated with this contract: (1)How should is the concept of a unified SPC; and (2) How well has the SPC contractor actually performed? A related issue is the quality of essential logistical support, especially spare parts, provided to the contractor by NASA. Findings

Performance under the SPC has improved since the inception of the contract. However, up to the time of the Challenger accident, contractor performance continued to be plagued by excessive over- time, persistent failures to follow prescribed work procedures, and inadequate logistical support from NASA.
High overtime rates have hampered SPC performance. Over- time rates had increased significantly during the six months prior to the Challenger launch, to the point that critical personnel were working weeks of consecutive workdays and multiple strings of 11 and 12-hour days. Fatigue resulting from work patterns of this sort can constitute a threat to safety. In fact, worker fatigue was a contributing factor in a mission-threatening incident on Flight 61-C, the mission immediately prior to the January 28 Challenger launch.

There are numerous documented cases where contractor em- ployees failed to comply with guidelines for carrying out assigned duties, including specific "Operations and Maintenance Instruc- tions" (OMIS). Such failures contributed to both of the major mis- haps in 1985 involving Shuttle processing-namely, the November 8, 1985, "handling ring" episode which led to significant damage to a Solid Rocket Motor segment slated for use on STS 51-L, and the March 8, 1985, "payload bay access platform" episode which led to significant damage to bay payload bay door. Failure to follow an OM1 also led to improper (and mission-threatening) handling of the hydrogen disconnect valve during the 51-L launch operations. All of these incidents show a lack of discipline, both with respect to fol- lowing prescribed procedures and with respect to reporting viola- tions of these procedures.
At the time of the Challenger accident, the lack of spare parts caused a degree of cannibalization (i.e., the removal of a part from one Orbiter to satisfy a need for a spare part on another Orbiter), which was the highest in the history of the Shuttle program and which was a threat to flight schedule and flight safety. Excessive cannibalization leads to multiple installations, retesting, added doc- umentation, delayed access to parts, and increased damage poten- tial. As a result, cannibalization contributes directly to excessive overtime.
There is no clear evidence whether or not greater involvement of the development contractors would improve Shuttle operations. Recommendations
Because of the serious quality and safety concerns surround- ing the contract, NASA should conduct a careful review of Shuttle processing, the SPC contract, and the relationship of flight hard- ware contractors and report its findings, recommendations, and proposed contract modifications to the Committee. NASA's reexam- ination should include a comparison of efficiency and safety under the SPC versus efficiency and safety during pre-1983 Shuttle proc- essing operations, which heavily involved the development contrac- tors.
NASA should examine the issues of spares availability and cannibalization and provide the Congress with a management and budgetar plan for correcting previous logistical problems.
NAJA should stop routine cannibalization and develop guilde- lines (including appropriate control and review procedures and roles for the SR&QA office) governing permissible cannibalization.
The Committee recommends that NASA provide its re-invig- orated safety office with the authority to enforce scheduling that leads to safe overtime rates.

¶b. Pressures on Shuttle Operations Issue

¶Was NASA under pressure to fly more flights? How did this pressure originate? Will it recur?

¶Findings

The Congress and the Executive Branch jointly developed the policy that the Space Shuttle should, in a reliable fashion and at an internationally competitive cost, provide for most of the Free World's space launch needs. By and large, both Branches failed to appreciate the impact that this policy was having on the operation- al safety of the system.
NASA was under internal and external pressure to build its Shuttle flight rate to 24 per year, primarily to reduce costs per flight, but also to demonstrate and achieve routine access to space. NASA has never achieved its planned flight rate. Recommendations
NASA must not attempt to achieve a flight rate beyond that which (1)can be supported by the budget and staff resources avail- able; and (2) is consistent with the technical maturity of the Shut- tle and the flexibility desired and needed in scheduling payloads. Management should ensure efficient use of resources but should not impose a flight rate on the system.
Once operation of the Space Shuttle resumes, the Committee should maintain a close and continuous oversight of Shuttle flight rate, planning, and operations. The Committee should ensure both that flight rate flows logically from the resources provided and that flight safety is not compromised beyond acceptable limits.

¶c. Impact of Pressures on Shuttle Operations Issue

¶Did operating pressures adversely affect the safety of the Shuttle program? Findings

The pressure on NASA to achieve planned flight rates was so pervasive that it undoubtedly adversely affected attitudes regard- ing safety.
The pressure to achieve planned flight rates was compressing mission preparation as earlier missions were delayed due to unfore- seen problems. Had the accident not occurred there would soon have been a collision between planned launch dates and mission preparation needs which could not have been met by overtime, can- nibalization, or other undesirable practices. Operating pressures were causing an increase in unsafe practices.
The schedule of payloads planned to fly on the Shuttle (the manifest) was frequently changed. Each change rippled through the NASA Shuttle organization and through the manifest and, es- pecially if made shortly before launch, would increase the demands on personnel and resources in order to achieve the planned flight rate.
The Space Shuttle has not yet reached a level of maturity which could be called operational as that term is used in either the airline industry or the military. Each Shuttle flight is fundamen- tally unique, and requires unique preparations. Therefore, small changes in a mission can cause significant perturbations of mission planning and crew training.

¶Recommendations