SUMMARY OF LAUNCH OPERATIONS

¶Issue 1

¶How was the decision to launch STS 51-L arrived at and why was it wrong? Findings

The Flight Readiness Review for STS 51-L was conducted in accordance with established procedure.

The decision to launch STS 51-L was based on a faulty engineering analysis of the SRM field joint seal behavior.
Compounding this erroneous analysis were serious ongoing weaknesses in the Shuttle Safety, Reliability, and Quality Assurance program which had failed to exercise control over the problem tracking systems, had not critiqued the engineering analysis advanced as an explanation of the SRM seal problem, and did not provide the independent perspective required by senior NASA managers at Flight Readiness Reviews.
The initial response of Marshall managers to the attempts of Thiokol engineers to raise the issue of temperature effects on the SRM seals caused Thiokol management to discount proper technical concerns and engineering judgement in their recommendation to launch.
The Director of Marshall's Shuttle Projects Office may have violated NASA's Flight Readiness Review policy directive by failing to report the results of the January 27 teleconference to the Associate Administrator for Space Flight.
The decision of the STS Program Manager to launch despite the uncertainty represented by ice on the Fixed Service Structure was not a prudent effort to mitigate avoidable risks to the Shuttle.
The Launch Director failed to place safety paramount in evaluating the launch readiness of STS 51-L. 8. No launch should have been permitted until ice was cleared from the platform leading to the pad escape system.
Ice Team personnel and Rockwell contractors properly conveyed their inability to predict the post-ignition behavior of ice.
Post-flight analysis indicated that ice did not exhibit the behavior predicted by analysis, and that ice traversed a distance sufficient to strike the Shuttle during lift-off.
Failure to enforce a clear requirement for definite readiness statements contributed to failures in communication between NASA and its contractors during launch preparations. Discussion

¶Significant in the loss of Challenger was NASA's decision to launch the Shuttle on January 28. The Rogers Commission and the Committee investigation found sufficient evidence to indicate that STS 51-L should not have been allowed to lift off until a number of problems had been corrected. The Committee has examined documentation made available to the Rogers Commission and has reviewed recordings made of conversations among personnel in KSC Firing Rooms on January 27 and 28 in developing its analysis.

¶What seems evident in the Committee's review of this material is that clear indications existed on the morning of January 28 argu- ing that a launch of the Shuttle vehicle would not be a prudent decision. Significantly greater risks were present for this launch attempt than were usually found during a launch of the Shuttle. Despite these signals, some of which reached officials with the authority to delay the launch, STS 51-L was allowed to proceed. The Committee is disturbed that expected safeguards in the launch decision process failed to operate.

¶Specifically, this section examines the inability of the Flight Readiness Review procedure to compensate for poor technical analysis in preparing the Shuttle system for launch. Also, the efforts initiated by Thiokol engineers to delay the launch until SRM seal temperatures had risen were unsuccessful, nor were their arguments conveyed to the Associate Administrator for Space Flight, as NASA policy apparently requires. Finally, the heavy ice on the pad Fixed Service Structure led NASA's ice team leader to recommend that the launch be scrubbed, but his objections were apparently never conveyed to the STS Program Manager. The Committee concludes that sufficient warning of the risks to STS 51-L was available, and the launch therefore should not have occurred. Readers are directed to Section VIII-A of this report for a complete discussion of each of these areas.

¶NASA has developed a highly involved procedure to prepare a Shuttle mission for flight. Much of this preparation is discussed in Section VI-A.2.b. In the period immediately proceding a launch, project and program managers participate in a number of meetings that together are known as the Flight Readiness Review. In the case of the Solid Rocket Motor, the apparent cause of the accident, eight levels of review were required to certify the flight readiness of the STS 51-L hardware. (See Table I for date and scope of these reviews)

¶Flight Readiness Reviews employ the so-called "delta review" concept, meaning that the data presented only represents those elements on the previous flight that fall outside the expected performance of the hardware. The responsible project or program manager must then explain the failure to the satisfaction of the review board and describe the steps that have been taken to assure that the situation will not recur on the upcoming flight. In the case of STS 51-L, however, this concept permitted the SRM seal erosion problem to evade scrutiny. STS 61-C, the mission immediately proceding 51-L, did not fly until halfway through the 51-L FRR cycle. Thus, there was no previous mission to obtain data from Only at the last stage of the cycle, at the L-1 review, did the Associate Administrator learn that the SRM seal erosion problem had been noted again. Mr. Mulloy's presentation characterized the situation as "within the experience base," according to Thiokol's Mr. McDonald.

¶The history of SRM seal erosion demonstrates the effect that faulty engineering analysis has on the Flight Readiness Review process. Thiokol and Marshall engineering personnel declared the seal erosion problem to be "acceptable," even though the seal design clearly recognized that the elastomeric O-ring seals were not designed to stand up to propellant gases during flight. Relying on a computer model of the situation and a limited battery of tests, Marshall continued to present the situation in Flight Readiness Reviews as "within the experience base;" that is, the deterioration in the seals was no worse than previous cases and thus no concern was warranted.

¶It is the conclusion of the Committee that the Flight Readiness Review operated as well as its design permitted in the case of STS- 51-L. See Section VI-B.l.b.3. It seems clear that the process cannot compensate for faulty engineering judgement among participants. Had the engineering analysis led Marshall to a different conclusion about the severity of the SRM seal erosion problem, the system would have reacted to these concerns long before the 51-L Flight Readiness Review.

¶If the Flight Readiness Review process did not fail, however, why was STS 51-L launched? The Committee is seriously concerned by the fact that information indicating that the SRM seals might fail became available in time to delay the launch, and yet these concerns were overridden. Engineers from Marshall and Thiokol argued for hours on the night of January 27 regarding the effect of temperature on the performance of the seals. In the end, Thiokol managers chose to recommend that the launch proceed over the objections of their engineering staff.

¶In hindsight, it is unfortunate that Thiokol engineers did not present their objections in terms of developing a new launch commit criteria on the SRM joint seal temperature. Doing so would have required that the STS Program Manager would have had to listen to the engineers' presentation. It would also have guaranteed that a more rigorous analysis of the situation would have been forthcoming, simply to explain why the situation had been allowed to continue for so long. Even so, the Committee's investigation indicates that these discussions should have been brought directly to the attention of the Associate Administrator for Space Flight by Marshall's Shuttle Project Office Director. The Committee's investigation also questions whether doing so would have altered the decision made on January 28. (See Section VI-B.l.b.4)

¶The question remains: Should the engineering concerns, as expressed in the pre-launch teleconference, have been sufficient to stop the launch? The Committee concludes the answer is yes. Thiokol's recognized expert on SRM seals had evidence he believed con- clusive and sufficient. His opinion, in the absence of evidence to the contrary, should have been accepted until such time as better information became available.

¶Finally, the Committee examined the taped conversations among NASA and Rockwell personnel discussing the ice that covered the pad's Fixed Service Structure on January 28. Because the temperature dropped below freezing, NASA had permitted critical water systems on the pad to run during the night. The pad drainage system could not handle the water flow, and allowed water to spill out onto the gantry platforms and freeze.

¶NASA personnel were sent to the pad to examine the situation and determine whether the situation posed a threat to the Shuttle. What they found was described by Rockwell personnel as "something out of Dr. Zhivago." Icicles hung from platforms and handrails, and could be easily broken off. Sheets of ice covered the gantry platforms, including the platform across which the crew would have to run if it became necessary to use the pad escape system. The ice team leader indicated that he felt the situation was a distinct hazard to the Orbiter thermal protection system, since Main Engine ignition would likely release a great deal of ice debris. Blown by the wind or sucked up by the engines and boosters, the ice could inflict damage on the delicate silica titles that made up the Orbiter heat shield. Asked for his opinion, the ice team leader recommended that the launch be scrubbed until the ice had been removed from the gantry.

¶Rockwell personnel in Downey, California, expressed similar concerns about the situation after seeing the pad on television. They attempted to determine what would happen to the ice by use of computer modelling, but were not satisfied with the result. Rockwell's chief engineer finally concluded that the situation was little better than "Russian roulette." The company's liaison at KSC noted that the situation was much worse than the threat from ice in the liquid oxygen vent arm, which NASA considered a definite threat to the Orbiter. However, the STS manager, relying on a n analysis by engineers at KSC and JSC (using t h e same model Rockwell found inadequate), decided to launch.

¶As a whole, the Committee's review of the decision to launch STS 51-L on January 28 indicates a number of questionable practices. It is not clear to the Committee why so many warnings went unheeded by NASA personnel that morning. What is certain, however, is that the Associate Administrator for Space Flight and the Associate Administrator for Safety, Reliability and Quality Assurance should restore a more conservative set of launch rules prior to resuming flights of the Space Transportation System. Issue 2

¶Should firing room personnel be allowed to waive launch commit criteria or equipment redlines during a launch countdown without a well-developed technical reason for doing so? Finding

¶NASA's ma:! gement waived its own launch commit criteria on January 28, 1986, without a valid technical reason for doing so. Discussion

¶Conversations obtained from the Operational Intercommunication System (OIS), used by the launch team during Shuttle count- downs, indicates that launch commit criteria were waived without sufficient technical justification on January 27 and 28. The Committee reviewed tapes and transcripts which indicate that engineering personnel wrote a waiver for launch commit criteria on the External Tank nose cone temperatures that justified using lower temperatures on the basis of a backup procedure that was invalid.

¶Should the temperature sensors in the ET nose cone fail, according to Launch Commit Criteria 5.1-4, a secondary procedure corre- lating data obtained from telemetry channels with a previously derived curve could be substituted. The curve, however, was limited to a n ambient temperature range of 40-99 degrees Fahrenheit. Ambient temperatures were outside this range during the countdown, meaning that the backup procedure could not be used. According to the Launch Commit Criteria, exceeding the lower temperature limit could cause "inaccurate ullage pressure readings." Since these pressure readings might be significant in operation of the Shuttle's main engines, inaccuracies might have threatened the safety of the mission. During flight, pressure in the fuel tanks for the main engines is maintained by bleeding off excess gas from the main engine heat exchangers and circulating it back into the External Tank. Misreading the pressure might cause the Orbiter genera1 purpose computers to over- or underpressurize the tanks and disrupt fuel flow to the engines.

¶Also, in discussion with Thiokol personnel during the latter stages of preparing this report, the Committee learned that liquid hydrogen remained in the External Tank throughout the night of January 27. Notwithstanding the effect this had on heat transfer through the aft attachment strut (see Section VII on casing joint design), this indicates that criteria requiring a n eight-hour period between tanking cycles may have been violated. This is significant in that, had the tanking cycles been carried out as required, launch of STS 51-L would have taken place in the afternoon of January 28 or the next day. The Committee has not confirmed this possibility.

RETRIEVAL, TRANSPORTATION, A N D REFURBISHMENT

¶Issue

¶Were the motor casings used on STS 51-L damaged as a result of the retrieval, transportation and refurbishment operations following previous launches? Finding

¶There was no evidence of damage to the casings or joint due to prior use or preparation for reuse. Discussion

¶The aft field joint on Flight 51-L was between two casings that were used previously on STS 51-C. After appioximately two minutes of burn-time during the launch operation, the Solid Rocket Boosters are separated from the External Tank, at which time they fall toward the ocean for a considerable distance. Before impact, parachutes are deployed from the Solid Rocket Boosters to slow their decent and minimize impact forces. The Solid Rocket Boosters strike the ocean at a speed of approximately 60 miles per hour (vertical speed component). (There has been no evidence that the casings are distorted by impacting the ocean since the impact loads are low and the cases are still assembled at this point.) The parachutes and boosters are retrieved by divers a t sea and both Solid Rocket Boosters are towed back to the Cape by ships. They are towed into a special dock, lifted in slings, conveyed to a wash rack and completely washed down to remove salt water. The casings are made of high carbon steel which is very susceptible to corrosion. The casings are then disassembled, given a visual inspection, and shipped back to Utah for refurbishment. At a plant in Clearfield they are further cleaned and "shot with glass beads" to assure that all foreign contaminants have been removed. The cases are then inspected to determine the dimensions of tang and clevis and for cracking. Inspection for cracks is performed by using a magnetic flux technique. The procedure calls for a test whereby cracks must be of such a minimum size as to be able to withstand four more flight uses without failure. The casings are then subjected to a hydroburst test where they are pressure tested with a mixture of oil and water, to assure sufficient strength to withstand propellant pressure during flight. The hydroburst test i s conducted at 1.1 times the maximum expected operating pressure (MEOP). This gives assurance that the strength can accommodate 10 percent more load than the casings will experience in use. There was no indication that there had been any damage to the casings from Flight 51-C.