SPACE SHUTTLE PROGRAM

Space Shuttle Projects Office (MSFC) NASA Marshall Space Flight Center, Huntsville, Alabama

¶er, NASA/MP31 Presenter Jerry Smelser, NASA/MP31 02 Page 3

¶STS-112/ET-115 Bipod Ramp Foam Loss Date October 31, 2002 Page 4

Rationale for Flight

Current bipod ramp closeout has not been changed since STS-54 (ET-51)

Prior to Foam Closeout • The Orbiter has not yet experienced "Safety of Flight" damage from loss of foam in After Final Foam Trim 112 flights (including 3 known flights with bipod ramp foam loss) • There have been no design / process / equipment changes over the last 60

¶m on

¶ETs (flights) mp

• All ramp closeout work (including ET-115 and ET-116) was performed by experienced practitioners (all over 20 years experience each) • Ramp foam application involves craftmanship in the use of Bipod Attach Fitting validated application processess • No change in Inspection / Process control / Post application handling, etc

Probability of loss of ramp TPS is no higher/no lower than previous flights

The ET is safe to fly with no new concerns (and no added risk)

¶Figure 6.1-5. These two briefing slides are from the STS-113 Flight Readiness Review. The first and third bullets on the right-hand slide are incorrect since the design of the bipod ramp had changed several times since the flights listed on the slide.

126

¶This rationale is seriously flawed. The first and third statements listed under "Rationale for Flight" are incorrect. Contrary to the chart, which was presented by Jerry Smelser, the Program Manager for the External Tank Project, the bipod ramp design had changed, as of External Tank-76. This casts doubt on the implied argument that because the design had not changed, future bipod foam events were unlikely to occur. Although the other points may be factually correct, they provide an exceptionally weak rationale for safe flight. The fact that ramp closeout work was "performed by experienced practitioners" or that "application involves craftsmanship in the use of validated application processes" in no way decreases the chances of recurrent foam loss. The statement that the "probability of loss of ramp Thermal Protection System is no higher/no lower than previous flights" could be just as accurately stated "the probability of bipod foam loss on the next flight is just as high as it was on previous flights." With no engineering analysis, Shuttle managers used past success as a justification for future flights, and made no change to the External Tank configurations planned for STS-113, and, subsequently, for STS-107.

¶Along with this chart, the NASA Headquarters Safety Office presented a report that estimated a 99 percent probability of foam not being shed from the same area, even though no corrective action had been taken following the STS-112 foam-shedding.16 The ostensible justification for the 99 percent figure was a calculation of the actual rate of bipod loss over 61 flights. This calculation was a sleight- of-hand effort to make the probability of bipod foam loss appear low rather than a serious grappling with the probability of bipod ramp foam separating. For one thing, the calculation equates the probability of left and right bipod loss, when right bipod loss has never been observed, and the amount of imagery available for left and right bipod events differs. The calculation also miscounts the actual number of bipod ramp losses in two ways. First, by restricting the sample size to flights between STS-112 and the last known bipod ramp loss, it excludes known bipod ramp losses from STS-7, STS-32R, and STS-50. Second, by failing to project the statistical rate of bipod loss across the many missions for which no bipod imagery is available, the calculation assumes a "what you donʼt see wonʼt hurt you" mentality when in fact the reverse is true. When the statistical rate of bipod foam loss is projected across missions for which imagery is not available, and the sample size is extended to include every mission from STS-1 on, the probability of bipod loss increases dramatically. The Boardʼs review after STS-107, which included the discovery of two additional bipod ramp losses that NASA had not previously noted, concluded that bipod foam loss occurred on approximately 10 percent of all missions.

¶During the brief at STS-113ʼs Flight Readiness Review, the Associate Administrator for Safety and Mission Assurance scrutinized the Integration Hazard Report 37 conclusion that debris-shedding was an accepted risk, as well as the External Tank Projectʼs rationale for flight. After confer- ring, STS-113 Flight Readiness Review participants ultimately agreed that foam shedding should be characterized as an "accepted risk" rather than a "not a safety-of-flight" issue. Space Shuttle Program management accepted this

¶rationale, and STS-113ʼs Certificate of Flight Readiness was signed.

¶The decision made at the STS-113 Flight Readiness Review seemingly acknowledged that the foam posed a threat to the Orbiter, although the continuing disagreement over whether foam was "not a safety of flight issue" versus an "accepted risk" demonstrates how the two terms became blurred over time, clouding the precise conditions under which an increase in risk would be permitted by Shuttle Program management. In retrospect, the bipod foam that caused a 4- by 3-inch gouge in the foam on one of Atlantisʼ Solid Rocket Boosters – just months before STS-107 – was a "strong signal" of potential future damage that Shuttle engineers ignored. Despite the significant bipod foam loss on STS-112, Shuttle Program engineers made no External Tank configuration changes, no moves to reduce the risk of bipod ramp shedding or potential damage to the Orbiter on either of the next two flights, STS-113 and STS-107, and did not update Integrated Hazard Report 37. The Board notes that although there is a process for conducting hazard analyses when the system is designed and a process for re-evaluating them when a design is changed or the component is replaced, no process addresses the need to update a hazard analysis when anomalies occur. A stronger Integration Office would likely have insisted that Integrated Hazard Analysis 37 be updated. In the course of that update, engineers would be forced to consider the cause of foam-shedding and the effects of shedding on other Shuttle elements, including the Orbiter Thermal Protection System.

¶STS-113 launched at night, and although it is occasionally possible to image the Orbiter from light given off by the Solid Rocket Motor plume, in this instance no imagery was obtained and it is possible that foam could have been shed.

¶The acceptance of the rationale to fly cleared the way for Columbiaʼs launch and provided a method for Mission managers to classify the STS-107 foam strike as a maintenance and turnaround concern rather than a safety-of-flight issue. It is significant that in retrospect, several NASA managers identified their acceptance of this flight rationale as a serious error.

¶The foam-loss issue was considered so insignificant by some Shuttle Program engineers and managers that the STS-107 Flight Readiness Review documents include no discussion of the still-unresolved STS-112 foam loss. According to Program rules, this discussion was not a requirement because the STS-112 incident was only identified as an "action," not an In-Flight Anomaly. However, because the action was still open, and the date of its resolution had slipped, the Board believes that Shuttle Program managers should have addressed it. Had the foam issue been discussed in STS-107 pre-launch meetings, Mission managers may have been more sensitive to the foam-shedding, and may have taken more aggressive steps to determine the extent of the damage.

¶The seventh and final known bipod ramp foam loss occurred on January 16, 2003, during the launch of Columbia on STS-107. After the Columbia bipod loss, the Program Requirements Control Board deemed the foam loss an In-Flight Anomaly to be dealt with by the External Tank Project.

127

¶Other Foam/Debris Events num plate, Gibson stated during a presentation to the Board

¶To better understand how NASAʼs treatment of debris strikes evolved over time, the Board investigated missions where debris was shed from locations other than the External Tank bipod ramp. The number of debris strikes to the Orbitersʼ lower surface Thermal Protection System that resulted in tile damage greater than one inch in diameter is shown in Figure 6.1-6.17 The number of debris strikes may be small, but a single strike could damage several tiles (see Figure 6.1-7).

¶One debris strike in particular foreshadows the STS-107 event. When Atlantis was launched on STS-27R on December 2, 1988, the largest debris event up to that time significantly damaged the Orbiter. Post-launch analysis of tracking camera imagery by the Intercenter Photo Working Group identified a large piece of debris that struck the Thermal Protection System tile at approximately 85 seconds into the flight. On Flight Day Two, Mission Control asked the flight crew to inspect Atlantis with a camera mounted on the remote manipulator arm, a robotic device that was not installed on Columbia for STS-107. Mission Commander R.L. "Hoot" Gibson later stated that Atlantis "looked like it had been blasted by a shotgun."18 Concerned that the Orbiterʼs Thermal Protection System had been breached, Gibson or- dered that the video be transferred to Mission Control so that NASA engineers could evaluate the damage.

¶When Atlantis landed, engineers were surprised by the extent of the damage. Post-mission inspections deemed it "the most severe of any mission yet flown."19 The Orbiter had 707 dings, 298 of which were greater than an inch in one dimension. Damage was concentrated outboard of a line right of the bipod attachment to the liquid oxygen umbilical line. Even more worrisome, the debris had knocked off a tile, exposing the Orbiterʼs skin to the heat of re-entry. Post-flight analysis concluded that structural damage was confined to the exposed cavity left by the missing tile, which happened to be at the location of a thick aluminum plate covering an L-band navigation antenna. Were it not for the thick alumi-

¶Lower surface damage dings >1 inch diameter 300

STS-26R OV-103, Flight 7

STS-27R OV-104, Flight 3

¶STS-17 Cause: SRB Ablative 150

¶OV-099, Flight 6

STS-7 STS-50 STS-32R STS-52

¶STS-11 STS-16 STS-19 STS-23 STS-25 STS-27 STS-30 STS-32

6 8 36 41 35 39 43 44 45 — 50

¶26R 29R 28R 33R

¶that a burn-through may have occurred.20

¶The Board notes the distinctly different ways in which the STS-27R and STS-107 debris strike events were treated. After the discovery of the debris strike on Flight Day Two of STS-27R, the crew was immediately directed to inspect the vehicle. More severe thermal damage – perhaps even a burn-through – may have occurred were it not for the aluminum plate at the site of the tile loss. Fourteen years later, when a debris strike was discovered on Flight Day Two of STS-107, Shuttle Program management declined to have the crew inspect the Orbiter for damage, declined to request on-orbit imaging, and ultimately discounted the possibility of a burn-through. In retrospect, the debris strike on STS-27R is a "strong signal" of the threat debris posed that should have been considered by Shuttle management when STS-107 suffered a similar debris strike. The Board views the failure to do so as an illustration of the lack of institutional memory in the Space Shuttle Program that supports the Boardʼs claim, discussed in Chapter 7, that NASA is not functioning as a learning organization.

¶After the STS-27R damage was evaluated during a postflight inspection, the Program Requirements Control Board assigned In-Flight Anomalies to the Orbiter and Solid Rocket Booster Projects. Marshall Sprayable Ablator (MSA-1) material found embedded in an insulation blanket on the right Orbital Maneuvering System pod confirmed that the ablator on the right Solid Rocket Booster nose cap was the most likely source of debris.21 Because an improved ablator material (MSA-2) would now be used on the Solid Rocket Booster nose cap, the issue was considered "closed" by the time of the next missionʼs Flight Readiness Review. The Orbiter Thermal Protection System review team concurred with the use of the improved ablator without reservation.

¶An STS-27R investigation team notation mirrors a Columbia Accident Investigation Board finding. The STS-27R investigation noted: "it is observed that program emphasis

¶Bipod Ramp Foam Loss Event

STS-87 OV-102, Flight 24 STS-73 Cause: ET Intertank Foam OV-102, Flight 18

¶STS-112

¶STS-107

65 68 63 71 69 74 75 77 79 81 83 94 86 89 91 88 93 99 99 92 98 100 105 109 111 — 113

¶Figure 6.1-6. This chart shows the number of dings greater than one inch in diameter on the lower surface of the Orbiter after each mission from STS-6 through STS-113. Flights where the bipod ramp foam is known to have come off are marked with a red triangle.

128