Investigation of the Challenger Accident
THE STS 51-L LAUNCH DECISION
THE STS 51-L LAUNCH DECISION
¶Discussion
¶Before each flight of the Space Shuttle, the ground support team carries out a series of meetings that are collectively known as the Flight Readiness Review. Policy guidance for this procedure is s u p plied by NASA Program Directive 710.5A, which states:
It is the policy of the Associate Administrator for Space Flight (AA-SF) to make an assessment of mission readi- ness prior to each flight. This will be accomplished by a consolidated Flight Readiness Review (FRR) of all activi- tiedelements necessary for safe and successful conduct of the launch, flight, and post-landing operations. . . . The FRR will be preceded by detailed readiness reviews (pre- FRR's) on individual elements, including cargo, under the cognizance of the responsible Managers.
¶The FRR policy directive offers the following guidance to project and program managers regarding the expected content of their presentations:
The Project/Element Managers will conduct pre-FRR's to develop their readiness assessment and are responsible for the FRR briefing content in their particular area.2
¶As for the agenda at these reviews, the directive has this to say:
- James Abrahamson, NASA, Headquarters, "Space Shuttle Flight Readiness Reviews," SFO- PD 710.5A, September 26, 1983, p, 1. See Appendix VIII-A. bid., pp. 1-2.
¶(207)
208The presentation of agenda items will normally include a brief status summary with appropriate supporting detail on significant items and conclude with a readiness assess- ment. The presentation topics and scope should be devel- oped from the pre-FRR's and should: (1) be that required to provide the AA-SF with the in- formation needed to make a judgment as to flight readi- ness; (2) review recent significant resolved problems and prior flight anomalies when necessary to establish confidence; (3) cover all problems, open items and constraints re- maining to be resolved before the mission; (4) establish the mission baseline configuration in terms of all significant changes since the last STS mission (changes to be considered include hardware, software, vehi- cle servicing/checkout, launch commit criteria, flight plans, flight rules and crew procedures); Within the above guidelines, the scope of the review should cover status and issues in areas such as: vehicle checkout, shortages and open work, unexplained anoma- lies, hardware failures, prior flight anomalies, certifica- tiodverification, as-built hardware configuration versus certified hardware list, Critical Items List (CIL), develop- ment, qualification and reliability testing, waviers and de- viations, limited life components, launch critical spares, sneak circuits, system safety/hazards and flight mar- gins. . . .3
¶In the case of STS 51-L, no deviation from normal procedure ap- parently occurred. This means that the Solid Rocket Motor, con- taining the seal that apparently failed, proceeded through the usual eight levels of review a t Thiokol's Wasatch Division, Mar- shall Space Flight Center, the STS Program Office at Johnson Space Flight Center, and the Associate Administrator's review at NASA H e a d q ~ a r t e r s . ~
¶The Flight Readiness Review process for STS 51-L began on De- cember l l , 1985, at Thiokol's Utah plant. No information is pre- sented in the briefing charts used that day regarding the continu- ing failure of the SRM joint seals. The chart entitled "STS-61C (STS-32) (SRM-24) Performance "has only one entry: "TBD [to be determined]."
¶Post-flight disassembly of STS 61-C SRB hardware following its launch on January 12 revealed that erosion of the primary O-ring had occurred in the aft field joint of the left motor. Hot gas had also bypassed the primary seal in the left nozzle joint. Erosion of the primary seal had also occurred in the nozzle joint of the right motor.6
¶Under the terms of the FRR Policy Directive, such damage would appear to require discussion: "the scope of the review should sIbid. pp. 2-3.
¶'Table I (9, e 44) indicates the date and BCO for each of these eight reviews.
¶5Thiok0l %S-51L (STS33) Solid Rocket &,or (SRM-25) Flight Readiness Review," TWR11. 1985.chart 1-1. See Amendm VIII-B. 1M811. Tbrpjmber ~.
¶~
¶6 Rogera Commkion &port, Volume 11,p. H-3.
209¶cover status and issues in areas such as . . . prior flight anoma- lies. . . ."
¶However, according to Mr. McDonald and Mr. Kennedy, Thiokol normally took about one week to prepare a discussion of problems noted in the initial inspection following SRB hardware disassem- bly.8
¶It would seem logical, when faced with the lack of data from the previous hardware set, to expand the search to other previously- flown hardware. On 61-A, hot gas had bypassed the primary seals in both the center and aft field joints of the left motor.9
¶The right motor suffered erosion of the primary O-ring in the nozzle joint. O
¶The SRBs from 61-B suffered erosion of the seals in both nozzle joints, with gas bypassing the primary seal of the left nozzle."
¶The Associate Administrator's policy directive is not alone in stressing that any available information capable of assisting with an assessment of flight readiness should be presented at a readi- ness review. Marshall's Shuttle Projects Office policy guidance uses virtually identical language. Under "Shuttle Policy Guidance," it states, "Review Concept: The Shuttle Projects FRR will employ a delta review concept from prior reviews and previous STS mis- sions."
¶In his letter announcing the STS 51-L Marshall Center FRR, Dr. Lucas wrote:
Each project manager must certify the flight readiness of his hardware and present supporting rationale and data so the Board can independently assess the flight readiness . . . Emphasis will be placed on safety of flight and mis- sion success, including potential impact of prior flight anomalies.
¶Apparent in the STS 51-L process, however, is that the continu- ing SRM seal problem did not receive such treatment. The "delta review concept" referred to above, according to Mr. McDonald, meant that the contractor was obligated to step back only to the previous mission for comparison. l4
¶For 51-L, there was no previous mission to compare data with, since 61-C had not yet flown. Anomalies on STS 61-A and 61-B were not discussed, Mr. McDonald said, because they had already been dispositioned in the FRR's for 61-B and 61-C.15
¶The Marshall Space Flight Center FRR conducted by Dr. Lucas occurred only one day after the 61-C launch. Mulloy's presentation
¶'SFO-PD 710.5A, p. 3.
210¶under STS 61-C performance noted that "all SRB systems func- tioned normally."
¶Under "ascent," the chart shows "no anomalies." l7
¶There is no indication in the documentation for this FRR that the continuing problem with the SRM seals was raised. The para- chute recovery system was discussed at some length. Much of the presentation appears to be drawn from the booster assembly pres- entation made at Mulloy's Level I11 FRR on January 3. The only relevant item that mi h t refer to the O-rings appears under "Certi8 fication/Verification tatus," where Mulloy stated that there were "no findings from continuing analyses that changes previously es- tablished rationale for flight. '
¶Mr. Mulloy's presentation at the January 15, 1986, Level 1 FRR does not indicate any serious problems with the SRBs. Documenta- tion under "Problems/Anomalies" lists "[IL]~61-C flight anoma- lies."19 Rogers Commission, "Meeting of Challenger Commission; NASA, JSC", Halloway, T. et al., March 9, 1986, p. 313; and Bobko, K . et al., March 24, 1986, p. 152. e Ibid., p. 17.
¶A ain, the focus of his presentation involved the changes made f in t e parachute recovery system. The SRM booster nozzle on STS 51-L would be separated at the apogee of the SRB flight path (fol- lowing se aration of the boosters from the Shuttle vehicle) to pro-B tect the rogue parachute from debris, and the main parachutes were to be separated at water impact to reduce risks to the divers that assisted with recovery.2O
¶Mulloy's presentation to the Associate Administrator was not no- ticeably different from the presentation be made to Mr. Aldrich, the Shuttle Program Manager, at the Level I1 readiness review the day before. In fact, the briefing charts are identical.21
¶SRM seal erosion was ultimately raised during the STS-51L Flight Readiness Review cycle. Mr. McDonald stated that at the L-1 FRR Mr. Mulloy informed the Mission Management Team of the erosion damage seen on STS 61-C, characterizing it as "within the experience base."2 Rogers Commission Report, Volume I, p. 199. o bid., Chart SRB-4. 2 1 Larry Mulloy, NASA, Marshall Space Fli ht Center, "STS-51L Level I1 Flight Readiness Review,'' January 14,1986. See Appendix VIII-g. 2 2 Discussion with Allan McDonald, September 4, 1986. Z3 Rogers Commission Report, Volume 11. See Chart 15 (p. H-10) and Chart 19 (p. H-12). s Ibid., Chart 30 (p. H-18). 2
¶This evaluation of the seal erosion problem does not indicate the seriousness of the issue, and would not lead senior managers to a conclusion that the seal problem was a threat to the safety of the Shuttle. Given the historical treatment of the SRM seal problem in this process, however, it is not surprising that the STS 51-L re- views did not raise any new concerns about the integrity of the joint.
¶This point is readily apparent in the Commission's report. There is no implication that a serious problem exists, if Mr. Mulloy's presentations are examined. The presentation made to Level 1 during the STS 4 1 4 FRR indicated that erosion was "acceptable," and offered a rationale for accepting the possibility that the phe- nomenon would recur.
¶l e Larry Mullo NASA, Marshftll Space Fight Center, "Center Board STS-51L Flight Readi- new Review Solidlkocket Booster, January 13,1986, Chart SRB-3.
211¶Indeed, Level 1 displayed more concern about the problem than did Marshall, since Dr. Hans Mark, then Deputy Administrator, di- rected Marshall to prepare a review of the seal erosion problems.24
¶For mission 41-G, Mulloy argued that "test shows maximum ero- sion possible less than erosion allowable."2 Rogers Commission Report, Volume I, p. 199. o bid., Chart SRB-4. 2 1 Larry Mulloy, NASA, Marshall Space Fli ht Center, "STS-51L Level I1 Flight Readiness Review,'' January 14,1986. See Appendix VIII-g. 2 2 Discussion with Allan McDonald, September 4, 1986. Z3 Rogers Commission Report, Volume 11. See Chart 15 (p. H-10) and Chart 19 (p. H-12). s Ibid., Chart 30 (p. H-18). 5
¶In his presentation to the STS 51-E Level 1 FRR, Mulloy is seen on a videotape stating that:
The rationale that was developed after observing this erosion on STS-11 [41-B] was that it was a limited dura- tion that was self-limiting in that as soon as the pressure in the cavity between the putty and the primary O-ring after the primary O-ring seats, or the pressure between the primary and the secondary O-ring equals the motor pressure, the flow stops and the erosion stops. The maxi- mum erosion that we have seen previously is 53 thou- sandths [of an inch]-that was back on STS-2. The erosion that we saw on 51-C was 10 thousandths of an inch on one O-ring and 38 thousandths on the other, so we believe that because of the limited exposure and the fact that the leak check assures that the secondary O-ring is properly sealing against motor pressure and the fact that the duration is limited, and that we can take 95 thousandths erosion on a primary O-ring and seal against 3,000 psi which is three times the motor pressure, that this represents an accepta- ble risk.2s
¶Mulloy's confidence that the SRM seal could take "95 thou- sandths erosion on a primary O-ring and seal against 3,000 psi which is three times the motor pressure, . . ." is based on comput- er modelling of the joint performance. Dr. Feynman's analysis of the model, however, questions its use as the basis for declaring the seal problem "an acceptable risk."
. . . This was a model based not on physical understand- ing but on empirical curve fitting. To be more detailed, it
¶was supposed a stream of hot gas impinged on the O-ring
material, and the heat was determind at the point of stag- nation (so far, with reasonable physical thermodynamic laws). But to determine how much rubber eroded it was as-
¶sumed this depended only on this heat by a formula suggested by data on a similar material. A logarithmic plot suggested a straight line, so it was supposed that the erosion varied as the .58 power of the heat, the .58 being determined by a nearest fit. At any rate, adjusting some
212other numbers, it was determined that the model agreed with erosion (to depth of one-third the radius of the ring). There is nothing much so wrong with this as believing the answer! Uncertainties appear everywhere. How strong the gas stream might be was unpredictable, it depended on holes formed in the putty. Blow-by showed that the ring might fail even though not, or only partially eroded
through. The empirical formula was known to be uncer- tain, for it did not go directly through the very data points by which it was determined. There were a cloud of points some twice above, and some twice below the fitted curve, so erosions twice predicted were reasonable from that cause alone. Similar uncertainties surrounded the other constants in the formula, etc., etc. When using a mathe- matical model careful attention must be given to uncer- tainties in the model.27
¶Mr. Mulloy's analysis of erosion also notes that it was a "self-lim- iting" phenomenon, assuming that the damage ceased after the pressure built up against the seal. His analysis demonstrates that either the primary or the secondary seal would serve the purpose.
¶On December 17, 1982, an amended version of the SRB Critical Items List was approved. It stated, "Leakage of the primary O-ring seal is classified as a single failure point due to possibility of loss of sealing at the secondary O-ring because of joint rotation after motor ressurization. [emphasis ad%dY'2 Rogers Commission Report, Volume I, p. 199. o bid., Chart SRB-4. 2 1 Larry Mulloy, NASA, Marshall Space Fli ht Center, "STS-51L Level I1 Flight Readiness Review,'' January 14,1986. See Appendix VIII-g. 2 2 Discussion with Allan McDonald, September 4, 1986. Z3 Rogers Commission Report, Volume 11. See Chart 15 (p. H-10) and Chart 19 (p. H-12). s Ibid., Chart 30 (p. H-18). 8
¶In t f e "Rationale .for Retention, the document states, "Full re- dundancy exists at the moment of initial pressurization."2 Rogers Commission Report, Volume I, p. 199. o bid., Chart SRB-4. 2 1 Larry Mulloy, NASA, Marshall Space Fli ht Center, "STS-51L Level I1 Flight Readiness Review,'' January 14,1986. See Appendix VIII-g. 2 2 Discussion with Allan McDonald, September 4, 1986. Z3 Rogers Commission Report, Volume 11. See Chart 15 (p. H-10) and Chart 19 (p. H-12). s Ibid., Chart 30 (p. H-18). 9
¶Mr. Mulloy read this to indicate that during the ignition tran- sient, the seal was a Critically 1R system, a redundant seal existed, and the secondary O-ring could be relied upon. After completion of the ignition transient (approximately 600 milliseconds), the joint became a Critically 1
¶Congressman Roe, however, said,
We don't buy the point of view, do we measure other criticality points in degrees? My father taught me . . . [i]t is or it isn t . . . you took it from a R1 position and made it a number one position. You didn't qualify that, there is nothing in the record that qualifies it as half an R1 or three-quarters of an R1 in terms of temperature. , . . We didn't say we put them in there in number of degrees. We either did or we didn't.
¶Implied in the presentation by Mr. Mulloy is that the Marshall and Thiokol engineers understood the joint's performance during the ignition transient. But, as Congressman Volkmer noted,
Mr. VOLKMER. ". . . Mr. Mulloy, it says on page 148 [of the Commission's report] that prior to the accident neither NASA or Thiokol clearly understood the mechanism by which the joint sealing took place. Do you agree or dis- agree with that?" Mr. MULLOY. "I totally agree, sir."32 Bid., p. 291.
¶Also notable by its absence in Mulloy's Presentation is the fact that STS 51-L had demonstrated an extreme example of blowby in the nozzle joint. It was this case that led Thiokol engineers to the conclusion that temperature was a contributing factor to joint damage. Mr. Boisjoly explained to General Kutyna that, based on photographs of the joints on 51-C (launched at a seal temperature of 53°F) and 61-A (launched at a seal temperature of 75"F), he "concluded, and so presented on the night before the launch . . . that it was telling us that temperature was indeed a discriminator ... "33 A type of, utty made b another company that also was considered for use in the SRM. Rogers Commission Report, Volume V, p. 784. a* bid., Chart 130 (p. H-66).
213¶The appearance of the material that had bypassed the joint, ac- cording to Boisjoly, was significantly worse for 51C in appearance and extent.
¶For mission 51-F, even after the failure of the primary seal in the 51-B nozzle joint, Mulloy's presentation to Level 1 listed the problem as " ~ l o s e d . ' ' ~ ~
¶Chairman Roe, questioning witnesses from NASA on 17 June, learned that managers at Johnson and at Headquarters had not necessarily perceived the seriousness of the situation represented by the seal problem.
¶Mr. ROE."I would like to get Mr. Mulloy to answer the question-would you repeat the nine flights and tell the
¶Committee at what level the O-ring problem was discussed and who was at that level? . . . You mentioned again, you listed the whole nine, and tell the Committee at what level the O-ring problem was discussed. We have been going on this for seven years and then who was at that meeting?"
Mr. M u u o ~ "Yes . sir. I can answer part of your ques-
¶tion. . . . I am reading from what was provided to me. It looks like it fits within the erosion. STS-11 [41-B], 41-C,
¶41-G, 51-E . . ., 51-F . . . , 51-1, 51-5, 61-A . . ., and 61
¶Bravo."
¶Mr. ROE. "These were a problem with the O-rings and they were discussed at Level l?"
Mr. MULLOY. "Level 1 and Level 2." Mr. ROE. "Therefore it is inconceivable that Level 1,
¶which is top management, would not have understood the issue?''
¶Mr. MULLOY. ""hat is right, and I believe that has been acknowledged. . . ."
¶Dr. GRAHAM. "We are in fact, reviewing the records to see who was at the various Flight Readiness Reviews that occurred when the O-ring data was mentioned, and we have not yet been able to pull that together. . . ."
¶Mr. ROE. "SO what you are basically saying is that
¶Washington level knew of part of the problems; is that a fair comment?"
¶Dr. GRAHAM. "There are two pieces to this: one, what was transmitted; and what was understood. I believe what
¶Mr. Mulloy and Dr. Lucas are addressing is what was transmitted. I don't know that they are the most appropriate people to express what was understood. That was a
¶Headquarters issue and, in some cases, a Johnson Space
214Center issue. It is clear the issue was not perceived at the seriousness with which it actually affected the system. However, the information was transmitted to these agen- cies."3 NASA, "Report to the President Actions to Implement the Recommendations of the Presi- dential Commission on the Space Shuttle Challenger Accident," July 14, 1986. (Hereafter r e ferred to as NASA Response to Rogers Commission.) s bid.. Chart 3-1. 6
¶Dr. Graham's statement is important when discussing the August 19, 1985, briefing on the joint seal problem. Thiokol and Marshall personnel did not communicate that the situation re- quired a halt in operations until the problem of seal erosion had been solved. It should also be noted that Mr. Moore was then occu- pied with the failure of the SSME temperature sensors (a failure which had led to premature shutdown of a main engine on flight STS 51-F and caused the first abort-to-orbit in the program's histo- ry), and so the briefing was attended by Mr. L. Michael Weeks, Deputy Associate Administrator (Technical) for Space Flight. A more complete analysis of his descripton of the situation to Mr. Moore is discussed in the section on Technical E x p e r t i ~ e . ~ ~
¶Mr. Aldrich was not made aware of the briefing at all, removing Level 2 from the information
¶Levels 1 and 2 were not alone in their misapprehensions. the lack of understanding of the seal problem also appears in the pres- entations to D r.Lucas and Mr. Reinartz at Marshall made by Mr. Mulloy. In the STS 61-C FRR cycle, immediately preceding 51-L, Mr. Mulloy was given an extensive discussion of the information obtained from STS 61-B, describing the damage to the seals, at the Level 3 SRB Project Office briefing he chaired.38
¶Mulloy's presentation to the Shuttle Projects Board then noted "SRM joint O-ring performance within experience base."3
¶In his presentation to the Level 1 FRR, however, Mulloy stated there were "no 61-B flight a n ~ m a l i e s . " ~ ~
¶In hindsight, a fundamental error that pervades the history of the seal erosion problem is this reliance on the "experience base" argument. Unwarranted confidence existed in the analysis of the joint seal erosion problem developed by Thiokol engineers and agreed to by Marshall's program office. There is a vital lesson to be learned in this episode, and it is best expressed by Henry Petroski, from the School of Engineering at Duke University.
Dismissing the single structural failure as an anomaly i s neuer a wise course (emphasis added). The failure of any engineering structure is cause for concern, for a single in- cident can indicate a material flaw or design error that renders myriad structural successes irrelevant. . . . In en-
¶ss Cmte H Transcript, June 17, 1986, pp. 203-206.
¶50 Vi
¶Section .B.l.c. of this report.
215gineering, numbers are means, not ends, and it ought rightly to have taken only the failure of a single bridge to bring into question the integrity of every other span. . . . The common expectation of the engineer and the layman is that the road will not lead to bridges that collapse.41
¶Clearly evident is the fact that the Flight Readiness Review pro- cedure cannot compensate for poor engineering analysis. The FRR is similar to a checklist and will not necessarily discover problems not on the list. The technical rationale presented by Level 3 man- agers is assumed to reflect the best engineering judgment avail- able. Relying on this expertise, managers in more senior positions at NASA were misinformed regarding the severity of the problem of seal erosion and its critical importance to flight safety.
¶The Committee is also concerned about the so-called "launch con- straint" imposed on the Shuttle system following STS 51-B, and the role this constraint was expected to play in the Flight Readi- ness Review process. The term "launch constraint" would seem to indicate that the Shuttle should not be launched until the problem giving rise to the constraint was solved. This is apparently not the case, according to Mr. Mulloy:
The problem assessment system is in place at the Mar- shall Center as a tool to assure-it is a tool used by our quality and a reliability assurance organization to assure that problems that occur in flights and in ground test, in development, our qualification motor tests that would have a bearing on the flight or the upcoming flights, that that is documented and tracked. That problem assessment system shows in the case of the O-ring erosion, it shows essential- ly the same information, in many cases identical informa- tion to what is in the Flight Readiness Reviews. It is the basis for continuing to fly given the observations we are ~eeing.~
¶Testifying before the Commission, Mulloy had also made this distinction.
Chairman ROGERS."Let's go back just a bit, because I think it is helpful to me if you-you use words that I un- derstand a little bit. What caused the constraint to be put on in the first place?' Mr. MULLOY."The constraint was put on after we saw the secondary O-ring erosion on the nozzle, I believe." Chairman ROGERS. "Who decided that?'' Mr. MULLOY. "I decided that, that that [the joint seal erosion] would be addressed, until that problem was re- solved, it would be considered a launch constraint, and ad- dressed at Flight Readiness Reviews to assure that we were staying within our flight experience base. , . ." Dr. RIDE. "Why didn't you put a launch constraint on the field joint at the same time?" Petroski, To E 'her is Human: The Role of Failure in Successful Design (New
¶Y;rL?t?%artin's Press,1 For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. g8 mid., July 24, 1986, p. 11. 1 9 9 Ibid., June 25, 1986, p. 52. 9 8 , pp. 69-73.4 Rogers Commission Report, Volume 1 1, p. H-1. s Cmte Hgs,Transcript,June 17, 1986, p. 205.
216Mr. MULLOY. "I think at that point . . . the logic was that we had been discussing the field joint, the field and nozzle joint primary O-ring erosion. This erosion of [STS 51-B'sl secondary O-ring was a new and significant event, very new and significant event that we certainly did not understand. Everything up to that point had been that the primary O-ring, even though it does experience some ero- sion, does seal. What we had evidence of was that here was a case where the primary O-ring was violated and the sec- ondary O-ring was eroded, and that was considered to be a more serious observation than previously observed."
¶The Marshall Space Flight System Problem Assessment System (PAS) was tracking the problem of nozzle joint primary O-ring ero- sion in Record A09288, "0-Ring Erosion in the Case to Nozzle
¶The record was apparently opened on July 10, 1985, some two months following the launch of STS 51-B on April 29, 1985. The last entry in this record is dated January 23, 1986, and begins "Resolution." It continues with a rationale for closing out the tracking record. Part of the rationale is quoted here:
Analytical studies based on both impingement erosion and blowby erosion show that this phenomenon has an ac- ceptable ceiling since implementing the above changes [in performance of the seal leak check and in stacking proce- dures]. Recent experience has been within the program data base. The seal improvement program plan will contin- ue until the problem has been isolated and damage elimi- nated to the SRM seals.45
¶An identical entry appears in PAS Record A07934, "Segment Joint Primary O-ring Charred." Though tracking problems with the field joint seals, work on the nozzle joint problem was included "as they are the same generic problem."4s
¶The logic behind this "resolution" of the O-ring problem is not readily apparent. As the field joint tracking report notes, "The 0- rings in the SRM segment ass[embl]y joints are designed as press[ure] seals & are not intended to be exposed to hot gases."47
¶Yet, in the rationale for closing out these tracking reports, it is stated that "[plrimary O-ring erosion is expected to continue since no corrective action has been established that will prevent hot gases from reaching the primary O-ring cavity."4 Rogers Commission Report, Volume 1 1, p. H-1. 8
¶The rationale ad described also appears to violate the directive, issued in 1980, that addresses the question of launch constraints. "All open problems coded criticality, 1, lR,2 Rogers Commission Report, Volume I, p. 199. o bid., Chart SRB-4. 2 1 Larry Mulloy, NASA, Marshall Space Fli ht Center, "STS-51L Level I1 Flight Readiness Review,'' January 14,1986. See Appendix VIII-g. 2 2 Discussion with Allan McDonald, September 4, 1986. Z3 Rogers Commission Report, Volume 11. See Chart 15 (p. H-10) and Chart 19 (p. H-12). s Ibid., Chart 30 (p. H-18). or 2R," it stated:
will be considered launch constraints until resolved (recur- rence control established and its implementation effecti- vity determined) or sufficient rationale, i.e., different con-
¶'s Rogers Commission Report, Volume V, p 1510.
¶NASA, Marshall Space Fli ht Center, '@Ring Erosion in the Case to Nozzle Joint," Prob lem Assessment System Record %umber A09288, February 26, 1986. See Appendix VIII-H. .&%id.,p. 2.
¶48NAS.4, Marshall Space Flight Center, "Segment Joint Primary Oring Charred," Problem Asseaament System Record Number A07934, March 7, 1986, p. 4. See Appendix VIII-I.4 Rogers Commission Report, Volume 1 1, p. H-1. 7 Ibid., p. 1.
¶481bid.r p. 5.
217figuration, etc., exists to conclude that this problem will not occur on the flight vehicle during prelaunch, launch or flight.
¶The Committee attributes this situation to the concept of "ac- ceptable erosion," which is more fully discussed in Chapter VII of this report.
¶According to testimony before the Commission, these tracking records for O-ring erosion were closed out upon receipt of a letter from Mr. McDonald dated December 10, 1985.51
¶This was apparently a mistake. As Mr. Mulloy and Mr. Wear ex- plained to the Commission,
Mr. MULLOY. ". . . Now, the entry that is shown in there that the problem was closed prior to 51-L is in error. What happened there was, one of your documents here which we did not discuss is the letter from Mr. McDonald to Mr. Wear which proposed that this problem be dropped from the problem assessment system and no longer be trapped [tracked] for the reasons stated in Mr. McDonald's letter. That letter was in the review cycle . . . . After Mr. Wear brought this letter to my attention, my reaction was, 'we are not going to drop this from the problem assessment system because the problem is not resolved and it has to be dealt with on a flight-by-flight basis.' Since that was going through the review cycle, the people who run this problem assessment system erroneously entered a closure for the problem on the basis of this submittal from Thio- kol. Having done that, then for the 51-L review, this did not come up in the Flight Readiness Review as an open launch constraint, so you won't find a project signature be- cause the PAS system showed the problem was closed, and that was an error." Chairman ROGERS."Who made the error? Do you know?" Mr. MULLOY. "The people who do the problem assess- men t system ." Mr. WEAR."Mr. Fletcher, and he reports within our quality organization at the Flight Readiness Review, at the incremental Flight Readiness Reviews . . . . At my review and a t Larry's review, there is a heads up given to the quality representative at that board for what problems the system has open, and they cross-check to make sure that we address that problem in the readiness review. On this particular occasion, there was no heads up given because their PAS system considered that action closed. That is un- fortunate."5 bid. 0 %id. iNm.-The nozzle to case joint design is significantly different than the case field joint design w ich caused the Challenger accident. However, it is cited here because some of the prob- l e m are relevant to the failure of the aft field joint.] 2
¶Mr. Mulloy's discussion with Chairman Roe, and his description provided to the Commission, indicate that the NASA Safety, Reli- ability and Quality Assurance (SR&QA) organization should play a
¶Robert Lindstrom, NASA, Marshall Space Fli ht Center, "Assigning Launch Constraints on dpen Problems Submitted t o MSFC PAS," Septem%er 15,1980, p. 1. See Appendix WI-J. 6 1 -era Commission Report, Volume V, p. 1509.
¶bid.
¶6 4 - 4 2 0 0 - 86 - 8 significant role in the Flight Readiness Review process. The infor- mation available on this topic suggests that this was not the case. The Committee is concerned by the invisibility of SR&QA in this area.
218¶First, the number of people operating in the SR&QA organiza- tion has apparently been declining since the Apollo program. The decline at Marshall is among the most severe, according to NASA's internal e ~ t i m a t e .5 bid. 0 %id. iNm.-The nozzle to case joint design is significantly different than the case field joint design w ich caused the Challenger accident. However, it is cited here because some of the prob- l e m are relevant to the failure of the aft field joint.] ~
¶The obvious conclusion is that SR&QA has fewer people to over- see the myriad details involved in preparing for Flight Readiness Reviews, in addition to their other duties.
¶Second, there is nothing to show what evaluation SR&QA person- nel had made of the joint seal erosion problem. The recurring nature of this problem, and the Criticality-1 status of the joint, argue that SR&QA should have paid close attention to this situa- tion, including the execution of an independent test program and presentations of their evaluation at Level 3 Flight Readiness Re- views.
¶Third, though management of the PAS system is apparently the responsibility of the SR&QA organization, they appear to exercise little control. The system is operated under contract by Rockwell, data is entered by hardware manufacturers, and the only technical analysis that appears in the reports on joint seal erosion was devel- oped by Mr. Wear or his deputy, James Thomas, in the SRM pro- gram office. There is no input, either concurrence or dispute, regis- tered by SR&QA personnel. Even more important, as illustrated by Mr. Mulloy's testimony, problem reports can too easily be removed from the system.
¶Fourth, the PAS tracking records do not support the testimony of Mr. Mulloy and Mr. Wear before the Commission. The entry enti- tled "Resolution" is dated January 23, 1986, while the FRR in Mr. Wear's SRM Project Office occurred on December 17, 1985, and the FRR in Mr. Mulloy's SRB Project Office took place on January 3, 1986. It is also interesting to note that the PAS Record, dated Feb- ruary 26, 1986, shows "Status Open."5 bid. 0 %id. iNm.-The nozzle to case joint design is significantly different than the case field joint design w ich caused the Challenger accident. However, it is cited here because some of the prob- l e m are relevant to the failure of the aft field joint.] 5
¶If Mr. Mulloy's and Mr. Wear's testimony is accurate, SR&QA should still have raised the issue of seal erosion as a concern at their reviews. No evidence exists that this occurred.
¶The Committee, however, is concerned not only about the SR&QA organization at Marshall. The Commission noted in its report that "[tlhe Problem Reporting and Corrective Action docu- ment (JSC 08126A, paragraph 3.2d) requires project offices to inform Level I1 of launch constraints. That requirement was not met. Neither Level I1 nor Level I was informed."5 bid. 0 %id. iNm.-The nozzle to case joint design is significantly different than the case field joint design w ich caused the Challenger accident. However, it is cited here because some of the prob- l e m are relevant to the failure of the aft field joint.] 6
¶Testifying before the Committee, however, Mr. Mulloy argued that both levels were informed.
Mr. VOLKMER. "Even though . . . you continued to see erosion of the O-ring, you continued to waive the launch constraint?"
¶5JSee also "Safety, Reliability and ality Assurance," Section VLB.Z.c(2)of this report. 6 4 This is documented in Section VI%Z.dl) of this report. s 6 PAS Record A09288, p. 1.
¶Rogers Commission Report, Volume I, p. 159.
219Mr. MULLOY. "That is correct, sir, on the basis of the ra- tionale or the explanation as to why that was an accepta- ble risk that was presented to me by Morton Thiokol, re- viewed and approved by my management. . . ." Mr. VOLKMER. "Was JSC [the Johnson Space Center] in- formed of the problem?" Mr. MULLOY. "Through the Flight Readiness Review and through the submission of this problem to the problem tracking system at JSC. I do not know what distribution was made at JSC when it goes down there. The report also goes to the Chief Engineer's office at Headquarters." Mr. VOLKMER. "It is my understanding that we had some testimony earlier from Mr. Aldrich that he wasn't knowledgeable that there was a launch constraint." Mr. MULLOY. "That is entirely possible, sir, I don't know what distribution was made, and I have testified, and I think-I have testified that it wasn't briefed in the Levels 2 and the Level 1. When I went-" Mr. VOLKMER. "That is right." Mr. MUWY. "-that 'we have a problem, the concern is flight safety, the rationale for continuing to fly is this.' That was not briefed in the context of 'this is a launch
¶constraint in the problem assessment system,' and it is entirely possible that if that report, whatever distribution is made of that report at Houston, that he might not have seen that."57
¶It is quite likely that neither Mr. Moore nor Mr. Aldrich was made aware of the launch constraint on the SRM. SR&QA person- nel at Johnson and at NASA Headquarters should have received these reports described by Mr. Mulloy and tracked them as they did similar launch constraints on other Shuttle hardware. What steps they took to assure that these constraints were raised at the Flight Readiness Review for these management levels is less clear. The Committee's review of the FRRs for the six missions subject to the launch constraint on SRM nozzle joint seals does not indicate a greater level of discussion took place because the constraint was in force, except for the STS 51-F FRR where an explanation of the 51-B failure was required.
¶The rationale for closing out these problems on the problem as- sessment system stated that "status will continue to be provided in the Flight Readiness Reviews and in formal technical reviews at Thiokol and MSFC."5 bid. 0 %id. iNm.-The nozzle to case joint design is significantly different than the case field joint design w ich caused the Challenger accident. However, it is cited here because some of the prob- l e m are relevant to the failure of the aft field joint.] 8
¶Without a change in the prevailing technical evaluation of the problem, however, it is unlikely that proper action to correct the overall problem would have been undertaken.
¶On the eve of the launch, Thiokol engineers attempted to change this prevailing technical evaluation. In a teleconference on the night of January 27, they presented data demonstrating that the low temperatures in the area would impair the function of the 0- ring seals inside the joint. After NASA managers expressed cons' Cmte Hgs Transcri t, June 17,1986,pp. 284-85.58 Ibid., p. K-31. Sbff meeting with NASA personnel, Head uarters, Washington, D.C., May 13, 1986. PAS Record A0928$ p. 3.
220¶cern about the delay such constraints would have on the flight schedules, Thiokol's management withdrew and met with their en- gineers again; only this time, the managers would not listen to fur- ther argument about aborting the flight. Thiokol then recommend- ed that the launch be allowed to proceed.
¶Launch operations were terminated at 12:36 p.m. Eastern Stand- ard Time (EST) on January 27 because of high crosswinds at the launch site. At 2:OO p.m. EST, the Mission Management Team met and decided to attempt a launch at 9:38 a.m. EST January 28. The weather was expected to be clear but cold with temperatures in the low twenties. There were concerns about the facilities and various water drains but no concerns were expressed about the O-ring and the Solid Rocket Boosters. All members of the team were asked to review the situation and call if any problems arose.
¶At Thiokol's Wasatch Division in Utah, Mr. Robert Ebeling 5 9 met with Mr. Boisjoly at about 2:30 p.m. Mountain Standard Time (MST) on the afternoon of January 27. They were joind by other Thiokol engineers. Mr. Ebeling was concerned about predicted cold temperatures at the Kennedy Space Center. When he was ques- tioned by the Rogers Commission he responded:
. . . The meeting lasted one hour, but the conclusion of that meeting was engineering, epecially Arnie [Thompson], Roger Boisjoly, Brian Russell, myself, Jerry Burns, they come to mind, were very adamant about their concerns on this lower temperature, because we were way below our data base and we were way below what we qualified for.60
¶Later Mr. Ebeling called Mr. McDonald at the Kennedy Space Center. Mr. McDonald remembered the call, saying:
¶He called me and said they had just received some word earlier that the weatherman was projecting temperatures
as low as 18 degrees F [Fahrenheit] sometime in the early morning hours of the 28th and that they had some meet- ing with some of the engineering people and had some con- cerns about the O-rings getting to those kinds of tempera- turea8
¶Mr. Ebeling wanted Mr. McDonald to get some accurate predict- ed temperatures for the Cape so he could make some calculations to determine what could be expected of the O-rings. McDonald told him he would get the temperature data for him and call him back. Mr. Carver Kennedy, Vice President of Space Services for Thiokol, working at the Kennedy Space Center, obtained the information. Mr. McDonald then relayed the information to Mr. Ebeling in Utah. The information indicated that the temperature was to get as low as 22" in the early morning hours, probably around 6:OO a.m., and that they were predicting a temperature of about 26" at the intended time of launch, 9:38 a.m. on the 28th.s2
¶69 Solid Rocket Motor Igniter and Final k m b l y Manager, Thiokol.
¶80 Thiokol, Robert Ebeling, Interview before the Presidential Commission on the Space Shut- tle Challenger Accident, March 19, 1986,
¶6 1 Rogers Commission Report, Volume f V
!; . 715.
¶8' Bid.
221¶Mr. McDonald then called Mr. Cecil Houston, the Resident Manager for the Marshall office at Kennedy Space Center, and told him of Thiokol's concerns with the low temperature and potential problems with the O-rings. Mr. Houston said he would set up a teleconference including Marshall and personnel at Thiokol in Utah.62a
¶~
¶62aTableI1 lists the principal participants in the teleconference on January 27, 1986.
222