MISSED OPPORTUNITIES

Flight Day 4. Rodney Rocha inquires if crew has been asked to inspect for damage. No response.
Flight Day 6. Mission Control fails to ask crew member David Brown to downlink video he took of External Tank separation, which may have revealed missing bipod foam.
Flight Day 6. NASA and National Imagery and Mapping Agency personnel discuss possible request for imagery. No action taken.
Flight Day 7. Wayne Hale phones Department of Defense representative, who begins identifying imaging assets, only to be stopped per Linda Hamʼs orders.
Flight Day 7. Mike Card, a NASA Headquarters manager from the Safety and Mission Assur-

ance Office, discusses imagery request with Mark Erminger, Johnson Space Center Safety and Mission Assurance. No action taken.

Flight Day 7. Mike Card discusses imagery request with Bryan OʼConnor, Associate Administrator for Safety and Mission Assurance. No action taken.
Flight Day 8. Barbara Conte, after discussing imagery request with Rodney Rocha, calls LeRoy

Cain, the STS-107 ascent/entry Flight Director. Cain checks with Phil Engelauf, and then deliv- ers a "no" answer.

Flight Day 14. Michael Card, from NASAʼs Safety and Mission Assurance Office, discusses the

imaging request with William Readdy, Associate Administrator for Space Flight. Readdy directs that imagery should only be gathered on a "not-to-interfere" basis. None was forthcoming.

¶Upon learning of the debris strike on Flight Day Two, the responsible system area manager from United Space Alliance and her NASA counterpart formed a team to analyze the debris strike in accordance with mission rules requiring the careful examination of any "out-of-family" event. Using film from the Intercenter Photo Working Group, Boeing systems integration analysts prepared a preliminary analysis that afternoon. (Initial estimates of debris size and speed, origin of debris, and point of impact would later prove remarkably accurate.)

¶As Flight Day Three and Four unfolded over the Martin Luther King Jr. holiday weekend, engineers began their analysis. One Boeing analyst used Crater, a mathematical prediction tool, to assess possible damage to the Thermal Protection System. Analysis predicted tile damage deeper than the actual tile depth, and penetration of the RCC coating at impact angles above 15 degrees. This suggested the potential for a burn-through during re-entry. Debris Assessment Team members judged that the actual damage would not be as severe as predicted because of the inherent conservatism in the Crater model and because, in the case of tile, Crater does not take into account the tileʼs stronger and more impact-resistant "densified" layer, and in the case of RCC, the lower density of foam would preclude penetration at impact angles under 21 degrees.

¶On Flight Day Five, impact assessment results for tile and RCC were presented at an informal meeting of the Debris Assessment Team, which was operating without direct Shuttle Program or Mission Management leadership. Mission Controlʼs engineering support, the Mission Evaluation Room, provided no direction for team activities other than to request the teamʼs results by January 24. As the problem was being worked, Shuttle managers did not formally direct the actions of or consult with Debris Assessment Team leaders about the teamʼs assumptions, uncertainties, progress, or interim results, an unusual circumstance given that NASA managers are normally engaged in analyzing what they view as problems. At this meeting, participants agreed that an image of the area of the wing in question was essential to refine their analysis and reduce the uncertainties in their damage assessment.

¶Each member supported the idea to seek imagery from an outside source. Due in part to a lack of guidance from the Mission Management Team or Mission Evaluation Room managers, the Debris Assessment Team chose an unconventional route for its request. Rather than working the request up the normal chain of command – through the Mission Evaluation Room to the Mission Management Team for action to Mission Control – team members nominated Rodney Rocha, the teamʼs Co-Chair, to pursue the request through the Engineering Directorate at Johnson Space Center. As a result, even after the accident the Debris Assessment Teamʼs request was viewed by Shuttle Program managers as a non-critical engineering desire rather than a critical operational need.

168

¶When the team learned that the Mission Management Team was not pursuing on-orbit imaging, members were concerned. What Debris Assessment Team members did not realize was the negative response from the Program was not necessarily a direct and final response to their official request. Rather, the "no" was in part a response to requests for imagery initiated by the Intercenter Photo Working Group at Kennedy on Flight Day 2 in anticipation of analystsʼ needs that had become by Flight Day 6 an actual engineering request by the Debris Assessment Team, made informally through Bob White to Lambert Austin, and formally through Rodney Rochaʼs e-mail to Paul Shack. Even after learning that the Shuttle Program was not going to provide the team with imagery, some members sought information on how to obtain it anyway.

¶Debris Assessment Team members believed that imaging of potentially damaged areas was necessary even after the January 24, Mission Management Team meeting, where they had reported their results. Why they did not directly approach Shuttle Program managers and share their concern and uncertainty, and why Shuttle Program managers claimed to be isolated from engineers, are points that the Board labored to understand. Several reasons for this communications failure relate to NASAʼs internal culture and the climate established by Shuttle Program management, which are discussed in more detail in Chapters 7 and 8.

¶A Flawed Analysis

¶An inexperienced team, using a mathematical tool that was not designed to assess an impact of this estimated size, performed the analysis of the potential effect of the debris impact. Crater was designed for "in-family" impact events and was intended for day-of-launch analysis of debris impacts. It was not intended for large projectiles like those observed on STS-107. Crater initially predicted possible damage, but the Debris Assessment Team assumed, without theoretical or experimental validation, that because Crater is a conservative tool – that is, it predicts more damage than will actually occur – the debris would stop at the tileʼs densified layer, even though their experience did not involve debris strikes as large as STS-107ʼs. Crater-like equations were also used as part of the analysis to assess potential impact damage to the wing leading edge RCC. Again, the tool was used for something other than that for which it was designed; again, it predicted possible penetration; and again, the Debris Assessment Team used engineering arguments and their experience to discount the results.

¶As a result of a transition of responsibility for Crater analysis from the Boeing Huntington Beach facility to the Houston-based Boeing office, the team that conducted the Crater analyses had been formed fairly recently, and therefore could be considered less experienced when compared with the more senior Huntington Beach analysts. In fact, STS-107 was the first mission for which they were solely responsible for providing analysis with the Crater tool. Though post-accident interviews suggested that the training for the Houston Boeing analysts was of high quality and adequate in substance and duration, communications and theoretical understandings of the Crater model among the Houston-based team members had not yet developed to the standard of a more senior team. Due in part to contractual arrangements related to the transition, the Houston-based team did not take full advantage of the Huntington Beach engineersʼ experience.

¶At the January 24, Mission Management Team meeting at which the "no safety-of-flight" conclusion was presented, there was little engineering discussion about the assumptions made, and how the results would differ if other assumptions were used.

¶Engineering solutions presented to management should have included a quantifiable range of uncertainty and risk analysis. Those types of tools were readily available, routinely used, and would have helped management understand the risk involved in the decision. Management, in turn, should have demanded such information. The very absence of a clear and open discussion of uncertainties and assumptions in the analysis presented should have caused management to probe further.

¶Shuttle Program Managementʼs Low Level of Concern

¶While the debris strike was well outside the activities covered by normal mission flight rules, Mission Management Team members and Shuttle Program managers did not treat the debris strike as an issue that required operational action by Mission Control. Program managers, from Ron Dittemore to individual Mission Management Team members, had, over the course of the Space Shuttle Program, gradually become inured to External Tank foam losses and on a fundamental level did not believe foam striking the vehicle posed a critical threat to the Orbiter. In particular, Shuttle managers exhibited a belief that RCC panels are impervious to foam impacts. Even after seeing the video of Columbiaʼs debris impact, learning estimates of the size and location of the strike, and noting that a foam strike with sufficient kinetic energy could cause Thermal Protection System damage, managementʼs level of concern did not change.

169

¶The opinions of Shuttle Program managers and debris and photo analysts on the potential severity of the debris strike diverged early in the mission and continued to diverge as the mission progressed, making it increasingly difficult for the Debris Assessment Team to have their concerns heard by those in a decision-making capacity. In the face of Mission managersʼ low level of concern and desire to get on with the mission, Debris Assessment Team members had to prove unequivocally that a safety-of-flight issue existed before Shuttle Program management would move to obtain images of the left wing. The engineers found themselves in the unusual position of having to prove that the situation was unsafe – a reversal of the usual requirement to prove that a situation is safe.

¶Other factors contributed to Mission managementʼs ability to resist the Debris Assessment Teamʼs concerns. A tile expert told managers during frequent consultations that strike damage was only a maintenance-level concern and that on-orbit imaging of potential wing damage was not necessary. Mission management welcomed this opinion and sought no others. This constant reinforcement of managersʼ pre-existing beliefs added another block to the wall between decision makers and concerned engineers.

¶Another factor that enabled Mission managementʼs detachment from the concerns of their own engineers is rooted in the culture of NASA itself. The Board observed an unofficial hierarchy among NASA programs and directorates that hindered the flow of communications. The effects of this unofficial hierarchy are seen in the attitude that members of the Debris Assessment Team held. Part of the reason they chose the institutional route for their imagery request was that without direction from the Mission Evaluation Room and Mission Management Team, they felt more comfortable with their own chain of command, which was outside the Shuttle Program. Further, when asked by investigators why they were not more vocal about their concerns, Debris Assessment Team members opined that by raising contrary points of view about Shuttle mission safety, they would be singled out for possible ridicule by their peers and managers.

¶A Lack of Clear Communication

¶Communication did not flow effectively up to or down from Program managers. As it became clear during the mission that managers were not as concerned as others about the danger of the foam strike, the ability of engineers to challenge those beliefs greatly diminished. Managersʼ tendency to accept opinions that agree with their own dams the flow of effective communications.

¶After the accident, Program managers stated privately and publicly that if engineers had a safety concern, they were obligated to communicate their concerns to management. Managers did not seem to understand that as leaders they had a corresponding and perhaps greater obligation to create viable routes for the engineering community to express their views and receive information. This barrier to communications not only blocked the flow of information to managers, but it also prevented the downstream flow of information from managers to engineers, leaving Debris Assessment Team members no basis for understanding the reasoning behind Mission Management Team decisions.

¶The January 27 to January 31, phone and e-mail exchanges, primarily between NASA engineers at Langley and Johnson, illustrate another symptom of the "cultural fence" that impairs open communications between mission managers and working engineers. These exchanges and the reaction to them indicated that during the evaluation of a mission contingency, the Mission Management Team failed to disseminate information to all system and technology experts who could be consulted. Issues raised by two Langley and Johnson engineers led to the development of "what-if" landing scenarios of the potential outcome if the main landing gear door sustained damaged. This led to behind-the-scenes networking by these engineers to use NASA facilities to make simulation runs of a compromised landing configuration. These engineers – who understood their systems and related technology – saw the potential for a problem on landing and ran it down in case the unthinkable occurred. But their concerns never reached the managers on the Mission Management Team that had operational control over Columbia.

170

¶A Lack of Effective Leadership

¶The Shuttle Program, the Mission Management Team, and through it the Mission Evaluation Room, were not actively directing the efforts of the Debris Assessment Team. These management teams were not engaged in scenario selection or discussions of assumptions and did not actively seek status, inputs, or even preliminary results from the individuals charged with analyzing the debris strike. They did not investigate the value of imagery, did not intervene to consult the more experienced Crater analysts at Boeingʼs Huntington Beach facility, did not probe the assumptions of the Debris Assessment Teamʼs analysis, and did not consider actions to mitigate the effects of the damage on re-entry. Managersʼ claims that they didnʼt hear the engineersʼ concerns were due in part to their not asking or listening.

¶The Failure of Safetyʼs Role

¶As will be discussed in Chapter 7, safety personnel were present but passive and did not serve as a channel for the voicing of concerns or dissenting views. Safety representatives attended meetings of the Debris Assessment Team, Mission Evaluation Room, and Mission Management Team, but were merely party to the analysis process and conclusions instead of an independent source of questions and challenges. Safety contractors in the Mission Evaluation Room were only marginally aware of the debris strike analysis. One contractor did question the Debris Assessment Team safety representative about the analysis and was told that it was adequate. No additional inquiries were made. The highest-ranking safety representative at NASA headquarters deferred to Program managers when asked for an opinion on imaging of Columbia. The safety manager he spoke to also failed to follow up.

¶Summary

¶Management decisions made during Columbiaʼs final flight reflect missed opportunities, blocked or ineffective communications channels, flawed analysis, and ineffective leadership. Perhaps most striking is the fact that management – including Shuttle Program, Mission Management Team, Mission Evaluation Room, and Flight Director and Mission Control – displayed no interest in understanding a problem and its implications. Because managers failed to avail themselves of the wide range of expertise and opinion necessary to achieve the best answer to the debris strike question – "Was this a safety-of-flight concern?" – some Space Shuttle Program managers failed to fulfill the implicit contract to do whatever is possible to ensure the safety of the crew. In fact, their management techniques unknowingly imposed barriers that kept at bay both engineering concerns and dissenting views, and ultimately helped create "blind spots" that prevented them from seeing the danger the foam strike posed.

¶Because this chapter has focused on key personnel who participated in STS-107 bipod foam debris strike decisions, it is tempting to conclude that replacing them will solve all NASAʼs problems. However, solving NASAʼs problems is not quite so easily achieved. Peoplesʼ actions are influenced by the organizations in which they work, shaping their choices in directions that even they may not realize. The Board explores the organizational context of decision making more fully in Chapters 7 and 8.

¶Findings

¶Intercenter Photo Working Group

¶F6.3-1 The foam strike was first seen by the Intercenter Photo Working Group on the morn-

ing of Flight Day Two during the standard review of launch video and high-speed photography. The strike was larger than any seen in the past, and the group was concerned about possible damage to the Orbiter. No conclusive images of the strike existed. One camera that may have provided an additional view was out of focus because of an improperly maintained lens.

¶F6.3-2 The Chair of the Intercenter Photo Working Group asked management to begin the

process of getting outside imagery to help in damage assessment. This request, the first of three, began its journey through the management hierarchy on Flight Day Two.

¶F6.3-3 The Intercenter Photo Working Group distributed its first report, including a digitized video clip and initial assessment of the strike, on Flight Day Two. This information

171

was widely disseminated to NASA and contractor engineers, Shuttle Program managers, and Mission Operations Directorate personnel.

¶F6.3-4 Initial estimates of debris size, speed, and origin were remarkably accurate. Initial in-

formation available to managers stated that the debris originated in the left bipod area of the External Tank, was quite large, had a high velocity, and struck the underside of the left wing near its leading edge. The report stated that the debris could have hit the RCC or tile.

¶The Debris Assessment Team

¶F6.3-5 A Debris Assessment Team began forming on Flight Day two to analyze the impact.

Once the debris strike was categorized as "out of family" by United Space Alliance, contractual obligations led to the Team being Co-Chaired by the cognizant contractor sub-system manager and her NASA counterpart. The team was not designated a Tiger Team by the Mission Evaluation Room or Mission Management Team.

¶F6.3-6 Though the Team was clearly reporting its plans (and final results) through the Mis-

sion Evaluation Room to the Mission Management Team, no Mission manager appeared to "own" the Teamʼs actions. The Mission Management Team, through the Mission Evaluation Room, provided no direction for team activities, and Shuttle managers did not formally consult the Teamʼs leaders about their progress or interim results.

¶F6.3-7 During an organizational meeting, the Team discussed the uncertainty of the data

and the value of on-orbit imagery to "bound" their analysis. In its first official meeting the next day, the Team gave its NASA Co-Chair the action to request imagery of Columbia on-orbit.

¶F6.3-8 The Team routed its request for imagery through Johnson Space Centerʼs Engineer-

ing Directorate rather than through the Mission Evaluation Room to the Mission Management Team to the Flight Dynamics Officer, the channel used during a mission. This routing diluted the urgency of their request. Managers viewed it as a non-critical engineering desire rather than a critical operational need.

¶F6.3-9 Team members never realized that managementʼs decision against seeking imagery was not intended as a direct or final response to their request. F6.3-10 The Teamʼs assessment of possible tile damage was performed using an impact

simulation that was well outside Craterʼs test database. The Boeing analyst was inexperienced in the use of Crater and the interpretation of its results. Engineers with extensive Thermal Protection System expertise at Huntington Beach were not actively involved in determining if the Crater results were properly interpreted.

¶F6.3-11 Crater initially predicted tile damage deeper than the actual tile depth, but engineers

used their judgment to conclude that damage would not penetrate the densified layer of tile. Similarly, RCC damage conclusions were based primarily on judgment and experience rather than analysis.

¶F6.3-12 For a variety of reasons, including management failures, communication break-

downs, inadequate imagery, inappropriate use of assessment tools, and flawed engineering judgments, the damage assessments contained substantial uncertainties.

¶F6.3-13 The assumptions (and their uncertainties) used in the analysis were never presented

or discussed in full to either the Mission Evaluation Room or the Mission Management Team.

¶F6.3-14 While engineers and managers knew the foam could have struck RCC panels; the

briefings on the analysis to the Mission Evaluation Room and Mission Management Team did not address RCC damage, and neither Mission Evaluation Room nor Mission Management Team managers asked about it.

¶Space Shuttle Program Management

¶F6.3-15 There were lapses in leadership and communication that made it difficult for en-

gineers to raise concerns or understand decisions. Management failed to actively engage in the analysis of potential damage caused by the foam strike.

¶F6.3-16 Mission Management Team meetings occurred infrequently (five times during a 16 day mission), not every day, as specified in Shuttle Program management rules. F6.3-17 Shuttle Program Managers entered the mission with the belief, recently reinforced

by the STS-113 Flight Readiness Review, that a foam strike is not a safety-of-flight issue.

172

¶F6.3-18 After Program managers learned about the foam strike, their belief that it would not

be a problem was confirmed (early, and without analysis) by a trusted expert who was readily accessible and spoke from "experience." No one in management questioned this conclusion.

¶F6.3-19 Managers asked "Whoʼs requesting the photos?" instead of assessing the merits of

the request. Management seemed more concerned about the staff following proper channels (even while they were themselves taking informal advice) than they were about the analysis.

¶F6.3-20 No one in the operational chain of command for STS-107 held a security clearance

that would enable them to understand the capabilities and limitations of National imagery resources.

¶F6.3-21 Managers associated with STS-107 began investigating the implications of the foam strike on the launch schedule, and took steps to expedite post-flight analysis. F6.3-22 Program managers required engineers to prove that the debris strike created a safety-

of-flight issue: that is, engineers had to produce evidence that the system was unsafe rather than prove that it was safe.

¶F6.3-23 In both the Mission Evaluation Room and Mission Management Team meetings over

the Debris Assessment Teamʼs results, the focus was on the bottom line – was there a safety-of-flight issue, or not? There was little discussion of analysis, assumptions, issues, or ramifications.

¶Communication

¶F6.3-24 Communication did not flow effectively up to or down from Program managers. F6.3-25 Three independent requests for imagery were initiated. F6.3-26 Much of Program managersʼ information came through informal channels, which prevented relevant opinion and analysis from reaching decision makers. F6.3-27 Program Managers did not actively communicate with the Debris Assessment Team.

Partly as a result of this, the Team went through institutional, not mission-related, channels with its request for imagery, and confusion surrounded the origin of imagery requests and their subsequent denial.

¶F6.3-28 Communication was stifled by the Shuttle Program attempts to find out who had a

¶"mandatory requirement" for imagery.

¶Safety Representativeʼs Role

¶F6.3-29 Safety representatives from the appropriate organizations attended meetings of the

Debris Assessment Team, Mission Evaluation Room, and Mission Management Team, but were passive, and therefore were not a channel through which to voice concerns or dissenting views.

¶Recommendation:

¶R6.3-1 Implement an expanded training program in which the Mission Management Team

faces potential crew and vehicle safety contingences beyond launch and ascent. These contingences should involve potential loss of Shuttle or crew, contain numerous uncertainties and unknowns, and require the Mission Management Team to assemble and interact with support organizations across NASA/Contractor lines and in various locations.

¶R6.3-2 Modify the Memorandum of Agreement with the National Imagery and Mapping

Agency (NIMA) to make the imaging of each Shuttle flight while on orbit a standard requirement.

173