Hardware Development and Production

¶a. Problems in Hardware Certification Issue I

¶Have all elements of Space Shuttle flight hardware been adequately certified? Findings

The overall design and certification processes prescribed by NASA for each major element of Space Shuttle flight hardware are very comprehensive.
Prior to the STS 51-L accident, in spite of the comprehensive nature of NASA's prescribed design and certification processes, insufficient testing had been conducted to permit a n adequate understanding by either Morton-Thiokol or NASA regarding the actual functioning of the Solid Rocket Motor joint. Also, the Solid Rocket Motor had not been adequately certified to meet the natural and induced environmental conditions that are stated in NASA's design standards. The issue of whether or not standards were adequate is discussed in Section VII.
The deficiencies in Solid Rocket Motor testing and certification persisted in spite of many reviews of the program by panels of experts: (1)within the manufacturer; (2) within NASA; and (3) from independent, outside groups.
These deficiencies in testing and certification of one major element of the Space Shuttle system raise the possibility that other elements of flight hardware (or other sub-elements of the Solid Rocket Motor) could have similar deficiences.
If NASA is unable to explain why the deficiences in Solid Rocket Motor testing and certification went undetected by the existing comprehensive set of processes and procedures, the agency will not be able to protect against a similar breakdown in its system of checks and balances in the future. Recommendations
NASA should devote more attention to determining why the deficiencies in Solid Rocket Motor testing and certification went undetected, so that appropriate action can be taken to uncover latent problems in existing hardware and to prevent similar problems in future development programs.
NASA and its contractors should thoroughly reassess the adequacy of all the testing and certification that has been conducted to date on each element of Space Shuttle flight hardware. Where deficiencies are found, they must be corrected. Issue 2

¶Does the Space Shuttle Main Engine have adequate operating margins, and is the "fleet leader'' concept adequate to ensure safe operation?

¶Findings

The Space Shuttle Main Engine is an impressive, technological achievement. However, it also is one of the higher risk elements of the Space Shuttle system. Anomalous component performance or premature engine shutdown could prove catastrophic to the Space Shuttle and its crew.
Some NASA officials familiar with the Space Shuttle Main Engine believe that it should be operated at a throttle setting of 109 percent only in an emergency; others believe the engine could be safely operated at 109 percent on a routine basis.
It is widely accepted that the Space Shuttle Main Engine would be safer if its operating margins (for temperature, pressure, operating time, etc.) were increased.
The Committee agrees with the sense of Dr. Feynman's concerns with respect to NASA's current "fleet leader" concept for certifying Space Shuttle Main Engine components, such as high pressure turbopumps, for flight.
On a case by case basis, NASA regularly violates its own certification requirements by permitting individual engine components to be used for flight even though they have accumulated an operating time in excess of 50 percent of the two fleet leaders (i.e., in violation of the "2X" rule). Recommendations
NASA should continue its active development program for the Space Shuttle Main Engine. The program should be focused more on increasing operating margins.
Because of the safety concerns raised by some knowledgeable officials, NASA should give serious consideration to restricting use of the 109 percent engine throttle setting to emergency situations only. If NASA decides that it needs to use the 109 percent throttle setting for other than emergency situations, the space agency should take whatever actions are required to ensure that adequate margins are present to maintain safety.
NASA should closely scrutinize each of the concerns raised by Dr. Feynman regarding the agency's "fleet leader" concept for certifying Space Shuttle Main Engine components. The agency should also closely reassess its practice of selectively violating its "2X" rule for some Main Engine flight hardware elements.

¶b. Recurrent Hardware Problems Issue

¶What resolutions of inadequacies revealed in the landing gear, tires, wheels, brakes, and nose wheel steering of the landing and deceleration system are required? Findings

The Orbiter landing gear, tires, wheels, brakes, and nose wheel steering, as a system, is experimental, designed to criteria outside any other experience, and uses unique combinations of materials. The original design performance specifications for speed and landing weights are routinely exceeded. The original design did not consider asymmetrical braking for cross wind steering as the normal case, although it has become standard practice. Stresses which were not taken into account in the design have surfaced in as yet a very small real world sample.

As a consequence, Orbiter landings appear high risk even under ideal conditions, which seldom occur. Exceptional procedural and skill demands are placed upon the pilots to nurse the brakes and tires through every landing. Landing rules have had increasing constraints imposed that hamper operational flexibility and usefulness of the Orbiter.
Brake and tire damage have been evident since early on in the program. The Rogers Commission seems very correct in finding the current landing gear system unacceptable. Resolution of landing gear system problems can no longer be put off. Recommendations

¶The Committee recommends that NASA

Assemble all of the fragmented studies, analyses, and conclusions on landing gear problems and integrate them into one engineering description of the system as it is now intended to be used. This should include consideration of the basic strength of the struts themselves and their attachments.
Write a new system specification and match the proposed design improvements to an acceptable reliability and certification specification.
Design a test and certification program adequate to meet criteria to fly and to continue well into future operations until understanding and confidence in the landing gear system is attained.
In anticipation of requirements for a new brake specification, accelerate a program to provide:

Increased brake mass and/or heat sink, Substantial increase in energy absorption, Evaluation which weighs the experimental nature of the proposed 65 million foot pound carbon brake and its impact on the system against the penalty of weight of known materials (e.g. steel) for operational confidence.

Write updated subsystem specifications to upgrade the landing gear system to acceptable levels of performance to respond to the Rogers Commission's recommendations. Issue 2

¶What actions should be taken relative to other recurrent problems with flight hardware? Finding

¶There have been many instances of in-flight anomalies and failures of other elements of Space Shuttle hardware, some involving mission critical pieces of equipment. Some of these past problems have been corrected while others have not. Recommendation

¶NASA should ensure that before reinstituting Space Shuttle flight operations, it fully understands and has corrected all instances of serious in-flight anomalous behavior or failures involving mission critical pieces of flight hardware.

¶c. Other Engineering Concerns Issue

¶What action should be taken relative to other engineering concerns regarding critical elements of Space Shuttle flight hardware? Finding

¶In recent years, serious engineering concerns have been raised regarding the safety of some elements of Space Shuttle flight hardware, such as the 17 inch flapper valve and the heat exchanger feeding the liquid oxygen tank. Recommendations

NASA should ensure that, as a part of its current review of Space Shuttle safety, it identifies, thoroughly evaluates, and then takes appropriate action on all serious engineering concerns raised regarding mission critical elements of Space Shuttle flight hardware.
NASA should give special attention to both the cost and risks of using Filament Wound Case Solid Rocket Boosters for very heavy Space Shuttle payloads versus the cost and programmatic impacts of simply transferring those payloads to expendable launch vehicles.

¶d. Desirable Tests Not Yet Approved Issue 1

¶Is the current ground test program for the SSME adequate to provide a complete understanding of the engine's operating characteristics acd safety margins? Findings

The Committee supports the Findings and Conclusions of the Development and Production Team concerning the SSME, particularly the concern that "Hardware availability and the potential of damage to hardware and facilities resulting from tests malfunctions have constrained . . . [full margin] . . . testing during the ground test program."
The Committee shares Dr. Feynman's concern that there has been a slow shift toward decreasing safety in the SSME program.
There is not a sufficient understanding of SSME blade cracks and fractures. Recommendations
The Committee concurs with the Development and Production Team conclusion that overtesting, limits testing, and malfunction- testing in the SSME program should be re-emphasized to demonstrate full engine capability.
NASA should prepare and submit to the Committee a cost-benefit analysis of testing a SSME to destruction including: (a) utilizing additional SSME test stands; (b) utilizing additional hardware for the ground test program; and (c) the value of such a test.

A vigorous study of fracture behavior should be conducted to minimize the hazard of cracked SSME blades and to increase the reliability and safety margin of blades. New blades and/or new policies for duration of blade use should be incorporated prior to the next Shuttle launch. Issue 2

¶Is the leak/combustion threat of the External Tank's hydrogen pressure valve a hazard warranting testing? Findings

The Committee supports the Rogers Commission concern regarding the hazard posed by the liquid hydrogen vent and relief valve.
The Committee supports the intent of the ET prime contractor, Martin Marietta, to pursue outdoor wind tunnel testing to eliminate the liquid hydrogen vent/relief valve hazard. Recommendation

¶NASA, in conjunction with the appropriate contractor, should consider designing and conducting an ET liquid hydrogen leak/ burn test to determine if corrective actions should be taken prior to the next Shuttle flight. Issue 3

¶Does the present Range Safety System (RSS) on the External Tank present an unreasonable risk? Finding

¶There is substantial controversy over the relative benefits and risks of the present RSS on the External Tank. Recommendation

¶The Committee believes the Administrator should prepare and submit to the Committee a comprehensive review of RSS requirements.

¶e. Production/Refurbishment Issues Issue I

¶Should 100 percent X-ray inspection of the propellant and insulation for the Solid Rocket Motors (SRM) be resumed? Findings

Previous X-ray inspection led to only one SRM being rejected for Shuttle use.
There is no non-destructive inspection method which can guarantee a defect-free SRM. X-ray inspection cannot detect "kissing" voids in which the SRM insulation is touching the SRM steel casing but is not bonded to it. Debonded insulation at the end of an SRM segment could provide burning propellant gases with a path to the SRM steel casing and could result in loss of vehicle and crew. X-ray inspection can detect propellant cracks and large voids which if undetected could also result in a catastrophic situation.

Although there is no guarantee that X-ray inspection has been a particularly effective method of detecting propellant and insulation SRM flaws, it remains one of the best available methods to monitor the SRM manufacturing process. Recommendations
NASA should consider reinstating full X-ray inspection of the propellant and insulation for all motors used on succeeding flights until new, more accurate inspection methods can be developed and implemented and there is unquestionable confidence in the SRM production process.
NASA, in conjunction with the appropriate contractors, should investigate the development of new, more accurate inspection techniques which can detect "kissing" voids and other potential defects that cannot be detected by X-ray inspection. Issue 2

¶Are all production and other activities involving Criticality 1 and 1R hardware at prime and secondary contractor facilities labeled as "critical" processes? Findings

Critical processes are formally identified and controlled by NASA. All processes are classified and controlled by the contractor's Process Change Control Board.
The O-ring used in the case joint is critical to the sea:ing integrity of the joint, yet it is not designated as a "critical" process by either the Parker Seal Co. or Hydrapack, the manufacturer and supplier respectively. This raises the possibility that other Criticality 1 and 1R hardware components are also not appropriately designated by their manufacturer as "critical" processes. Recommendations
NASA should require the manufacture of critical items, such as the O-rings, to be designated "critical" processes. Contractors should formally notify their employees involved in critical manufacturing processes of the serious nature of particular production processes.
NASA should conduct a thorough review to ensure that all manufacturing processes involving Criticality 1 and 1R hardware components of prime and secondary contractors are appropriately designated "critical" processes. Issue 3

¶Do O-ring repairs compromise safety? Finding

¶The Committee supports the Development and Production Team Finding and Conclusion that the "limit of five repair joints per 0- ring is an arbitrary number'' and that "repair of inclusions and voids in the rubber , . . appears to be an area of potential problem."

¶Recommendation

¶NASA should review its O-ring repair policy and contractor repair practices in terms of their effects on O-ring performance and safety. Such review should be completed prior to the resumption of Shuttle flights if, as anticipated, the new SRB joint design uses 0- rings. Issue 4

¶What impact does growth of SRM case size have upon booster and Shuttle performance and safety? Finding

¶The Committee concurs with the Development and Production Team Finding that "Remeasurement of two used SRM case segments indicated both tang and clevis sealing surfaces have increased in diameter beyond the anticipated design limits." Recommendation

¶NASA and the appropriate contractor should resolve through analysis and testing prior to the next Shuttle flight the cause of SRM case size growth and its impact upon booster and Shuttle performance, reliability of refurbished SRM case segments, and safety.

¶f: Review of NASA 's Redesign/RecertificationPlan Issue

¶Is NASA's SRM redesign and hardware recertification plan a viable and realistic one which will result in a safer, more reliable Space Transportation System? Findings

NASA's SRM redesign plan is a step in the right direction. Moving the proposed launch date beyond June 1987 is a responsible and realistic decision. The membership of the SRM Redesign Team is representative of qualified individuals in and outside of NASA. With the expert assistance of the specially appointed National Research Council (NRC) Independent Oversight Group, the new SRM design should be a significantly safer and more reliable Shuttle element.
NASA's current hardware recertification plan is also a step in the right direction. The use of independent review contractors distinguishes this recertification plan from earlier reviews. However, given the failure of previous reviews to discover the deficient SRB joint certification, the Committee is concerned there is still the possibility that the recertification effort may not reveal other certification deficiencies, if indeed they exist. The plan also raises concern about the qualifications of independent reviewers to evaluate certain elements given the uniqueness of particular Shuttle components.
The joint was never fully tested as a separate element of the SRM. The various forces that act on the joint during stacking, launch, and flight are difficult, if not impossible, to duplicate in a test of the joint under all conditions that could be experienced during launch and flight.

It is unclear what function the new Safety Office will perform in the redesign of the SRB field joint and other critical elements of the Shuttle, as well as NASA's recertification plan. Recommendations
The Committee recognizes the national need to return the Shuttle to flight status as soon as reasonably possible. As noted in NASA's July 14, 1986, report to the President, safety will determine the launch schedule. However, NASA should consider the proposed launch date of early 1988 as a flexible one which should be slipped further if necessary. The Shuttle should not be launched again until NASA can assure that safety criteria have been met.
In establishing a test program to certify the new Solid Rocket Motor design, NASA should consider the feasibility of including in combination and in the proper sequence all of the thermal and structural loads expected to be experienced by the Solid Rocket Motor during ignition, lift-off, and flight.
The independent review contractors participating in the hardware recertification plan should utilize sufficient specific technical expertise to insure adequate recertification of all elements of the STS.
The Committee requests that the new Office of Safety, Reliability and Quality Assurance conduct an independent assessment of the SRB field joint redesign efforts. In addition, the new office should also be integrally involved in reviewing all other critical component redesign efforts and NASA's recertification plan.

Operations a. Shuttle Processing Issues

¶Issue

¶In 1983, NASA consolidated fifteen separate contracts and awarded a single Shuttle Processing Contract (SPC) encompassing all ground processing related to launch and landing of the Space Shuttle. There are two issues associated with this contract: (1)How should is the concept of a unified SPC; and (2) How well has the SPC contractor actually performed? A related issue is the quality of essential logistical support, especially spare parts, provided to the contractor by NASA. Findings

Performance under the SPC has improved since the inception of the contract. However, up to the time of the Challenger accident, contractor performance continued to be plagued by excessive overtime, persistent failures to follow prescribed work procedures, and inadequate logistical support from NASA.
High overtime rates have hampered SPC performance. Overtime rates had increased significantly during the six months prior to the Challenger launch, to the point that critical personnel were working weeks of consecutive workdays and multiple strings of 11 and 12-hour days. Fatigue resulting from work patterns of this sort can constitute a threat to safety. In fact, worker fatigue was a contributing factor in a mission-threatening incident on Flight 61-C, the mission immediately prior to the January 28 Challenger launch.

There are numerous documented cases where contractor employees failed to comply with guidelines for carrying out assigned duties, including specific "Operations and Maintenance Instructions" (OMIS). Such failures contributed to both of the major mishaps in 1985 involving Shuttle processing-namely, the November 8, 1985, "handling ring" episode which led to significant damage to a Solid Rocket Motor segment slated for use on STS 51-L, and the March 8, 1985, "payload bay access platform" episode which led to significant damage to bay payload bay door. Failure to follow an OM1 also led to improper (and mission-threatening) handling of the hydrogen disconnect valve during the 51-L launch operations. All of these incidents show a lack of discipline, both with respect to following prescribed procedures and with respect to reporting violations of these procedures.
At the time of the Challenger accident, the lack of spare parts caused a degree of cannibalization (i.e., the removal of a part from one Orbiter to satisfy a need for a spare part on another Orbiter), which was the highest in the history of the Shuttle program and which was a threat to flight schedule and flight safety. Excessive cannibalization leads to multiple installations, retesting, added documentation, delayed access to parts, and increased damage potential. As a result, cannibalization contributes directly to excessive overtime.
There is no clear evidence whether or not greater involvement of the development contractors would improve Shuttle operations. Recommendations
Because of the serious quality and safety concerns surrounding the contract, NASA should conduct a careful review of Shuttle processing, the SPC contract, and the relationship of flight hardware contractors and report its findings, recommendations, and proposed contract modifications to the Committee. NASA's reexam- ination should include a comparison of efficiency and safety under the SPC versus efficiency and safety during pre-1983 Shuttle processing operations, which heavily involved the development contractors.
NASA should examine the issues of spares availability and cannibalization and provide the Congress with a management and budgetar plan for correcting previous logistical problems.
NAJA should stop routine cannibalization and develop guilde- lines (including appropriate control and review procedures and roles for the SR&QA office) governing permissible cannibalization.
The Committee recommends that NASA provide its re-invig- orated safety office with the authority to enforce scheduling that leads to safe overtime rates.

¶b. Pressures on Shuttle Operations Issue

¶Was NASA under pressure to fly more flights? How did this pressure originate? Will it recur?

¶Findings

The Congress and the Executive Branch jointly developed the policy that the Space Shuttle should, in a reliable fashion and at an internationally competitive cost, provide for most of the Free World's space launch needs. By and large, both Branches failed to appreciate the impact that this policy was having on the operational safety of the system.
NASA was under internal and external pressure to build its Shuttle flight rate to 24 per year, primarily to reduce costs per flight, but also to demonstrate and achieve routine access to space. NASA has never achieved its planned flight rate. Recommendations
NASA must not attempt to achieve a flight rate beyond that which (1)can be supported by the budget and staff resources available; and (2) is consistent with the technical maturity of the Shuttle and the flexibility desired and needed in scheduling payloads. Management should ensure efficient use of resources but should not impose a flight rate on the system.
Once operation of the Space Shuttle resumes, the Committee should maintain a close and continuous oversight of Shuttle flight rate, planning, and operations. The Committee should ensure both that flight rate flows logically from the resources provided and that flight safety is not compromised beyond acceptable limits.

¶c. Impact of Pressures on Shuttle Operations Issue

¶Did operating pressures adversely affect the safety of the Shuttle program? Findings

The pressure on NASA to achieve planned flight rates was so pervasive that it undoubtedly adversely affected attitudes regarding safety.
The pressure to achieve planned flight rates was compressing mission preparation as earlier missions were delayed due to unforeseen problems. Had the accident not occurred there would soon have been a collision between planned launch dates and mission preparation needs which could not have been met by overtime, cannibalization, or other undesirable practices. Operating pressures were causing an increase in unsafe practices.
The schedule of payloads planned to fly on the Shuttle (the manifest) was frequently changed. Each change rippled through the NASA Shuttle organization and through the manifest and, especially if made shortly before launch, would increase the demands on personnel and resources in order to achieve the planned flight rate.
The Space Shuttle has not yet reached a level of maturity which could be called operational as that term is used in either the airline industry or the military. Each Shuttle flight is fundamentally unique, and requires unique preparations. Therefore, small changes in a mission can cause significant perturbations of mission planning and crew training.

¶Recommendations

The new Associate Administrator for Safety, Reliability and Quality Assurance must assure that any pressures to increase the Shuttle flight rate do not adversely influence mission preparation. The Associate Administrator must have the authority not only to stop a particular flight, e.g., at a Flight Readiness Review, but to stop the whole mission planning process if necessary.
Where appropriate, NASA should take steps to make the mission planning process standard and routine to reduce the time and resources needed to plan a mission. Before requesting more resources for the existing mission planning process (manpower, facilities, equipment), NASA should identify ways to improve the process.

¶d. Other Safety Issues Issue 1

¶What is the criticality of landing safety associated with programmed and abort landing sites and their local characteristics? Findings

The Committee finds that many of the normal and abort landing safety problems will be alleviated when the Rogers Commission's and the Committee's (Section VI. A. 1. b., this report) recommendations to upgrade the landing gear system are implemented. When the landing gear system is understood, straightforward calculations and operational rules will determine acceptable runway dimensions and conditions.
The Committee found no reason to fault NASA's current procedure on launch constraints based upon operational judgment and conservative rules on local conditions at planned abort and landing sites. However, since an obvious finding is that the Orbiter is a developmental system, it is axiomatic that unanticipated "dicey" circumstances will arise.
It was found that for the least landing gear system stress, runway preference is Edwards Air Force Base (EAFB) (concrete), KSC, and Rogers Dry Lake (EAFB "lake bed") in that order. No reason was found to invalidate the KSC runway design. The reasons for the "dry" course surface still prevail over concern about wear on tires designed for one landing. Additional constraints at KSC because of lesser lateral stabilized overrun area may be needed to bring its safety to the level of the EAFB runway.
The NASA Landing Safety Team's proposal to provide standard landing aids and arresting barriers at all sites and their emphasis on runway surface characteristics for repetitive tire use takes on a new dimension that is in addition to the Rogers Commission's recommendations.
Weather, by far, is the most significant factor governing operational decisions, Orbiter damage, and landing safety. The constraint is simply that acceptable weather must be forecast with confidence within the time frame needed. Ultra-conservative rules prevail because of the predictable unpredictability of Cape weather. New and innovative local weather analysis and forecasting research is a high priority. The African Coast and southwestern United States sites enjoy more stable and predictable weather. Recommendations

¶The first priority to achieve an acceptable degree of landing safety and to have a sensible base to work from for improvement is to implement the recommendations of the Rogers Commission and the Committee on the landing gear system improvements to attain an operational capability. Then:

¶Instrument the system, and schedule all landings at Edwards runway for systematic concurrent testing until the landing gear system is understood.

Write a clean sheet set of rules based on results. Determine the risk of accident with the B-747 Shuttle Carrier Aircraft (SCA) and its impact upon the Shuttle program.

¶Extend every reasonable effort to assure a mission planning process to minimize the need for abort site landings.

¶Reevaluate and determine the degree of risk acceptable at abort site landings and bring abort site capability up to meet that risk level.

¶Expand astronaut matched team flight landing practice to cover all known exigencies. Propose additional training craft if necessary.

¶Join in a venture with NOAA to invent new technology and techniques to learn new ways to understand the dynamics of

¶Cape Kennedy weather phenomena to supplant current inadequacy to forecast two hours ahead. Issue 2

¶Has adequate provision been made for crew safety in case of inflight emergencies? That is, has adequate provision been given to launch abort options and crew escape options? Findings

Crew escape options were considered when the Shuttle was originally designed and the basic situation has not changed. Many initially attractive options do not significantly reduce risk to the crew either because they may not reduce exposure to the principal hazards or because they add risks of their own.
A crew escape system for use in controlled gliding flight might be feasible and worthwhile.
Crew escape during the ascent phase appears infeasible.
Launch abort during SRB burn appears impossible but it may be possible to decrease risk to the crew after SRB separation, primarily through mission design. Recommendation

¶NASA should continue to respond to the recommendations of the Rogers Commission regarding (i) crew escape during controlled gliding flight and (ii) increasing the possibility of successful emergency runway landings. NASA should reexamine all crew survival options and report to the Committee on its findings.

Hardware Development and Production

MANAGEMENT ISSUES