The Director of Marshall's Shuttle Projects Office may have

¶violated NASA's Flight Readiness Review policy directive by failing to report the results of the January 27 teleconference to the Associ- ate Administrator for Space Flight.

The decision of the STS Program Manager to launch despite the uncertainty represented by ice on the Fixed Service Structure was not a prudent effort to mitigate avoidable risks to the Shuttle.
The Launch Director failed to place safety paramount in eval- uating the launch readiness of STS 51-L. 8. No launch should have been permitted until ice was cleared from the platform leading to the pad escape system.
Ice Team personnel and Rockwell contractors properly con- veyed their inability to predict the post-ignition behavior of ice.
Post-flight analysis indicated that ice did not exhibit the be- havior predicted by analysis, and that ice traversed a distance suf- ficient to strike the Shuttle during lift-off.
Failure to enforce a clear requirement for definite readiness statements contributed to failures in communication between NASA and its contractors during launch preparations. Discussion

¶Significant in the loss of Challenger was NASA's decision to launch the Shuttle on January 28. The Rogers Commission and the Committee investigation found sufficient evidence to indicate that STS 51-L should not have been allowed to lift off until a number of problems had been corrected. The Committee has examined docu- mentation made available to the Rogers Commission and has re- viewed recordings made of conversations among personnel in KSC Firing Rooms on January 27 and 28 in developing its analysis.

¶What seems evident in the Committee's review of this material is that clear indications existed on the morning of January 28 argu- ing that a launch of the Shuttle vehicle would not be a prudent de- cision. Significantly greater risks were present for this launch at- tempt than were usually found during a launch of the Shuttle. De- spite these signals, some of which reached officials with the author- ity to delay the launch, STS 51-L was allowed to proceed. The Committee is disturbed that expected safeguards in the launch de- cision process failed to operate.

¶Specifically, this section examines the inability of the Flight Readiness Review procedure to compensate for poor technical analysis in preparing the Shuttle system for launch. Also, the efforts initiated by Thiokol engineers to delay the launch until SRM seal temperatures had risen were unsuccessful, nor were their argu- ments conveyed to the Associate Administrator for Space Flight, as NASA policy apparently requires. Finally, the heavy ice on the pad Fixed Service Structure led NASA's ice team leader to recommend that the launch be scrubbed, but his objections were apparently never conveyed to the STS Program Manager. The Committee con- cludes that sufficient warning of the risks to STS 51-L was avail- able, and the launch therefore should not have occurred. Readers are directed to Section VIII-A of this report for a complete discus- sion of each of these areas.

¶NASA has developed a highly involved procedure to prepare a Shuttle mission for flight. Much of this preparation is discussed in Section VI-A.2.b. In the period immediately proceding a launch, project and program managers participate in a number of meetings that together are known as the Flight Readiness Review. In the case of the Solid Rocket Motor, the apparent cause of the accident, eight levels of review were required to certify the flight readiness of the STS 51-L hardware. (See Table I for date and scope of these reviews)

¶Flight Readiness Reviews employ the so-called "delta review" concept, meaning that the data presented only represents those ele- ments on the previous flight that fall outside the expected perform- ance of the hardware. The responsible project or program manager must then explain the failure to the satisfaction of the review board and describe the steps that have been taken to assure that the situation will not recur on the upcoming flight. In the case of STS 51-L, however, this concept permitted the SRM seal erosion problem to evade scrutiny. STS 61-C, the mission immediately pro- ceding 51-L, did not fly until halfway through the 51-L FRR cycle. Thus, there was no previous mission to obtain data from Only at the last stage of the cycle, at the L-1 review, did the Associate Ad- ministrator learn that the SRM seal erosion problem had been noted again. Mr. Mulloy's presentation characterized the situation as "within the experience base," according to Thiokol's Mr. McDon- ald.

¶The history of SRM seal erosion demonstrates the effect that faulty engineering analysis has on the Flight Readiness Review process. Thiokol and Marshall engineering personnel declared the seal erosion problem to be "acceptable," even though the seal design clearly recognized that the elastomeric O-ring seals were not designed to stand up to propellant gases during flight. Relying on a computer model of the situation and a limited battery of tests, Marshall continued to present the situation in Flight Readiness Re- views as "within the experience base;" that is, the deterioration in the seals was no worse than previous cases and thus no concern was warranted.

¶It is the conclusion of the Committee that the Flight Readiness Review operated as well as its design permitted in the case of STS- 51-L. See Section VI-B.l.b.3. It seems clear that the process cannot compensate for faulty engineering judgement among participants. Had the engineering analysis led Marshall to a different conclusion about the severity of the SRM seal erosion problem, the system would have reacted to these concerns long before the 51-L Flight Readiness Review.

¶If the Flight Readiness Review process did not fail, however, why was STS 51-L launched? The Committee is seriously concerned by the fact that information indicating that the SRM seals might fail became available in time to delay the launch, and yet these con- cerns were overridden. Engineers from Marshall and Thiokol argued for hours on the night of January 27 regarding the effect of temperature on the performance of the seals. In the end, Thiokol managers chose to recommend that the launch proceed over the ob- jections of their engineering staff.

¶In hindsight, it is unfortunate that Thiokol engineers did not present their objections in terms of developing a new launch commit criteria on the SRM joint seal temperature. Doing so would have required that the STS Program Manager would have had to listen to the engineers' presentation. It would also have guaranteed that a more rigorous analysis of the situation would have been forthcoming, simply to explain why the situation had been allowed to continue for so long. Even so, the Committee's investigation indi- cates that these discussions should have been brought directly to the attention of the Associate Administrator for Space Flight by Marshall's Shuttle Project Office Director. The Committee's inves- tigation also questions whether doing so would have altered the de- cision made on January 28. (See Section VI-B.l.b.4)

¶The question remains: Should the engineering concerns, as ex- pressed in the pre-launch teleconference, have been sufficient to stop the launch? The Committee concludes the answer is yes. Thio- kol's recognized expert on SRM seals had evidence he believed con- clusive and sufficient. His opinion, in the absence of evidence to the contrary, should have been accepted until such time as better information became available.

¶Finally, the Committee examined the taped conversations among NASA and Rockwell personnel discussing the ice that covered the pad's Fixed Service Structure on January 28. Because the tempera- ture dropped below freezing, NASA had permitted critical water systems on the pad to run during the night. The pad drainage system could not handle the water flow, and allowed water to spill out onto the gantry platforms and freeze.

¶NASA personnel were sent to the pad to examine the situation and determine whether the situation posed a threat to the Shuttle. What they found was described by Rockwell personnel as "some- thing out of Dr. Zhivago." Icicles hung from platforms and hand- rails, and could be easily broken off. Sheets of ice covered the gantry platforms, including the platform across which the crew would have to run if it became necessary to use the pad escape system. The ice team leader indicated that he felt the situation was a distinct hazard to the Orbiter thermal protection system, since Main Engine ignition would likely release a great deal of ice debris. Blown by the wind or sucked up by the engines and boost- ers, the ice could inflict damage on the delicate silica titles that made up the Orbiter heat shield. Asked for his opinion, the ice team leader recommended that the launch be scrubbed until the ice had been removed from the gantry.

¶Rockwell personnel in Downey, California, expressed similar con- cerns about the situation after seeing the pad on television. They attempted to determine what would happen to the ice by use of computer modelling, but were not satisfied with the result. Rock- well's chief engineer finally concluded that the situation was little better than "Russian roulette." The company's liaison at KSC noted that the situation was much worse than the threat from ice in the liquid oxygen vent arm, which NASA considered a definite threat to the Orbiter. However, the STS manager, relying on a n analysis by engineers at KSC and JSC (using t h e same model Rock- well found inadequate), decided to launch.

¶As a whole, the Committee's review of the decision to launch STS 51-L on January 28 indicates a number of questionable prac- tices. It is not clear to the Committee why so many warnings went unheeded by NASA personnel that morning. What is certain, how- ever, is that the Associate Administrator for Space Flight and the Associate Administrator for Safety, Reliability and Quality Assur- ance should restore a more conservative set of launch rules prior to resuming flights of the Space Transportation System. Issue 2

¶Should firing room personnel be allowed to waive launch commit criteria or equipment redlines during a launch countdown without a well-developed technical reason for doing so? Finding

¶NASA's ma:! gement waived its own launch commit criteria on January 28, 1986, without a valid technical reason for doing so. Discussion

¶Conversations obtained from the Operational Intercommunica- tion System (OIS), used by the launch team during Shuttle count- downs, indicates that launch commit criteria were waived without sufficient technical justification on January 27 and 28. The Com- mittee reviewed tapes and transcripts which indicate that engi- neering personnel wrote a waiver for launch commit criteria on the External Tank nose cone temperatures that justified using lower temperatures on the basis of a backup procedure that was invalid.

¶Should the temperature sensors in the ET nose cone fail, accord- ing to Launch Commit Criteria 5.1-4, a secondary procedure corre- lating data obtained from telemetry channels with a previously de- rived curve could be substituted. The curve, however, was limited to a n ambient temperature range of 40-99 degrees Fahrenheit. Am- bient temperatures were outside this range during the countdown, meaning that the backup procedure could not be used. According to the Launch Commit Criteria, exceeding the lower temperature limit could cause "inaccurate ullage pressure readings." Since these pressure readings might be significant in operation of the Shuttle's main engines, inaccuracies might have threatened the safety of the mission. During flight, pressure in the fuel tanks for the main engines is maintained by bleeding off excess gas from the main engine heat exchangers and circulating it back into the Ex- ternal Tank. Misreading the pressure might cause the Orbiter genera1 purpose computers to over- or underpressurize the tanks and disrupt fuel flow to the engines.

¶Also, in discussion with Thiokol personnel during the latter stages of preparing this report, the Committee learned that liquid hydrogen remained in the External Tank throughout the night of January 27. Notwithstanding the effect this had on heat transfer through the aft attachment strut (see Section VII on casing joint design), this indicates that criteria requiring a n eight-hour period between tanking cycles may have been violated. This is significant in that, had the tanking cycles been carried out as required, launch of STS 51-L would have taken place in the afternoon of January 28 or the next day. The Committee has not confirmed this possibility.

RETRIEVAL, TRANSPORTATION, A N D REFURBISHMENT

¶Issue

¶Were the motor casings used on STS 51-L damaged as a result of the retrieval, transportation and refurbishment operations follow- ing previous launches? Finding

¶There was no evidence of damage to the casings or joint due to prior use or preparation for reuse. Discussion

¶The aft field joint on Flight 51-L was between two casings that were used previously on STS 51-C. After appioximately two min- utes of burn-time during the launch operation, the Solid Rocket Boosters are separated from the External Tank, at which time they fall toward the ocean for a considerable distance. Before impact, parachutes are deployed from the Solid Rocket Boosters to slow their decent and minimize impact forces. The Solid Rocket Boosters strike the ocean at a speed of approximately 60 miles per hour (ver- tical speed component). (There has been no evidence that the cas- ings are distorted by impacting the ocean since the impact loads are low and the cases are still assembled at this point.) The para- chutes and boosters are retrieved by divers a t sea and both Solid Rocket Boosters are towed back to the Cape by ships. They are towed into a special dock, lifted in slings, conveyed to a wash rack and completely washed down to remove salt water. The casings are made of high carbon steel which is very susceptible to corrosion. The casings are then disassembled, given a visual inspection, and shipped back to Utah for refurbishment. At a plant in Clearfield they are further cleaned and "shot with glass beads" to assure that all foreign contaminants have been removed. The cases are then in- spected to determine the dimensions of tang and clevis and for cracking. Inspection for cracks is performed by using a magnetic flux technique. The procedure calls for a test whereby cracks must be of such a minimum size as to be able to withstand four more flight uses without failure. The casings are then subjected to a hy- droburst test where they are pressure tested with a mixture of oil and water, to assure sufficient strength to withstand propellant pressure during flight. The hydroburst test i s conducted at 1.1 times the maximum expected operating pressure (MEOP). This gives assurance that the strength can accommodate 10 percent more load than the casings will experience in use. There was no indication that there had been any damage to the casings from Flight 51-C.