MISSION DATE COMMENTS

¶STS-1 April 12, 1981 Lots of debris damage. 300 tiles replaced.

¶STS-7 June 18, 1983 First known left bipod ramp foam shedding event.

¶STS-27R December 2, 1988 Debris knocks off tile; structural damage and near burn through results.

¶STS-32R January 9, 1990 Second known left bipod ramp foam event.

¶First time NASA calls foam debris "safety of flight issue," and "re-use or turn-

¶STS-35 December 2, 1990 around issue."

¶First mission after which the next mission (STS-45) launched without debris In-

¶STS-42 January 22, 1992

¶Flight Anomaly closure/resolution.

¶Damage to wing RCC Panel 10-right. Unexplained Anomaly, "most likely orbital

¶STS-45 March 24, 1992 debris."

¶STS-50 June 25, 1992 Third known bipod ramp foam event. Hazard Report 37: an "accepted risk."

¶STS-52 October 22, 1992 Undetected bipod ramp foam loss (Fourth bipod event).

¶Acreage tile damage (large area). Called "within experience base" and consid-

¶STS-56 April 8, 1993 ered "in family."

¶STS-62 October 4, 1994 Undetected bipod ramp foam loss (Fifth bipod event).

¶Damage to Orbiter Thermal Protection System spurs NASA to begin 9 flight

¶STS-87 November 19, 1997 tests to resolve foam-shedding. Foam fix ineffective. In-Flight Anomaly eventually closed after STS-101 as "accepted risk."

¶Sixth known left bipod ramp foam loss. First time major debris event not assigned

¶STS-112 October 7, 2002 an In-Flight Anomaly. External Tank Project was assigned an Action. Not closed out until after STS-113 and STS-107.

¶STS-107 January 16, 2003 Columbia launch. Seventh known left bipod ramp foam loss event.

¶Figure 6.1-7. The Board identified 14 flights that had significant Thermal Protection System damage or major foam loss. Two of the bipod foam loss events had not been detected by NASA prior to the Columbia Accident Investigation Board requesting a review of all launch images.

¶and attention to tile damage assessments varies with severity tank to the intertank. An In-Flight Anomaly was assigned and that detailed records could be augmented to ease trend to the External Tank Project, which closed it by stating that maintenance" (emphasis added).22 In other words, Space there was no increase in Orbiter Thermal Protection System Shuttle Program personnel knew that the monitoring of damage and that it was "not a safety-of-flight concern."24 tile damage was inadequate and that clear trends could be The Board notes that it was in a discussion at the STS-36 more readily identified if monitoring was improved, but no Flight Readiness Review that NASA first identified this such improvements were made. The Board also noted that problem as a turnaround issue.25 Per established procedures, an STS-27R investigation team recommendation correlated NASA was still designating foam-loss events as In-Flight to the Columbia accident 14 years later: "It is recommended Anomalies and continued to make various corrective ac- that the program actively solicit design improvements ditions, such as drilling more vent holes and improving the rected toward eliminating debris sources or minimizing foam application process. damage potential."23

¶Discovery was launched on STS-42 on January 22, 1992. A Another instance of non-bipod foam damage occurred on total of 159 hits on the Orbiter Thermal Protection System STS-35. Post-flight inspections of Columbia after STS-35 in were noted after landing. Two 8- to 12-inch-diameter div- December 1990, showed a higher-than-average amount of ots in the External Tank intertank area were noted during damage on the Orbiterʼs lower surface. A review of External post-External Tank separation photo evaluation, and these Tank separation film revealed approximately 10 areas of pieces of foam were identified as the most probable sources missing foam on the flange connecting the liquid hydrogen of the damage. The External Tank Project was assigned an

129

¶In-Flight Anomaly, and the incident was later described as an unexplained or isolated event. However, at later Flight Readiness Reviews, the Marshall Space Flight Center briefed this as being "not a safety-of-flight" concern.26 The next flight, STS-45, would be the first mission launched before the foam-loss In-Flight Anomaly was closed.

¶On March 24, 1992, Atlantis was launched on STS-45. Post-mission inspection revealed exposed substrate on the upper surface of right wing leading edge Reinforced Carbon-Carbon (RCC) panel 10 caused by two gouges, one 1.9 inches by 1.6 inches and the other 0.4 inches by 1 inch.27 Before the next flight, an In-Flight Anomaly assigned to the Orbiter Project was closed as "unexplained," but "most likely orbital debris."28 Despite this closure, the Safety and Mission Assurance Office expressed concern as late as the pre-launch Mission Management Team meeting two days before the launch of STS-49. Nevertheless, the mission was cleared for launch. Later laboratory tests identified pieces of man-made debris lodged in the RCC, including stainless steel, aluminum, and titanium, but no conclusion was made about the source of the debris. (The Board notes that this indicates there were transport mechanisms available to determine the path the debris took to impact the wing leading edge. See Section 3.4.)

¶The Program Requirements Control Board also assigned the External Tank Project an In-Flight Anomaly after foam loss on STS-56 (Discovery) and STS-58 (Columbia), both of which were launched in 1993. These missions demonstrate the increasingly casual ways in which debris impacts were dispositioned by Shuttle Program managers. After postflight analysis determined that on both missions the foam had come from the intertank and bipod jackpad areas, the rationale for closing the In-Flight Anomalies included nota- tions that the External Tank foam debris was "in-family," or within the experience base.29

¶During the launch of STS-87 (Columbia) on November 19, 1997, a debris event focused NASAʼs attention on debris-shedding and damage to the Orbiter. Post-External Tank separation photography revealed a significant loss of material from both thrust panels, which are fastened to the Solid Rocket Booster forward attachment points on the intertank structure. Post-landing inspection of the Orbiter noted 308 hits, with 244 on the lower surface and 109 larger than an inch. The foam loss from the External Tank thrust panels was suspected as the most probable cause of the Orbiter Thermal Protection System damage. Based on data from post-flight inspection reports, as well as comparisons with statistics from 71 similarly configured flights, the total number of damage sites, and the number of damage sites one inch or larger, were considered "out-of-family."30 An investigation was conducted to determine the cause of the material loss and the actions required to prevent a recurrence.

¶The foam loss problem on STS-87 was described as "popcorning" because of the numerous popcorn-size foam particles that came off the thrust panels. Popcorning has always occurred, but it began earlier than usual in the launch of STS-87. The cause of the earlier-than-normal popcorning (but not the fundamental cause of popcorning) was traced

¶back to a change in foam-blowing agents that caused pressure buildups and stress concentrations within the foam. In an effort to reduce its use of chlorofluorocarbons (CFCs), NASA had switched from a CFC-11 (chlorofluorocarbon) blowing agent to an HCFC-141b blowing agent beginning with External Tank-85, which was assigned to STS-84. (The change in blowing agent affected only mechanically applied foam. Foam that is hand sprayed, such as on the bipod ramp, is still applied using CFC-11.)

¶The Program Requirements Control Board issued a Directive and the External Tank Project was assigned an In-Flight Anomaly to address the intertank thrust panel foam loss. Over the course of nine missions, the External Tank Project first reduced the thickness of the foam on the thrust panels to minimize the amount of foam that could be shed; and, due to a misunderstanding of what caused foam loss at that time, put vent holes in the thrust panel foam to relieve trapped gas pressure.

¶The In-Flight Anomaly remained open during these changes, and foam shedding occurred on the nine missions that tested the corrective actions. Following STS-101, the 10th mission after STS-87, the Program Requirements Control Board concluded that foam-shedding from the thrust panel had been reduced to an "acceptable level" by sanding and venting, and the In-Flight Anomaly was closed.31 The Orbiter Project, External Tank Project, and Space Shuttle Program management all accepted this rationale without question. The Board notes that these interventions merely reduced foam-shedding to previously experienced levels, which have remained relatively constant over the Shuttleʼs lifetime.

¶Making the Orbiter More Resistant To Debris Strikes

¶If foam shedding could not be prevented entirely, what did NASA do to make the Thermal Protection System more resistant to debris strikes? A 1990 study by Dr. Elisabeth Paté-Cornell and Paul Fishback attempted to quantify the risk of a Thermal Protection System failure using probabilistic analysis.32 The data they used included (1) the probability that a tile would become debonded by either debris strikes or a poor bond, (2) the probability of then losing adjacent tiles, (3) depending on the final size of the failed area, the probability of burn-through, and (4) the probability of failure of a critical sub-system if burn-through occurs. The study concluded that the probability of losing an Orbiter on any given mission due to a failure of Thermal Protection System tiles was approximately one in 1,000. Debris-related problems accounted for approximately 40 percent of the probability, while 60 percent was attributable to tile debonding caused by other factors. An estimated 85 percent of the risk could be attributed to 15 percent of the "acreage," or larger areas of tile, meaning that the loss of any one of a relatively small number of tiles pose a relatively large amount of risk to the Orbiter. In other words, not all tiles are equal – losing certain tiles is more dangerous. While the actual risk may be different than that computed in the 1990 study due to the limited amount of data and the underlying simplified assumptions, this type of analysis offers insight that enables management to concentrate their resources on protecting the Orbitersʼ critical areas.

130

¶Two years after the conclusion of that study, NASA wrote to Paté-Cornell and Fishback describing the importance of their work, and stated that it was developing a long-term effort to use probabilistic risk assessment and related disciplines to improve programmatic decisions.33 Though NASA has taken some measures to invest in probabilistic risk assessment as a tool, it is the Boardʼs view that NASA has not fully exploited the insights that Paté-Cornellʼs and Fishbackʼs work offered.34

¶Impact Resistant Tile

¶NASA also evaluated the possibility of increasing Thermal Protection System tile resistance to debris hits, lowering the possibility of tile debonding, and reducing tile production and maintenance costs.35 Indeed, tiles with a "tough" coating are currently used on the Orbiters. This coating, known as Toughened Uni-piece Fibrous Insulation (TUFI), was patented in 1992 and developed for use on high-temperature rigid insulation.36 TUFI is used on a tile material known as Alumina Enhanced Thermal Barrier (AETB), and has a debris impact resistance that is greater than the current acreage tileʼs resistance by a factor of approximately 6-20.37 At least 772 of these advanced tiles have been installed on the Orbitersʼ base heat shields and upper body flaps.38 However, due to its higher thermal conductivity, TUFI-coated AETB cannot be used as a replacement for the larger areas of tile coverage. (Boeing, Lockheed Martin and NASA are developing a lightweight, impact-resistant, low-conductivity tile.39) Because the impact requirements for these next-generation tiles do not appear to be based on resistance to specific (and probable) damage sources, it is the Boardʼs view that certification of the new tile will not adequately address the threat posed by debris.

¶Conclusion

¶Despite original design requirements that the External Tank not shed debris, and the corresponding design requirement that the Orbiter not receive debris hits exceeding a trivial amount of force, debris has impacted the Shuttle on each flight. Over the course of 113 missions, foam-shedding and other debris impacts came to be regarded more as a turnaround or maintenance issue, and less as a hazard to the vehicle and crew.

¶Assessments of foam-shedding and strikes were not thoroughly substantiated by engineering analysis, and the process for closing In-Flight Anomalies is not well-documented and appears to vary. Shuttle Program managers appear to have confused the notion of foam posing an "accepted risk" with foam not being a "safety-of-flight issue." At times, the pressure to meet the flight schedule appeared to cut short engineering efforts to resolve the foam-shedding problem.

¶NASAʼs lack of understanding of foam properties and be- F6.1−2 havior must also be questioned. Although tests were conducted to develop and qualify foam for use on the External Tank, it appears there were large gaps in NASAʼs knowledge about this complex and variable material. Recent testing conducted at Marshall Space Flight Center and under the auspices of the Board indicate that mechanisms previously

¶considered a prime source of foam loss, cryopumping and cryoingestion, are not feasible in the conditions experienced during tanking, launch, and ascent. Also, dissections of foam bipod ramps on External Tanks yet to be launched reveal subsurface flaws and defects that only now are being discovered and identified as contributing to the loss of foam from the bipod ramps.

¶While NASA properly designated key debris events as In- Flight Anomalies in the past, more recent events indicate that NASA engineers and management did not appreciate the scope, or lack of scope, of the Hazard Reports involving foam shedding.40 Ultimately, NASAʼs hazard analyses, which were based on reducing or eliminating foam-shedding, were not succeeding. Shuttle Program management made no adjustments to the analyses to recognize this fact. The acceptance of events that are not supposed to happen has been described by sociologist Diane Vaughan as the "normalization of deviance."41 The history of foam-problem decisions shows how NASA first began and then continued flying with foam losses, so that flying with these deviations from design specifications was viewed as normal and acceptable. Dr. Richard Feynman, a member of the Presidential Commission on the Space Shuttle Challenger Accident, discusses this phenomena in the context of the Challenger accident. The parallels are striking:

¶The phenomenon of accepting … flight seals that had shown erosion and blow-by in previous flights is very clear. The Challenger flight is an excellent example.

¶There are several references to flights that had gone before. The acceptance and success of these flights is taken as evidence of safety. But erosions and blow-by are not what the design expected. They are warnings that something is wrong … The O-rings of the Solid Rocket Boosters were not designed to erode. Erosion was a clue that something was wrong. Erosion was not something from which safety can be inferred … If a reasonable launch schedule is to be maintained, engineering often cannot be done fast enough to keep up with the expectations of originally conservative certification criteria designed to guarantee a very safe vehicle. In these situations, subtly, and often with apparently logical arguments, the criteria are altered so that flights may still be certified in time. They therefore fly in a relatively unsafe condition, with a chance of failure of the order of a percent (it is difficult to be more accurate).42

¶Findings

¶F6.1−1 NASA has not followed its own rules and require-

ments on foam-shedding. Although the agency continuously worked on the foam-shedding problem, the debris impact requirements have not been met on any mission.

¶F6.1−2 Foam-shedding, which had initially raised seri-

ous safety concerns, evolved into "in-family" or "no safety-of-flight" events or were deemed an "accepted risk."

¶F6.1−3 Five of the seven bipod ramp events occurred

on missions flown by Columbia, a seemingly high number. This observation is likely due to

131

Columbia having been equipped with umbilical cameras earlier than other Orbiters.

¶F6.1−4 There is lack of effective processes for feedback

or integration among project elements in the resolution of In-Flight Anomalies.

¶F6.1−5 Foam bipod debris-shedding incidents on STS-52

and STS-62 were undetected at the time they occurred, and were not discovered until the Board directed NASA to examine External Tank separation images more closely.

¶F6.1−6 Foam bipod debris-shedding events were clas-

sified as In-Flight Anomalies up until STS-112, which was the first known bipod foam-shedding event not classified as an In-Flight Anomaly.

¶F6.1−7 The STS-112 assignment for the External Tank

Project to "identify the cause and corrective action of the bipod ramp foam loss event" was not due until after the planned launch of STS-113, and then slipped to after the launch of STS-107.

¶F6.1−8 No External Tank configuration changes were made after the bipod foam loss on STS-112. F6.1−9 Although it is sometimes possible to obtain imag-

ery of night launches because of light provided by the Solid Rocket Motor plume, no imagery was obtained for STS-113.

¶F6.1−10 NASA failed to adequately perform trend analy-

sis on foam losses. This greatly hampered the agencyʼs ability to make informed decisions about foam losses.

¶F6.1−11 Despite the constant shedding of foam, the Shut-

tle Program did little to harden the Orbiter against foam impacts through upgrades to the Thermal Protection System. Without impact resistance and strength requirements that are calibrated to the energy of debris likely to impact the Orbiter, certification of new Thermal Protection System tile will not adequately address the threat posed by debris.

¶Recommendations:

None