6.1 A History of Foam Anomalies

¶The shedding of External Tank foam – the physical cause of the Columbia accident – had a long history. Damage caused by debris has occurred on every Space Shuttle flight, and most missions have had insulating foam shed during ascent. This raises an obvious question: Why did NASA continue

¶flying the Shuttle with a known problem that violated design requirements? It would seem that the longer the Shuttle Program allowed debris to continue striking the Orbiters, the more opportunity existed to detect the serious threat it posed. But this is not what happened. Although engineers have made numerous changes in foam design and application in the 25 years that the External Tank has been in production, the problem of foam-shedding has not been solved, nor has the Orbiterʼs ability to tolerate impacts from foam or other debris been significantly improved.

¶The Need for Foam Insulation

¶The External Tank contains liquid oxygen and hydrogen propellants stored at minus 297 and minus 423 degrees Fahrenheit. Were the super-cold External Tank not sufficiently insulated from the warm air, its liquid propellants would boil, and atmospheric nitrogen and water vapor would condense and form thick layers of ice on its surface. Upon launch, the ice could break off and damage the Orbiter. (See Chapter 3.)

¶To prevent this from happening, large areas of the External Tank are machine-sprayed with one or two inches of foam, while specific fixtures, such as the bipod ramps, are hand-sculpted with thicker coats. Most of these insulating materials fall into a general category of "foam," and are outwardly similar to hardware store-sprayable foam insulation. The problem is that foam does not always stay where the External Tank manufacturer Lockheed Martin installs it. During flight, popcorn- to briefcase-size chunks detach from the External Tank.

¶Original Design Requirements

¶Early in the Space Shuttle Program, foam loss was considered a dangerous problem. Design engineers were extremely concerned about potential damage to the Orbiter and its fragile Thermal Protection System, parts of which are so vulnerable to impacts that lightly pressing a thumbnail into them leaves a mark. Because of these concerns, the baseline design requirements in the Shuttleʼs "Flight and Ground System Specification-Book 1, Requirements," precluded foam-shedding by the External Tank. Specifically:

122

¶3.2.1.2.14 Debris Prevention: The Space Shuttle System, including the ground systems, shall be designed to preclude the shedding of ice and/or other debris from the Shuttle elements during prelaunch and flight operations that would jeopardize the flight crew, vehicle, mission success, or would adversely impact turnaround operations.¹¹ "Space Shuttle Program Description and Requirements Baseline," NSTS- 07700, Volume X, Book 1. CAIB document CTF028-32643667.

¶3.2.1.1.17 External Tank Debris Limits: No debris shall emanate from the critical zone of the External

¶Tank on the launch pad or during ascent except for such material which may result from normal thermal protection system recession due to ascent heating.²² "External Tank End Item (CEI) Specification – Part 1," CPT01M09A, contract NAS8 –30300, April 9, 1980, WBS 1.6.1.2 and 1.6.2.2.

¶The assumption that only tiny pieces of debris would strike the Orbiter was also built into original design requirements, which specified that the Thermal Protection System (the tiles and Reinforced Carbon-Carbon, or RCC, panels) would be built to withstand impacts with a kinetic energy less than 0.006 foot-pounds. Such a small tolerance leaves the Orbiter vulnerable to strikes from birds, ice, launch pad debris, and pieces of foam.

¶Despite the design requirement that the External Tank shed no debris, and that the Orbiter not be subjected to any significant debris hits, Columbia sustained damage from debris strikes on its inaugural 1981 flight. More than 300 tiles had to be replaced.³³ "STS-1 Orbiter Final Mission Report," JSC-17378, August 1981, p. 85. Engineers stated that had they known in ad- vance that the External Tank "was going to produce the debris shower that occurred" during launch, "they would have had a difficult time clearing Columbia for flight."⁴⁴ Discussed in Craig Covault, "Investigators Studying Shuttle Tiles, Aviation Week & Space Technology, May 11, 1981, pg. 40.

¶Discussion of Foam Strikes Prior to the Rogers Commission

¶Foam strikes were a topic of management concern at the time of the Challenger accident. In fact, during the Rogers Commission accident investigation, Shuttle Program Manager Arnold Aldrich cited a contractorʼs concerns about foam shedding to illustrate how well the Shuttle Program manages risk:

¶On a series of four or five external tanks, the thermal insulation around the inner tank … had large divots of insulation coming off and impacting the Orbiter.

¶We found significant amount of damage to one Orbiter after a flight and … on the subsequent flight we had a camera in the equivalent of the wheel well, which took a picture of the tank after separation, and we determined that this was in fact the cause of the damage. At that time, we wanted to be able to proceed with the launch program if it was acceptable … so we undertook discussions of what would be acceptable in terms of potential field repairs, and during those discussions, Rockwell was very conservative because, rightly, damage to the

¶Orbiter TPS [Thermal Protection System] is damage to the Orbiter system, and it has a very stringent environment to experience during the re-entry phase.

¶Aldrich described the pieces of foam as "… half a foot square or a foot by half a foot, and some of them much smaller and localized to a specific area, but fairly high up on the tank. So they had a good shot at the Orbiter underbelly, and this is where we had the damage."⁵⁵ Report of the Presidential Commission on the Space Shuttle Challenger Accident, Volume V, 1986, pp. 1028-9, hearing section pp. 1845-1849.

¶Continuing Foam Loss

¶Despite the high level of concern after STS-1 and through the Challenger accident, foam continued to separate from the External Tank. Photographic evidence of foam shedding exists for 65 of the 79 missions for which imagery is available. Of the 34 missions for which there are no imagery, 8 missions where foam loss is not seen in the imagery, and 6 missions where imagery is inconclusive, foam loss can be inferred from the number of divots on the Orbiterʼs lower surfaces. Over the life of the Space Shuttle Program, Orbiters have returned with an average of 143 divots in the upper and lower surfaces of the Thermal Protection System tiles, with 31 divots averaging over an inch in one dimension.⁶⁶ "Orbiter Vehicle End Item Specification for the Space Shuttle System, Part 1, Performance and Design Requirements," contract NAS9-20000, November 7, 2002. CAIB documents CAB006-06440645 and CAB033- 20242971. (The Orbitersʼ lower surfaces have an average of 101 hits, 23 of which are larger than an inch in diameter.) Though the Orbiter is also struck by ice and pieces of launch-pad hardware during launch, by micrometeoroids and orbital debris in space, and by runway debris during landing, the Board concludes that foam is likely responsible for most debris hits.

¶With each successful landing, it appears that NASA engineers and managers increasingly regarded the foam-shedding as inevitable, and as either unlikely to jeopardize safety or simply an acceptable risk. The distinction between foam loss and debris events also appears to have become blurred. NASA and contractor personnel came to view foam strikes not as a safety of flight issue, but rather a simple maintenance, or "turnaround" issue. In Flight Readiness Review documentation, Mission Management Team minutes, In- Flight Anomaly disposition reports, and elsewhere, what was originally considered a serious threat to the Orbiter

DEFINITIONS

¶In Family: A reportable problem that was previously experienced, analyzed, and understood. Out of limits performance or discrepancies that have been previously experienced may be considered as in-family when specifically approved by the Space Shuttle Program or design project.⁸⁸ Ibid.

¶Out of Family: Operation or performance outside the expected performance range for a given parameter or which has not previously been experienced.⁹⁹ Ibid.

¶Accepted Risk: The threat associated with a specific circumstance is known and understood, cannot be completely eliminated, and the circumstance(s) producing that threat is considered unlikely to reoccur. Hence, the circumstance is fully known and is considered a tolerable threat to the conduct of a Shuttle mission.

¶No Safety-of-Flight-Issue: The threat associated with a specific circumstance is known and understood and does not pose a threat to the crew and/or vehicle.

123

¶Flight STS-7 STS-32R STS-50

ET # 06 25 — 45

¶ET Type SWT LWT LWT

¶Orbiter Challenger Columbia Columbia

¶Inclination 28.45 deg 28.45 deg 28.45 deg

¶Launch Date 06/18/83 01/09/90 06/25/92

¶Launch Time 07:33:00 07:35:00 12:12:23 (Local) AM EDT AM EST PM EDT

¶Figure 6.1-1. There have been seven known cases where the left External Tank bipod ramp foam has come off in flight.

¶came to be treated as "in-family,"⁷⁷ "Problem Reporting and Corrective Action System Requirements," NSTS- 08126, Revision H, November 22, 2000, Appendix C, Definitions, In Family. CAIB document CTF044-28652894. a reportable problem that was within the known experience base, was believed to be understood, and was not regarded as a safety-of-flight issue.

¶Bipod Ramp Foam Loss Events

¶Chunks of foam from the External Tankʼs forward bipod attachment, which connects the Orbiter to the External Tank, are some of the largest pieces of debris that have struck the Orbiter. To place the foam loss from STS-107 in a broader context, the Board examined every known instance of foam-shedding from this area. Foam loss from the left bipod ramp (called the –Y ramp in NASA parlance) has been confirmed by imagery on 7 of the 113 missions flown. However, only on 72 of these missions was available imagery of sufficient quality to determine left bipod ramp foam loss. Therefore, foam loss from the left bipod area occurred on approximately 10 percent of flights (seven events out of 72 imaged flights). On the 66 flights that imagery was available for the right bipod area, foam loss was never observed. NASA could not explain why only the left bipod experienced foam loss. (See Figure 6.1-1.)

¶Figure 6.1-2. The first known instance of bipod ramp shedding occurred on STS-7 which was launched on June 18, 1983.

¶STS-52 STS-62 STS-112 STS-107

55 62 115 — 93

LWT LWT SLWT LWT

¶Columbia Columbia Atlantis Columbia

¶28.45 deg 39.0 deg 51.6 deg 39.0 deg

¶10/22/92 03/04/94 10/07/02 01/16/03

¶1:09:39 08:53:00 3:46:00 10:39:00

PM EDT AM EST PM EDT AM EDT

¶The first known bipod ramp foam loss occurred during STS-7, Challengerʼs second mission (see Figure 6.1-2). Images taken after External Tank separation revealed that a 19- by 12-inch piece of the left bipod ramp was missing, and that the External Tank had some 25 shallow divots in the foam just forward of the bipod struts and another 40 divots in the foam covering the lower External Tank. After the mission was completed, the Program Requirements Control Board cited the foam loss as an In-Flight Anomaly. Citing an event as an In-Flight Anomaly means that before the next launch, a specific NASA organization must resolve the problem or prove that it does not threaten the safety of the vehicle or crew.¹¹¹¹ NSTS-08126, Paragraph 3.4, Additional Requirements for In-Flight Anomaly (IFA) Reporting.

¶At the Flight Readiness Review for the next mission, Orbiter Project management reported that, based on the completion of repairs to the Orbiter Thermal Protection System, the bipod ramp foam loss In-Flight Anomaly was resolved, or "closed." However, although the closure documents detailed the repairs made to the Orbiter, neither the Certificate of Flight Readiness documentation nor the Flight Readiness Review documentation referenced correcting the cause of the damage – the shedding of foam.

¶Figure 6.1-3. Only three months before the final launch of Columbia, the bipod ramp foam had come off during STS-112.

124

¶impact damage was shallow, the tile loss was not a result

UMBILICAL CAMERAS AND THE STATISTICS OF BIPOD RAMP LOSS

¶Over the course of the 113 Space Shuttle missions, the left bipod ramp has shed significant pieces of foam at least seven times. (Foam-shedding from the right bipod ramp has never been confirmed. The right bipod ramp may be less subject to foam shedding because it is partially shielded from aerodynamic forces by the External Tankʼs liquid oxygen line.) The fact that five of these left bipod shedding events occurred on missions flown by Columbia sparked considerable Board debate. Although initially this appeared to be a improbable coincidence that would have caused the Board to fault NASA for improper trend analysis and lack of engineering curiosity, on closer inspection, the Board concluded that this "coincidence" is probably the result of a bias in the sample of known bipod foam-shedding. Before the Challenger accident, only

¶Challenger and Columbia carried umbilical well cameras that imaged the External Tank after separation, so there are more images of Columbia than of the other Orbiters.10

¶The bipod was imaged 26 of 28 of Columbiaʼs missions; in contrast, Challenger had 7 of 10, Discovery had only 14 of

¶30, Atlantis only 14 of 26, and Endeavour 12 of 19.

¶The second bipod ramp foam loss occurred during STS-32R, Columbiaʼs ninth flight, on January 9, 1990. A post-mission review of STS-32R photography revealed five divots in the intertank foam ranging from 6 to 28 inches in diameter, the largest of which extended into the left bipod ramp foam. A post-mission inspection of the lower surface of the Orbiter revealed 111 hits, 13 of which were one inch or greater in one dimension. An In-Flight Anomaly assigned to the External Tank Project was closed out at the Flight Readiness Review for the next mission, STS-36, on the basis that there may have been local voids in the foam bipod ramp where it attached to the metal skin of the External Tank. To address the foam loss, NASA engineers poked small "vent holes" through the intertank foam to allow trapped gases to escape voids in the foam where they otherwise might build up pressure and cause the foam to pop off. However, NASA is still studying this hypothesized mechanism of foam loss. Experiments conducted under the Boardʼs purview indicate that other mechanisms may be at work. (See "Foam Fracture Under Hydrostatic Pressure" in Chapter 3.) As discussed in Chapter 3, the Board notes that the persistent uncertainty about the causes of foam loss and potential Orbiter damage results from a lack of thorough hazard analysis and engineering attention.

¶The third bipod foam loss occurred on June 25, 1992, during the launch of Columbia on STS-50, when an approximately 26- by 10-inch piece separated from the left bipod ramp area. Post-mission inspection revealed a 9-inch by 4.5-inch by 0.5-inch divot in the tile, the largest area of tile damage in Shuttle history. The External Tank Project at Marshall Space Flight Center and the Integration Office at Johnson Space Center cited separate In-Flight Anomalies. The Integration Office closed out its In-Flight Anomaly two days before the next flight, STS-46, by deeming damage to the Thermal Protection System an "accepted flight risk."¹²¹² Integrated Hazard Analysis INTG 037, "Degraded Functioning of Orbiter TPS or Damage to the Windows Caused by SRB/ET Ablatives or Debonded ET or SRB TPS." In Integration Hazard Report 37, the Integration Office noted that the

¶of excessive aerodynamic loads, and the External Tank Thermal Protection System failure was the result of "inadequate venting."¹³¹³ Ibid. The External Tank Project closed out its In-Flight Anomaly with the rationale that foam loss during ascent was "not considered a flight or safety issue."¹⁴¹⁴ Ibid. Note the difference in how the each program addressed the foam-shedding problem: While the Integration Office deemed it an "accepted risk," the External Tank Project considered it "not a safety-of-flight issue." Hazard Report 37 would figure in the STS-113 Flight Readiness Review, where the crucial decision was made to continue flying with the foam-loss problem. This inconsistency would reappear 10 years later, after bipod foam-shedding during STS-112.

¶The fourth and fifth bipod ramp foam loss events went undetected until the Board directed NASA to review all available imagery for other instances of bipod foam-shedding. This review of imagery from tracking cameras, the umbilical well camera, and video and still images from flight crew hand held cameras revealed bipod foam loss on STS-52 and STS-62, both of which were flown by Columbia. STS-52, launched on October 22, 1992, lost an 8- by 4-inch corner of the left bipod ramp as well as portions of foam covering the left jackpad, a piece of External Tank hardware that facilitates the Orbiter attachment process. The STS-52 post-mission inspection noted a higher-than-average 290 hits on upper and lower Thermal Protection System tiles, 16 of which were greater than one inch in one dimension. External Tank separation videos of STS-62, launched on March 4, 1994, revealed that a 1- by 3-inch piece of foam in the rear face of the left bipod ramp was missing, as were small pieces of foam around the bipod ramp. Because these incidents of missing bipod foam were not detected until after the STS-107 accident, no In-Flight Anomalies had been written. The Board concludes that NASAʼs failure to identify these bipod foam losses at the time they occurred means the agency must examine the adequacy of its film review, post-flight inspection, and Program Requirements Control Board processes.

¶The sixth and final bipod ramp event before STS-107 occurred during STS-112 on October 7, 2002 (see Figure 6.1- 3). At 33 seconds after launch, when Atlantis was at 12,500 feet and traveling at Mach 0.75, ground cameras observed an object traveling from the External Tank that subsequently impacted the Solid Rocket Booster/External Tank Attachment ring (see Figure 6.1-4). After impact, the debris broke into multiple pieces that fell along the Solid Rocket Booster exhaust plume.¹⁵¹⁵ During the flight of STS-112, the Intercenter Photo Working Group speculated that a second debris strike occurred at 72 seconds, possibly to the right wing. Although post-flight analysis showed that this did not occur, the Board notes that the Intercenter Photo Working Group failed to properly inform the Mission Management Team of this strike, and that the Mission Management Team subsequently failed to aggressively address the event during flight.Show full note Post-mission inspection of the Solid Rocket Booster confirmed damage to foam on the forward face of the External Tank Attachment ring. The impact was approximately 4 inches wide and 3 inches deep. Post-External Tank separation photography by the crew showed that a 4- by 5- by 12-inch (240 cubic-inch) corner section of the left bipod ramp was missing, which exposed the super lightweight ablator coating on the bipod housing. This missing chunk of foam was believed to be the debris that impacted the External Tank Attachment ring during ascent. The post-launch review of photos and video identified these debris events, but the Mission Evaluation Room logs and Mission Management Team minutes do not reflect any discussions of them.

125

¶Shuttle Program Manager Ron Dittemore and attended by

¶Figure 6.1-4. On STS-112, the foam impacted the External Tank Attach ring on the Solid Rocket Booster, causing this tear in the insulation on the ring.

¶STS-113 Flight Readiness Review: A Pivotal Decision

¶Because the bipod ramp shedding on STS-112 was significant, both in size and in the damage it caused, and because it occurred only two flights before STS-107, the Board investigated NASAʼs rationale to continue flying. This decision made by the Program Requirements Control Board at the STS-113 Flight Readiness Review is among those most directly linked to the STS-107 accident. Had the foam loss during STS-112 been classified as a more serious threat, managers might have responded differently when they heard about the foam strike on STS-107. Alternately, in the face of the increased risk, STS-107 might not have flown at all. However, at STS-113ʼs Flight Readiness Review, managers formally accepted a flight rationale that stated it was safe to fly with foam losses. This decision enabled, and perhaps even encouraged, Mission Management Team members to use similar reasoning when evaluating whether the foam strike on STS-107 posed a safety-of-flight issue.

¶At the Program Requirements Control Board meeting following the return of STS-112, the Intercenter Photo Working Group recommended that the loss of bipod foam be classified as an In-Flight Anomaly. In a meeting chaired by

SPACE SHUTTLE PROGRAM

Space Shuttle Projects Office (MSFC) NASA Marshall Space Flight Center, Huntsville, Alabama

¶STS-112/ET-115 Bipod Ramp Foam Loss

Issue
Foam was lost on the STS-112/ET-115 –Y bipod ramp (~ 4" X 5" X 12") exposing the bipod housing SLA closeout
Background
ET TPS Foam loss over the life of the Shuttle Program has never been a "Safety of Flight" issue
More than 100 External Tanks have flown with only 3 documented instances of significant foam loss on a bipod ramp

¶many of the managers who would be actively involved with STS-107, including Linda Ham, the Program Requirements Control Board ultimately decided against such classification. Instead, after discussions with the Integration Office and the External Tank Project, the Program Requirements Control Board Chairman assigned an "action" to the External Tank Project to determine the root cause of the foam loss and to propose corrective action. This was inconsistent with previous practice, in which all other known bipod foam-shedding was designated as In-Flight Anomalies. The Program Requirements Control Board initially set December 5, 2002, as the date to report back on this action, even though STS-113 was scheduled to launch on November 10. The due date subsequently slipped until after the planned launch and return of STS-107. The Space Shuttle Program decided to fly not one but two missions before resolving the STS-112 foam loss.

¶The Board wondered why NASA would treat the STS-112 foam loss differently than all others. What drove managers to reject the recommendation that the foam loss be deemed an In-Flight Anomaly? Why did they take the unprecedented step of scheduling not one but eventually two missions to fly before the External Tank Project was to report back on foam losses? It seems that Shuttle managers had become conditioned over time to not regard foam loss or debris as a safety-of-flight concern. As will be discussed in Section 6.2, the need to adhere to the Node 2 launch schedule also appears to have influenced their decision. Had the STS-113 mission been delayed beyond early December 2002, the Expedition 5 crew on board the Space Station would have exceeded its 180-day on-orbit limit, and the Node 2 launch date, a major management goal, would not be met.

¶Even though the results of the External Tank Project engineering analysis were not due until after STS-113, the foam-shedding was reported, or "briefed," at STS-113ʼs Flight Readiness Review on October 31, 2002, a meeting that Dittemore and Ham attended. Two slides from this brief (Figure 6.1-5) explain the disposition of bipod ramp foam loss on STS-112.

SPACE SHUTTLE PROGRAM

Space Shuttle Projects Office (MSFC) NASA Marshall Space Flight Center, Huntsville, Alabama

¶Presenter Jerry Smelser, NASA/MP31 Presenter Jerry Smelser, NASA/MP31 Date October 31, 2002 Page 3

¶STS-112/ET-115 Bipod Ramp Foam Loss Date October 31, 2002 Page 4

Rationale for Flight
Current bipod ramp closeout has not been changed since STS-54 (ET-51)

¶Prior to Foam Closeout

¶• The Orbiter has not yet experienced "Safety

of Flight" damage from loss of foam in After Final Foam Trim 112 flights (including 3 known flights with bipod ramp foam loss)

¶• There have been no design / process / equipment changes over the last 60 Missing Foam on

¶ETs (flights) –Y Bipod Ramp

¶• All ramp closeout work (including ET-115 and ET-116) was

performed by experienced practitioners (all over 20 years experience each)

¶• Ramp foam application involves craftmanship in the use of Bipod Attach Fitting validated application processess

¶• No change in Inspection / Process control / Post application handling, etc

Probability of loss of ramp TPS is no higher/no lower than previous flights
The ET is safe to fly with no new concerns (and no added risk)

¶Figure 6.1-5. These two briefing slides are from the STS-113 Flight Readiness Review. The first and third bullets on the right-hand slide are incorrect since the design of the bipod ramp had changed several times since the flights listed on the slide.

126

¶This rationale is seriously flawed. The first and third statements listed under "Rationale for Flight" are incorrect. Contrary to the chart, which was presented by Jerry Smelser, the Program Manager for the External Tank Project, the bipod ramp design had changed, as of External Tank-76. This casts doubt on the implied argument that because the design had not changed, future bipod foam events were unlikely to occur. Although the other points may be factually correct, they provide an exceptionally weak rationale for safe flight. The fact that ramp closeout work was "performed by experienced practitioners" or that "application involves craftsmanship in the use of validated application processes" in no way decreases the chances of recurrent foam loss. The statement that the "probability of loss of ramp Thermal Protection System is no higher/no lower than previous flights" could be just as accurately stated "the probability of bipod foam loss on the next flight is just as high as it was on previous flights." With no engineering analysis, Shuttle managers used past success as a justification for future flights, and made no change to the External Tank configurations planned for STS-113, and, subsequently, for STS-107.

¶Along with this chart, the NASA Headquarters Safety Office presented a report that estimated a 99 percent probability of foam not being shed from the same area, even though no corrective action had been taken following the STS-112 foam-shedding.¹⁶¹⁶ "Safety and Mission Assurance Report for the STS-113 Mission, Pre- Launch Mission Management Team Edition," Enterprise Safety and Mission Assurance Division, November 7, 2002. CAIB Document CTF024-00430061. The ostensible justification for the 99 percent figure was a calculation of the actual rate of bipod loss over 61 flights. This calculation was a sleight- of-hand effort to make the probability of bipod foam loss appear low rather than a serious grappling with the probability of bipod ramp foam separating. For one thing, the calculation equates the probability of left and right bipod loss, when right bipod loss has never been observed, and the amount of imagery available for left and right bipod events differs. The calculation also miscounts the actual number of bipod ramp losses in two ways. First, by restricting the sample size to flights between STS-112 and the last known bipod ramp loss, it excludes known bipod ramp losses from STS-7, STS-32R, and STS-50. Second, by failing to project the statistical rate of bipod loss across the many missions for which no bipod imagery is available, the calculation assumes a "what you donʼt see wonʼt hurt you" mentality when in fact the reverse is true. When the statistical rate of bipod foam loss is projected across missions for which imagery is not available, and the sample size is extended to include every mission from STS-1 on, the probability of bipod loss increases dramatically. The Boardʼs review after STS-107, which included the discovery of two additional bipod ramp losses that NASA had not previously noted, concluded that bipod foam loss occurred on approximately 10 percent of all missions.

¶During the brief at STS-113ʼs Flight Readiness Review, the Associate Administrator for Safety and Mission Assurance scrutinized the Integration Hazard Report 37 conclusion that debris-shedding was an accepted risk, as well as the External Tank Projectʼs rationale for flight. After confer- ring, STS-113 Flight Readiness Review participants ultimately agreed that foam shedding should be characterized as an "accepted risk" rather than a "not a safety-of-flight" issue. Space Shuttle Program management accepted this

¶rationale, and STS-113ʼs Certificate of Flight Readiness was signed.

¶The decision made at the STS-113 Flight Readiness Review seemingly acknowledged that the foam posed a threat to the Orbiter, although the continuing disagreement over whether foam was "not a safety of flight issue" versus an "accepted risk" demonstrates how the two terms became blurred over time, clouding the precise conditions under which an increase in risk would be permitted by Shuttle Program management. In retrospect, the bipod foam that caused a 4- by 3-inch gouge in the foam on one of Atlantisʼ Solid Rocket Boosters – just months before STS-107 – was a "strong signal" of potential future damage that Shuttle engineers ignored. Despite the significant bipod foam loss on STS-112, Shuttle Program engineers made no External Tank configuration changes, no moves to reduce the risk of bipod ramp shedding or potential damage to the Orbiter on either of the next two flights, STS-113 and STS-107, and did not update Integrated Hazard Report 37. The Board notes that although there is a process for conducting hazard analyses when the system is designed and a process for re-evaluating them when a design is changed or the component is replaced, no process addresses the need to update a hazard analysis when anomalies occur. A stronger Integration Office would likely have insisted that Integrated Hazard Analysis 37 be updated. In the course of that update, engineers would be forced to consider the cause of foam-shedding and the effects of shedding on other Shuttle elements, including the Orbiter Thermal Protection System.

¶STS-113 launched at night, and although it is occasionally possible to image the Orbiter from light given off by the Solid Rocket Motor plume, in this instance no imagery was obtained and it is possible that foam could have been shed.

¶The acceptance of the rationale to fly cleared the way for Columbiaʼs launch and provided a method for Mission managers to classify the STS-107 foam strike as a maintenance and turnaround concern rather than a safety-of-flight issue. It is significant that in retrospect, several NASA managers identified their acceptance of this flight rationale as a serious error.

¶The foam-loss issue was considered so insignificant by some Shuttle Program engineers and managers that the STS-107 Flight Readiness Review documents include no discussion of the still-unresolved STS-112 foam loss. According to Program rules, this discussion was not a requirement because the STS-112 incident was only identified as an "action," not an In-Flight Anomaly. However, because the action was still open, and the date of its resolution had slipped, the Board believes that Shuttle Program managers should have addressed it. Had the foam issue been discussed in STS-107 pre-launch meetings, Mission managers may have been more sensitive to the foam-shedding, and may have taken more aggressive steps to determine the extent of the damage.

¶The seventh and final known bipod ramp foam loss occurred on January 16, 2003, during the launch of Columbia on STS-107. After the Columbia bipod loss, the Program Requirements Control Board deemed the foam loss an In-Flight Anomaly to be dealt with by the External Tank Project.

127

¶Other Foam/Debris Events

¶To better understand how NASAʼs treatment of debris strikes evolved over time, the Board investigated missions where debris was shed from locations other than the External Tank bipod ramp. The number of debris strikes to the Orbitersʼ lower surface Thermal Protection System that resulted in tile damage greater than one inch in diameter is shown in Figure 6.1-6.¹⁷¹⁷ Orbiter TPS damage numbers come from the Shuttle Flight Data and In- Flight Anomaly List (JSC-19413). The number of debris strikes may be small, but a single strike could damage several tiles (see Figure 6.1-7).

¶One debris strike in particular foreshadows the STS-107 event. When Atlantis was launched on STS-27R on December 2, 1988, the largest debris event up to that time significantly damaged the Orbiter. Post-launch analysis of tracking camera imagery by the Intercenter Photo Working Group identified a large piece of debris that struck the Thermal Protection System tile at approximately 85 seconds into the flight. On Flight Day Two, Mission Control asked the flight crew to inspect Atlantis with a camera mounted on the remote manipulator arm, a robotic device that was not installed on Columbia for STS-107. Mission Commander R.L. "Hoot" Gibson later stated that Atlantis "looked like it had been blasted by a shotgun."¹⁸¹⁸ CAIB Meeting Minutes, presentation and discussion on IFAs for STS-27 and STS-28, March 28, 2003, Houston, Texas. Concerned that the Orbiterʼs Thermal Protection System had been breached, Gibson or- dered that the video be transferred to Mission Control so that NASA engineers could evaluate the damage.

¶When Atlantis landed, engineers were surprised by the extent of the damage. Post-mission inspections deemed it "the most severe of any mission yet flown."¹⁹¹⁹ "STS-27R National Space Transportation System Mission Report," NSTS- 23370, February 1989, p. 2. The Orbiter had 707 dings, 298 of which were greater than an inch in one dimension. Damage was concentrated outboard of a line right of the bipod attachment to the liquid oxygen umbilical line. Even more worrisome, the debris had knocked off a tile, exposing the Orbiterʼs skin to the heat of re-entry. Post-flight analysis concluded that structural damage was confined to the exposed cavity left by the missing tile, which happened to be at the location of a thick aluminum plate covering an L-band navigation antenna. Were it not for the thick alumi-

¶Lower surface damage dings >1 inch diameter 300

STS-26R OV-103, Flight 7

STS-27R OV-104, Flight 3

¶STS-17 Cause: SRB Ablative 150

¶OV-099, Flight 6

¶STS-7

¶STS-32R

¶STS-11 STS-16 STS-19 STS-23 STS-25 STS-27 STS-30 STS-32

6 — 8

¶26R 29R 28R 33R

¶num plate, Gibson stated during a presentation to the Board that a burn-through may have occurred.²⁰²⁰ CAIB Meeting Minutes, presentation and discussion on IFAs for STS-27 and STS-28, March 28, 2003, Houston, Texas.

¶The Board notes the distinctly different ways in which the STS-27R and STS-107 debris strike events were treated. After the discovery of the debris strike on Flight Day Two of STS-27R, the crew was immediately directed to inspect the vehicle. More severe thermal damage – perhaps even a burn-through – may have occurred were it not for the aluminum plate at the site of the tile loss. Fourteen years later, when a debris strike was discovered on Flight Day Two of STS-107, Shuttle Program management declined to have the crew inspect the Orbiter for damage, declined to request on-orbit imaging, and ultimately discounted the possibility of a burn-through. In retrospect, the debris strike on STS-27R is a "strong signal" of the threat debris posed that should have been considered by Shuttle management when STS-107 suffered a similar debris strike. The Board views the failure to do so as an illustration of the lack of institutional memory in the Space Shuttle Program that supports the Boardʼs claim, discussed in Chapter 7, that NASA is not functioning as a learning organization.

¶After the STS-27R damage was evaluated during a postflight inspection, the Program Requirements Control Board assigned In-Flight Anomalies to the Orbiter and Solid Rocket Booster Projects. Marshall Sprayable Ablator (MSA-1) material found embedded in an insulation blanket on the right Orbital Maneuvering System pod confirmed that the ablator on the right Solid Rocket Booster nose cap was the most likely source of debris.²¹²¹ Corrective Action Record, 27RF13, Closeout Report (no date). CAIB document CTF010-20822107. Because an improved ablator material (MSA-2) would now be used on the Solid Rocket Booster nose cap, the issue was considered "closed" by the time of the next missionʼs Flight Readiness Review. The Orbiter Thermal Protection System review team concurred with the use of the improved ablator without reservation.

¶An STS-27R investigation team notation mirrors a Columbia Accident Investigation Board finding. The STS-27R investigation noted: "it is observed that program emphasis

¶Bipod Ramp Foam Loss Event

STS-87 OV-102, Flight 24 STS-73 Cause: ET Intertank Foam OV-102, Flight 18

¶STS-50 STS-112 STS-42 STS-52 STS-62 STS-107 STS-35

36 41 35 39 43 44 45 50 47 53 56 57 58 — 60
65 68 63 71 69 74 75 77 79 81 83 94 86 89 91 88 93 99 99 92 98 100 105 109 111 — 113

¶Space Shuttle Mission Number

¶Figure 6.1-6. This chart shows the number of dings greater than one inch in diameter on the lower surface of the Orbiter after each mission from STS-6 through STS-113. Flights where the bipod ramp foam is known to have come off are marked with a red triangle.

128

MISSION DATE COMMENTS

¶STS-1 April 12, 1981 Lots of debris damage. 300 tiles replaced.

¶STS-7 June 18, 1983 First known left bipod ramp foam shedding event.

¶STS-27R December 2, 1988 Debris knocks off tile; structural damage and near burn through results.

¶STS-32R January 9, 1990 Second known left bipod ramp foam event.

¶First time NASA calls foam debris "safety of flight issue," and "re-use or turn-

¶STS-35 December 2, 1990 around issue."

¶First mission after which the next mission (STS-45) launched without debris In-

¶STS-42 January 22, 1992

¶Flight Anomaly closure/resolution.

¶Damage to wing RCC Panel 10-right. Unexplained Anomaly, "most likely orbital

¶STS-45 March 24, 1992 debris."

¶STS-50 June 25, 1992 Third known bipod ramp foam event. Hazard Report 37: an "accepted risk."

¶STS-52 October 22, 1992 Undetected bipod ramp foam loss (Fourth bipod event).

¶Acreage tile damage (large area). Called "within experience base" and consid-

¶STS-56 April 8, 1993 ered "in family."

¶STS-62 October 4, 1994 Undetected bipod ramp foam loss (Fifth bipod event).

¶Damage to Orbiter Thermal Protection System spurs NASA to begin 9 flight

¶STS-87 November 19, 1997 tests to resolve foam-shedding. Foam fix ineffective. In-Flight Anomaly eventually closed after STS-101 as "accepted risk."

¶Sixth known left bipod ramp foam loss. First time major debris event not assigned

¶STS-112 October 7, 2002 an In-Flight Anomaly. External Tank Project was assigned an Action. Not closed out until after STS-113 and STS-107.

¶STS-107 January 16, 2003 Columbia launch. Seventh known left bipod ramp foam loss event.

¶Figure 6.1-7. The Board identified 14 flights that had significant Thermal Protection System damage or major foam loss. Two of the bipod foam loss events had not been detected by NASA prior to the Columbia Accident Investigation Board requesting a review of all launch images.

¶and attention to tile damage assessments varies with severity tank to the intertank. An In-Flight Anomaly was assigned and that detailed records could be augmented to ease trend to the External Tank Project, which closed it by stating that maintenance" (emphasis added).²²²² "STS-27R OV-104 Orbiter TPS Damage Review Team Summary Report," Volume I, February 1989, TM-100355, p. 64. CAIB document CAB035- 02290303. In other words, Space there was no increase in Orbiter Thermal Protection System Shuttle Program personnel knew that the monitoring of damage and that it was "not a safety-of-flight concern."²⁴²⁴ "In-Flight Anomaly: STS-35/ET-35," External Tank Flight Readiness Report 3500.2.3/91. CAIB document CAB057-51185119. tile damage was inadequate and that clear trends could be The Board notes that it was in a discussion at the STS-36 more readily identified if monitoring was improved, but no Flight Readiness Review that NASA first identified this such improvements were made. The Board also noted that problem as a turnaround issue.²⁵²⁵ STS-36 PRCB, IFA Closure Rationale for STS-35. CAIB document CAB029- 03620433. Per established procedures, an STS-27R investigation team recommendation correlated NASA was still designating foam-loss events as In-Flight to the Columbia accident 14 years later: "It is recommended Anomalies and continued to make various corrective ac- that the program actively solicit design improvements ditions, such as drilling more vent holes and improving the rected toward eliminating debris sources or minimizing foam application process. damage potential."²³²³ Ibid.

¶Discovery was launched on STS-42 on January 22, 1992. A Another instance of non-bipod foam damage occurred on total of 159 hits on the Orbiter Thermal Protection System STS-35. Post-flight inspections of Columbia after STS-35 in were noted after landing. Two 8- to 12-inch-diameter div- December 1990, showed a higher-than-average amount of ots in the External Tank intertank area were noted during damage on the Orbiterʼs lower surface. A review of External post-External Tank separation photo evaluation, and these Tank separation film revealed approximately 10 areas of pieces of foam were identified as the most probable sources missing foam on the flange connecting the liquid hydrogen of the damage. The External Tank Project was assigned an In-Flight Anomaly, and the incident was later described as an unexplained or isolated event. However, at later Flight Readiness Reviews, the Marshall Space Flight Center briefed this as being "not a safety-of-flight" concern.²⁶²⁶ Identified by MSFC in PRACA database as "not a safety of flight" concern. Briefed at post-STS-42 PRCB and STS-45 Flight Readiness Review. The next flight, STS-45, would be the first mission launched before the foam-loss In-Flight Anomaly was closed.

129

¶On March 24, 1992, Atlantis was launched on STS-45. Post-mission inspection revealed exposed substrate on the upper surface of right wing leading edge Reinforced Carbon-Carbon (RCC) panel 10 caused by two gouges, one 1.9 inches by 1.6 inches and the other 0.4 inches by 1 inch.²⁷²⁷ "STS-45 Space Shuttle Mission Report," NSTS-08275, May 1992, pg. 17. CAIB document CTF003-00030006. Before the next flight, an In-Flight Anomaly assigned to the Orbiter Project was closed as "unexplained," but "most likely orbital debris."²⁸²⁸ "STS-45 Space Shuttle Mission Report," NSTS-08275, May 1992. CAIB document CTF003-00030006. Despite this closure, the Safety and Mission Assurance Office expressed concern as late as the pre-launch Mission Management Team meeting two days before the launch of STS-49. Nevertheless, the mission was cleared for launch. Later laboratory tests identified pieces of man-made debris lodged in the RCC, including stainless steel, aluminum, and titanium, but no conclusion was made about the source of the debris. (The Board notes that this indicates there were transport mechanisms available to determine the path the debris took to impact the wing leading edge. See Section 3.4.)

¶The Program Requirements Control Board also assigned the External Tank Project an In-Flight Anomaly after foam loss on STS-56 (Discovery) and STS-58 (Columbia), both of which were launched in 1993. These missions demonstrate the increasingly casual ways in which debris impacts were dispositioned by Shuttle Program managers. After postflight analysis determined that on both missions the foam had come from the intertank and bipod jackpad areas, the rationale for closing the In-Flight Anomalies included nota- tions that the External Tank foam debris was "in-family," or within the experience base.²⁹²⁹ Both STS-56 and STS-58 post mission PRCBs discussed the debris events and IFAs. Closeout rationale was based upon the events being considered "in family" and "within experience base."

¶During the launch of STS-87 (Columbia) on November 19, 1997, a debris event focused NASAʼs attention on debris-shedding and damage to the Orbiter. Post-External Tank separation photography revealed a significant loss of material from both thrust panels, which are fastened to the Solid Rocket Booster forward attachment points on the intertank structure. Post-landing inspection of the Orbiter noted 308 hits, with 244 on the lower surface and 109 larger than an inch. The foam loss from the External Tank thrust panels was suspected as the most probable cause of the Orbiter Thermal Protection System damage. Based on data from post-flight inspection reports, as well as comparisons with statistics from 71 similarly configured flights, the total number of damage sites, and the number of damage sites one inch or larger, were considered "out-of-family."³⁰³⁰ "Problem Reporting and Corrective Action System Requirements," NSTS- 08126, Revision H, November 22, 2000, Appendix C, Definitions, Out of Family. CAIB document CTF044-28652894. An investigation was conducted to determine the cause of the material loss and the actions required to prevent a recurrence.

¶The foam loss problem on STS-87 was described as "popcorning" because of the numerous popcorn-size foam particles that came off the thrust panels. Popcorning has always occurred, but it began earlier than usual in the launch of STS-87. The cause of the earlier-than-normal popcorning (but not the fundamental cause of popcorning) was traced

¶back to a change in foam-blowing agents that caused pressure buildups and stress concentrations within the foam. In an effort to reduce its use of chlorofluorocarbons (CFCs), NASA had switched from a CFC-11 (chlorofluorocarbon) blowing agent to an HCFC-141b blowing agent beginning with External Tank-85, which was assigned to STS-84. (The change in blowing agent affected only mechanically applied foam. Foam that is hand sprayed, such as on the bipod ramp, is still applied using CFC-11.)

¶The Program Requirements Control Board issued a Directive and the External Tank Project was assigned an In-Flight Anomaly to address the intertank thrust panel foam loss. Over the course of nine missions, the External Tank Project first reduced the thickness of the foam on the thrust panels to minimize the amount of foam that could be shed; and, due to a misunderstanding of what caused foam loss at that time, put vent holes in the thrust panel foam to relieve trapped gas pressure.

¶The In-Flight Anomaly remained open during these changes, and foam shedding occurred on the nine missions that tested the corrective actions. Following STS-101, the 10th mission after STS-87, the Program Requirements Control Board concluded that foam-shedding from the thrust panel had been reduced to an "acceptable level" by sanding and venting, and the In-Flight Anomaly was closed.³¹³¹ Post STS-87 PRCBD, S 062127, 18 Dec 1997. The Orbiter Project, External Tank Project, and Space Shuttle Program management all accepted this rationale without question. The Board notes that these interventions merely reduced foam-shedding to previously experienced levels, which have remained relatively constant over the Shuttleʼs lifetime.

¶Making the Orbiter More Resistant To Debris Strikes

¶If foam shedding could not be prevented entirely, what did NASA do to make the Thermal Protection System more resistant to debris strikes? A 1990 study by Dr. Elisabeth Paté-Cornell and Paul Fishback attempted to quantify the risk of a Thermal Protection System failure using probabilistic analysis.³²³² M. Elisabeth Paté-Cornell and Paul S. Fischbeck, "Risk Management for the Tiles of the Space Shuttle," pp. 64-86, Interfaces 24, January- February 1994. CAIB document CAB005-0141. The data they used included (1) the probability that a tile would become debonded by either debris strikes or a poor bond, (2) the probability of then losing adjacent tiles, (3) depending on the final size of the failed area, the probability of burn-through, and (4) the probability of failure of a critical sub-system if burn-through occurs. The study concluded that the probability of losing an Orbiter on any given mission due to a failure of Thermal Protection System tiles was approximately one in 1,000. Debris-related problems accounted for approximately 40 percent of the probability, while 60 percent was attributable to tile debonding caused by other factors. An estimated 85 percent of the risk could be attributed to 15 percent of the "acreage," or larger areas of tile, meaning that the loss of any one of a relatively small number of tiles pose a relatively large amount of risk to the Orbiter. In other words, not all tiles are equal – losing certain tiles is more dangerous. While the actual risk may be different than that computed in the 1990 study due to the limited amount of data and the underlying simplified assumptions, this type of analysis offers insight that enables management to concentrate their resources on protecting the Orbitersʼ critical areas.

130

¶Two years after the conclusion of that study, NASA wrote to Paté-Cornell and Fishback describing the importance of their work, and stated that it was developing a long-term effort to use probabilistic risk assessment and related disciplines to improve programmatic decisions.³³³³ Letter to M. Elisabeth Paté-Cornell, Stanford University, from Benjamin Buchbinder, Risk Management Program Manager, NASA, 10 May 1993. CAIB document CAB038-36973698. Though NASA has taken some measures to invest in probabilistic risk assessment as a tool, it is the Boardʼs view that NASA has not fully exploited the insights that Paté-Cornellʼs and Fishbackʼs work offered.³⁴³⁴ M. Elisabeth Paté-Cornell, "Follow-up on the Standard 1990 Study of the Risk of Loss of Vehicle and Crew of the NASA Space Shuttle Due to Tile Failure," Report to the Columbia Accident Investigation Board, 18 June 2003. CAIB document CAB006-00970104.

¶Impact Resistant Tile

¶NASA also evaluated the possibility of increasing Thermal Protection System tile resistance to debris hits, lowering the possibility of tile debonding, and reducing tile production and maintenance costs.³⁵³⁵ M. Litwinsk and G. Wilson, et al., "End-to-End TPS Upgrades Plan for Space Shuttle Orbiter," February 1997; K. Hinkle and G. Wilson, "Advancements in TPS," M&P Engineering, 22 October 1998. Indeed, tiles with a "tough" coating are currently used on the Orbiters. This coating, known as Toughened Uni-piece Fibrous Insulation (TUFI), was patented in 1992 and developed for use on high-temperature rigid insulation.³⁶³⁶ Daniel B. Leiser, et al., "Toughened Uni-piece Fibrous Insulation (TUFI)" Patent #5,079,082, 7 January 1992. TUFI is used on a tile material known as Alumina Enhanced Thermal Barrier (AETB), and has a debris impact resistance that is greater than the current acreage tileʼs resistance by a factor of approximately 6-20.³⁷³⁷ Karrie Hinkle, "High Density Tile for Enhanced Dimensional Stability," Briefing to Space Shuttle Program, October 19, 1998. CAIB document CAB033-32663280. At least 772 of these advanced tiles have been installed on the Orbitersʼ base heat shields and upper body flaps.³⁸³⁸ Daniel B. Leiser, "Present/Future Tile Thermal Protection Systems," A presentation to the CAIB (Group 1), 16 May 2003. However, due to its higher thermal conductivity, TUFI-coated AETB cannot be used as a replacement for the larger areas of tile coverage. (Boeing, Lockheed Martin and NASA are developing a lightweight, impact-resistant, low-conductivity tile.³⁹³⁹ John Kowal, "Orbiter Thermal Protection System (TPS) Upgrades." Space Shuttle Upgrades Safety Panel Review, 10 February 2003.) Because the impact requirements for these next-generation tiles do not appear to be based on resistance to specific (and probable) damage sources, it is the Boardʼs view that certification of the new tile will not adequately address the threat posed by debris.

¶Conclusion

¶Despite original design requirements that the External Tank not shed debris, and the corresponding design requirement that the Orbiter not receive debris hits exceeding a trivial amount of force, debris has impacted the Shuttle on each flight. Over the course of 113 missions, foam-shedding and other debris impacts came to be regarded more as a turnaround or maintenance issue, and less as a hazard to the vehicle and crew.

¶Assessments of foam-shedding and strikes were not thoroughly substantiated by engineering analysis, and the process for closing In-Flight Anomalies is not well-documented and appears to vary. Shuttle Program managers appear to have confused the notion of foam posing an "accepted risk" with foam not being a "safety-of-flight issue." At times, the pressure to meet the flight schedule appeared to cut short engineering efforts to resolve the foam-shedding problem.

¶NASAʼs lack of understanding of foam properties and behavior must also be questioned. Although tests were conducted to develop and qualify foam for use on the External Tank, it appears there were large gaps in NASAʼs knowledge about this complex and variable material. Recent testing conducted at Marshall Space Flight Center and under the auspices of the Board indicate that mechanisms previously

¶considered a prime source of foam loss, cryopumping and cryoingestion, are not feasible in the conditions experienced during tanking, launch, and ascent. Also, dissections of foam bipod ramps on External Tanks yet to be launched reveal subsurface flaws and defects that only now are being discovered and identified as contributing to the loss of foam from the bipod ramps.

¶While NASA properly designated key debris events as In- Flight Anomalies in the past, more recent events indicate that NASA engineers and management did not appreciate the scope, or lack of scope, of the Hazard Reports involving foam shedding.⁴⁰⁴⁰ "Problem Reporting and Corrective Action System Requirements," NSTS-08126, Revision H, November 22, 2000. CAIB document CTF044- 28652894. Ultimately, NASAʼs hazard analyses, which were based on reducing or eliminating foam-shedding, were not succeeding. Shuttle Program management made no adjustments to the analyses to recognize this fact. The acceptance of events that are not supposed to happen has been described by sociologist Diane Vaughan as the "normalization of deviance."⁴¹⁴¹ Diane Vaughan, The Challenger Launch Decision: Risky Technology, Culture, and Deviance at NASA (Chicago: University of Chicago Press, 1996). The history of foam-problem decisions shows how NASA first began and then continued flying with foam losses, so that flying with these deviations from design specifications was viewed as normal and acceptable. Dr. Richard Feynman, a member of the Presidential Commission on the Space Shuttle Challenger Accident, discusses this phenomena in the context of the Challenger accident. The parallels are striking:

¶The phenomenon of accepting … flight seals that had shown erosion and blow-by in previous flights is very clear. The Challenger flight is an excellent example.

¶There are several references to flights that had gone before. The acceptance and success of these flights is taken as evidence of safety. But erosions and blow-by are not what the design expected. They are warnings that something is wrong … The O-rings of the Solid Rocket Boosters were not designed to erode. Erosion was a clue that something was wrong. Erosion was not something from which safety can be inferred … If a reasonable launch schedule is to be maintained, engineering often cannot be done fast enough to keep up with the expectations of originally conservative certification criteria designed to guarantee a very safe vehicle. In these situations, subtly, and often with apparently logical arguments, the criteria are altered so that flights may still be certified in time. They therefore fly in a relatively unsafe condition, with a chance of failure of the order of a percent (it is difficult to be more accurate).⁴²⁴² Richard Feynman, Minority Report on Challenger, The Pleasure of Finding Things Out, (New York: Perseus Publishing, 2002).

¶Findings

¶F6.1−1 NASA has not followed its own rules and requirements on foam-shedding. Although the agency continuously worked on the foam-shedding problem, the debris impact requirements have not been met on any mission.

¶F6.1−2 Foam-shedding, which had initially raised serious safety concerns, evolved into "in-family" or "no safety-of-flight" events or were deemed an "accepted risk."

¶F6.1−3 Five of the seven bipod ramp events occurred on missions flown by Columbia, a seemingly high number. This observation is likely due to

131

Columbia having been equipped with umbilical cameras earlier than other Orbiters.

¶F6.1−4 There is lack of effective processes for feedback or integration among project elements in the resolution of In-Flight Anomalies.

¶F6.1−5 Foam bipod debris-shedding incidents on STS-52 and STS-62 were undetected at the time they occurred, and were not discovered until the Board directed NASA to examine External Tank separation images more closely.

¶F6.1−6 Foam bipod debris-shedding events were classified as In-Flight Anomalies up until STS-112, which was the first known bipod foam-shedding event not classified as an In-Flight Anomaly.

¶F6.1−7 The STS-112 assignment for the External Tank Project to "identify the cause and corrective action of the bipod ramp foam loss event" was not due until after the planned launch of STS-113, and then slipped to after the launch of STS-107.

¶F6.1−8 No External Tank configuration changes were made after the bipod foam loss on STS-112.

¶F6.1−9 Although it is sometimes possible to obtain imagery of night launches because of light provided by the Solid Rocket Motor plume, no imagery was obtained for STS-113.

¶F6.1−10 NASA failed to adequately perform trend analysis on foam losses. This greatly hampered the agencyʼs ability to make informed decisions about foam losses.

¶F6.1−11 Despite the constant shedding of foam, the Shuttle Program did little to harden the Orbiter against foam impacts through upgrades to the Thermal Protection System. Without impact resistance and strength requirements that are calibrated to the energy of debris likely to impact the Orbiter, certification of new Thermal Protection System tile will not adequately address the threat posed by debris.

¶Recommendations:

None