Article 2714 of net.space: Relay-Version: version B 2.10.3 4.3bsd-beta 6/6/85; site hadron.UUCP Path: hadron!rlgvax!seismo!lll-crg!styx!nike!ucbcad!ucbvax!ti-eg.CSNET!LINNIG From: LINNIG@ti-eg.CSNET (MIKE LINNIG) Newsgroups: net.space Subject: Presidents Commission Report (short form, 50 kbytes) Message-ID: <8606261011.AA06326@s1-b.arpa> Date: 26 Jun 86 10:15:25 GMT Date-Received: 27 Jun 86 02:59:34 GMT Sender: daemon@ucbvax.BERKELEY.EDU Organization: The ARPA Internet Lines: 1065 The "Report at a Glance" as prepared by The Presidential Commission WASHINGTON (AP) -- Here is the "Report at a Glance" as prepared by The Presidential Commission on the Space Shuttle Challenger Accident. It does not summarize every chapter of the full report, only those chosen for summary treatment by the commission. Preface The accident of Space Shuttle Challenger, mission 51-L, interrupting for a time one of the most productive engineering, scientific and exploratory programs in history, evoked a wide range of deeply felt public responses. There was grief and sadness for the loss of seven brave members of the crew; firm national resolve that those men and women be forever enshrined in the annals of American heroes, and a determination, based on that resolve and in their memory, to strengthen the Space Shuttle program so that this tragic event will become a milestone on the way to achieving the full potential that space offers to mankind. The President, who was moved and troubled by this accident in a very personal way, appointed an independent commission made up of persons not connected with the mission to investigate it. The mandate of the commission was to: 1. Review the circumstances surrounding the accident to establish the probable cause or causes of the accident; and 2. Develop recommendations for corrective or other action based upon the commission's findings and determinations. Immediately after being appointed, the commission moved forward with its investigation and, with the full support of the White House, held public hearings dealing with the facts leading up to the accident. In a closed society other options are available; in an open society -- unless classified matters are involved -- other options are not, either as matter of law or as a practical matter. In this case a vigorous investigation and full disclosure of the facts were necessary. The way to deal with a failure of this magnitude is to disclose all the facts fully and openly; to take immediate steps to correct mistakes that led to the failure; and to continue the program with renewed confidence and determination. The commission construed its mandate somewhat broadly to include recommendations on safety matters not necessarily involved in this accident but which require attention to make future flights safer. Careful attention was given to concerns expressed by astronauts because the Space Shuttle program will only succeed if the highly qualified men and women who fly the shuttle have confidence in the system. However, the commission did not construe its mandate to require a detailed investigation of all aspects of the Space Shuttle program; to review budgetary matters; or to interfere with or supersede Congress in any way in the performance of its duties. Rather, the commission focused its attention on the safety aspects of future flights based on the lessons learned from the investigation with the objective being to return to safe flight. Congress recognized the desirability, in the first instance, of having a single investigation of this national tragedy. It very responsibly agreed to await the commission's findings before deciding what further action might be necessary to carry out its responsibilities. For the first several days after the accident -- possibly because of the trauma resulting from the accident -- NASA appeared to be withholding information about the accident from the public. After the commission began its work, and at its suggestion, NASA began releasing a great deal of information that helped to reassure the public that all aspects of the accident were being investigated and that the full story was being told in an orderly and thorough manner. Following the suggestion of the commission, NASA established several teams of persons not involved in the mission 51-L launch process to support the commission and its panels. These NASA teams have cooperated with the commission in every aspect of its work. The result has been a comprehensive and complete investigation. The commission believes that its investigation and report have been responsive to the request of the president and hopes that they will serve the best interests of the nation in restoring the United States space program to its preeminent position in the world. The Accident Just after liftoff at .678 seconds into the flight, photographic data show a strong puff of gray smoke was spurting from the vicinity of the aft field joint on the right Solid Rocket Booster. The two pad 39B cameras that would have recorded the precise location of the puff were inoperative. Computer graphic analysis of film from other cameras indicated the initial smoke came from the 270 to 310-degree sector of the circumference of the aft field joint of the right Solid Rocket Booster. This area of the solid booster faces the External Tank. The vaporized material streaming from the joint indicated there was not complete sealing action within the joint. Eight more distinctive puffs of increasingly blacker smoke were recorded between .836 and 2.500 seconds. The smoke appeared to puff upwards from the joint. While each smoke puff was being left behind by the upward flight of the shuttle, the next fresh puff could be seen near the level of the joint. The multiple smoke puffs in this sequence occurred at about four times per second, approximating the frequency of the structural load dynamics and resultant joint flexing. Computer graphics applied to NASA photos from a variety of cameras in this sequence again placed the smoke puffs' origin in the 270-to 310-degree sector of the original smoke spurt. As the Shuttle increased its upward velocity, it flew past the emerging and expanding smoke puffs. The last smoke was seen above the field joint at 2.733 seconds. The black color and dense composition of the smoke puffs suggest that the grease, joint insulation and rubber O-rings in the joint seal were being burned and eroded by the hot propellant gases. At approximately 37 seconds, Challenger encountered the first of several high-altitude wind shear conditions, which lasted until about 64 seconds. The wind shear created forces on the vehicle with relatively large fluctuations. These were immediately sensed and countered by the guidance, navigation and control system. The steering system (trust vector control) of the Solid Rocket Booster responded to all commands and wind shear effects. The wind shear caused the steering system to be more active than on any previous flight. Both the shuttle main engines and the solid rockets operated at reduced thrust approaching and passing through the area of maximum dynamic pressure of 720 pounds per square foot. Main engines had been throttled up to 104 percent thrust and the Solid Rocket Boosters were increasing their thrust when the first flickering flame appeared on the right Solid Rocket Booster in the area of the aft field joint. This first very small flame was detected on image enhanced film at 58.788 seconds into the flight. It appeared to originate at about 305 degrees around the booster circumference at or near the aft field joint. One film frame later from the same camera, the flame was visible without image enhancement. It grew into a continuous, well-defined plume at 59.262 seconds. At about the same time (60 seconds), telemetry showed a pressure differential between the chamber pressures in the right and left boosters. The right booster chamber pressure was lower, confirming the growing leak in the area of the field joint. As the flame plume increased in size, it was deflected rearward by the aerodynamic slipstream and circumferentially by the protruding structure of the upper ring attaching the booster to the External Tank. These deflections directed the flame plume onto the surface of the External Tank. This sequence of flame spreading is confirmed by analysis of the recovered wreckage. The growing flame also impinged on the strut attaching the Solid Rocket Booster to the External Tank. The first visual indication that swirling flame from the right Solid Rocket Booster breached the External Tank was at 64.660 seconds when there was an abrupt change in the shape and color of the plume. This indicated that it was mixing with leaking hydrogen from the External Tank. Telemetered changes in the hydrogen tank pressurization confirmed the leak. Within 45 milliseconds of the breach of the External Tank, a bright sustained glow developed on the black-tiled underside of the Challenger between it and the External Tank. Beginning at about 72 seconds, a series of events occurred extremely rapidly that terminated the flight. Telemetered data indicate a wide variety of flight system actions that support the visual evidence of the photos as the shuttle struggled futilely against the forces that were destroying it. At about 72.20 seconds the lower strut linking the Solid Rocket Booster and the External Tank was severed or pulled away from the weakened hydrogen tank permitting the right Solid Rocket Booster to rotate around the upper attachment strut. This rotation is indicated by divergent yaw and pitch rates between the left and right Solid Rocket Boosters. At 73.124 seconds, a circumferential white vapor pattern was observed blooming from the side of the External Tank bottom dome. This was the beginning of the structural failure of the hydrogen tank that culminated in the entire aft dome dropping away. This released massive amounts of liquid hydrogen from the tank and created a sudden forward thrust of about 2.8 million pounds, pushing the hydrogen tank upward into the intertank structure. At about the same time, the rotating right Solid Rocket Booster impacted the intertank structure and the lower part of the liquid oxygen tank. These structures failed at 73.137 seconds as evidenced by the white vapors appearing in the intertank region. Within milliseconds there was massive, almost explosive, burning of the hydrogen streaming from the failed tank bottom and the liquid oxygen breach in the area of the intertank. At this point in its trajectory, while traveling at a Mach number of 1.92 at an altitude of 46,000 feet, the Challenger was totally enveloped in the explosive burn. The Challenger's reaction control system ruptured and a hypergolic burn of its propellants occurred as it exited the oxygen-hydrogen flames. The reddish brown colors of the hypergolic fuel burn are visible on the edge of the main fireball. The Orbiter, under severe aerodynamic loads, broke into several large sections which emerged from the fireball. Separate sections that can be identified on film include the main engine/tail section with the engines still burning, one wing of the Orbiter, and the forward fuselage trailing a mass of umbilical lines pulled loose from the payload bay. The Cause of the Accident The consensus of the commission and participating investigative agencies is that the loss of the Space Shuttle Challenger was caused by a failure in the joint between the two lower segments of the right Solid Rocket Motor. The specific failure was the destruction of the seals that are intended to prevent hot gases from leaking through the joint during the propellant burn of the rocket motor. The evidence assembled by the commission indicates that no other element of the Space Shuttle system contributed to this failure. In arriving at this conclusion, the commission reviewed in detail all available data, reports and records; directed and supervised numerous tests, analyses, and experiments by NASA, civilian contractors and various government agencies; and then developed specific failure scenarios and the range of most probable causative factors. Findings 1. A combustion gas leak through the right Solid Rocket Motor aft field joint initiated at or shortly after ignition eventually weakened and/or penetrated the External Tank initiating vehicle structural breakup and loss of the Space Shuttle Challenger during STS Mission 51-L. 2. The evidence shows that no other STS 51-L Shuttle element or the payload contributed to the causes of the right Solid Rocket Motor aft field joint combustion gas leak. Sabotage was not a factor. 3. Evidence examined in the review of Space Shuttle material, manufacturing, assembly, quality control, and processing of non-conformance reports found no flight hardware shipped to the launch site that fell outside the limits of shuttle design specifications. 4. Launch site activities, including assembly and preparation, from receipt of the flight hardware to launch were generally in accord with established procedures and were not considered a factor in the accident. 5. Launch site records show that the right Solid Rocket Motor segments were asembled using approved procedures. However, significant out-of-round conditions existed between the two segments joined at the right Solid Rocket Motor aft field joint (the joint that failed). a. While the assembly conditions had the potential of generating debris or damage that could cause O-ring seal failure, these were not considered factors in this accident. b. The diameters of the two Solid Rocket Motor segments had grown at a result of prior use. c. The growth resulted in a condition at time of launch wherein the maximum gap between the tang and clevis in the region of the joint's O-rings was no more than .008 inches and the average gap would have been .004 inches. d. With a tang-to-clevis gap of .004 inches, the O-ring in the joint would be compressed to the extent that it pressed against all three walls of the O-ring retaining channel. e. The lack of roundness of the segments was such that the smallest tang-to-clevis clearance occurred at the initiation of the assembly operation at positions of 120 degrees and 300 degrees around the circumference of the aft field joint. It is uncertain if this tight condition and the resultant greater compression of the O-rings at these points persisted to the time of launch. 6. The ambient temperature at time of launch was 36 degrees Fahrenheit, or 15 degrees lower than the next coldest previous launch. a. The temperature at the 300 degree position on the right aft field joint circumference was estimated to be 28 degrees plus/minus 5 degrees Fahrenheit. This was the coldest point on the joint. b. Temperature on the opposite side of the right Solid Rocket Booster facing the sun was estimated to be about 50 degrees Fahrenheit. 7. Other joints on the left and right Solid Rocket Boosters experienced similar combinations of tang-to-clevis gap clearance and temperature. It is not known whether these joints experienced distress during the flight of 51-L 8. Experimental evidence indicates that due to several effects associated with the Solid Rocket Booster's ignition and combustion pressures and associated vehicle motions, the gap between the tang and the clevis will open as much as .017 and .029 inches at the secondary and primary O-rings, respectively. a. This opening begins upon ignition, reaches its maximum rate of oppening at about 200-300 milliseconds, and is essentially complete at 600 milliseconds when the Solid Rocket Booster reaches its operating pressure. b. The External Tank and right Solid Rocket Booster are connected by several struts, including one at 310 degrees near the aft field joint that failed. This strut's effect on the joint dynamics is to enhance the opening of the gap between the tang and clevis by about 10-20 percent in the region of 300-320 degrees. 9. O-ring resiliency is directly related to its temperature. a. A warm O-ring that has been compressed will return to its original shape much quicker than will a cold O-ring when compression is relieved. Thus, a warm O-ring will follow the opening of the tang-to-clevis gap. A cold O-ring may not. b. A compressed O-ring at 75 degrees Fahrenheit is five times more responsive in returning to its uncompressed shape than a cold O-ring at 30 degrees Fahrenheit. c. As a result it is probable that the O-rings in the right solid booster aft field joint were not following the opening of the gap between the tang and clevis at time of ignition. 10. Experiments indicate that the primary mechanism that actuates O-ring sealing is the application of gas pressure to the upstream (high-pressure) side of the O-ring as itsits in its groove or channel. a. For this pressure actuation to work most effectively, a space between the O-ring and its upstream channel wall should exist during pressurization. b. A tang-to-clevis gap of .004 inches, as probably existed in the failed joint, would have initially compressed the O-ring to the degree that no clearance existed between the O-ring and its upstream channel wall and the other two surfaces of the channel. c. At the cold launch temperature experienced, the O-ring would be very slow in returning to its normal rounded shape. It would not follow the opening of the tang-to-clevis gap. It would remain in its compressed position in the O-ring channel and not provide a space between itself and the upstream channel wall. Thus, it is probable the O-ring would not be pressure actuated to seal the gap in time to preclude joint failure due to blow-by and erosion from hot combustion gases. 11. The sealing characteristics of the Solid Rocket Booster O-rings are enhanced by timely application of motor pressure. a. Ideally, motor pressure should be applied to actuate the O-ring and seal the joint prior to significant opening of the tang-to-clevis gap (100 to 200 milliseconds after motor ignition). b. Experimental evidence indicates that temperature, humidity and other variables in the putty compound used to seal the joint can delay pressure application to the joint by 500 milliseconds or more. c. this delay in pressure could be a factor in initial joint failure. 12. Of 21 launches with ambient temperatures of 61 degrees Fahrenheit or greater, only four showed signs of O-ring thermal distress; i.e., erosion or blow-by and soot. Each of the launches below 61 degrees Fahrenheit resulted in one or more O-rings showing signs of thermal distress. a. Of these improper joint sealing actions, one-half occurred in the aft field joints, 20 percent in the centerfield joints, and 30 percent in the upper field joints. the division between left and right Solid Rockter Boosters was roughly equal. b. Each instance of thermal O-ring distgress was accompanied by a leak path in the insulating putty. The leak path connects the rocket's combustion chamber with the O-ring region of the tang and clevis. Joints that actuated without incident may also have had these leak paths. 13. There is a possibility that there was water in the clevis of the STS 51-L joints since water was found in the STS-9 joints during a destack operation after exposure to less rainfall than STS 51-L. At time of launch, it was cold enough that water present in the joint would freeze. Tests show that ice in the joint can inhibit proper secondary seal performance. 14. A series of puffs of smoke were observed emanating from the 51-L aft field joint area of the right Solid Rocket Booster between 0.678 and 2.500 seconds after ignition of the Shuttle Solid Rocket Motors. a. The puffs appeared at a frequency of about three puffs per second. this roughly matches the natural structural frequency of the solids at lift off and is reflected in slight cyclic changes of the tang-to-clevis gap opening. b. The puffs were seen to be moving upward along the surface of the booster above the aft field joint. c. The smoke was estimated to originate at a circumferential position of between 270 degrees and 315 degrees on the booster aft field joint, emerging from the top of the joint. 15. This smoke from the aft field joint at shuttle lift off was the first sign of the failure of the Solid Rocket Booster O-ring seals on STS 51-L. 16. The leak was again clearly evident as a flame at approximately 58 seconds into the flight. It is possible that the leak was continuous but unobservable or non-existent in portions of the intervening period. It is possible in either case that thrust vectoring and normal vehicle response to wind shear as well as planned maneuvers reinitiated or magnified the leakage from a degraded seal in the period preceding the observed flames. The estimated position of the flame, centered at a point 307 degrees around the circumference of the aft field joint, was confirmed by the recovery of two fragments of the right Solid Rocket Booster. a. A small leak could have been present that may have grown to breach the joint in flame at a time on the order of 58 to 60 seconds after lift off. b. Alternatively, the O-ring gap could have been resealed by deposition of a fragile buildup of aluminum oxide and other combustion debris. This resealed section of the joint could have been disturbed by thrust vectoring. Space Shuttle motion and flight loads induced by changing winds aloft. c. The winds aloft caused control actions in the time interval of 32 seconds to 62 seconds into the flight that were typical of the largest values experienced on previous missions. Conclusion In view of the findings, the commission concluded that the cause of the Challenger accident was the failure of the pressure seal in the aft field joint of the right Solid Rocket Motor. The failure was due to a faulty design unacceptably sensitive to a number of factors. These factors were the effects of temperature, physical dimensions, the character of materials, the effects of reusability, processing, and the reaction of the joint to dynamic loading. The Contributing Cause of The Accident The decision to launch the Challenger was flawed. Those who made that decision were unaware of the recent history of problems concerning the O-rings and the joint and were unaware of the initial written recommendation of the contractor advising against the launch at temperatures below 53 degrees Fahrenheit and the continuing opposition of the engineers at Thiokol after the management reversed its position. they did not have a clear understanding of Rockwell's concern that it was not safe to launch because of ice on the pad. If the decisionmakers had known all of the facts, it is highly unlikely that they would have decided to launch 51-L on January 28, 1986. Findings 1. The commission concluded that there was a serious flaw in the decision making process leading up to the launch of flight 51-L. A well structured and managed system emphasizing safety would have flagged the rising doubts about the Solid Rocket Booster joint seal. Had these matters been clearly stated and emphasized in the flight readiness process in terms reflecting the views of most of the Thiokol engineers and at least some of the Marshall engineers, it seems likely that the launch of 51-L might not have occurred when it did. 2. The waiving of launch constraints appears to have been at the expense of flight safety. There was no system which made it imperative that launch constraints and waivers of launch contraints be considered by all levels of management. 3. The commission is troubled by what appears to be a propensity of management at Marshall to contain potentially serious problems and to attempt to resolve them internally rather than comunicate them forward. This tendency is altogether at odds with the need for Marshall to function as part of a system working toward successful flight missions, interfacing and communicating with the other parts of the system that work to the same end. 4. The commission concluded that the Thiokol Management reversed its position and recommended the launch of 51-L, at the urging of Marshall and contrary to the views of its engineers in order to accommodate a major customer. Findings The commission is concerned about three aspects of the ice-on-the-pad issue. 1. An analysis of all of the testimony and interviews establishes that Rockwell's recommendation on launch was ambiguous. The commission finds it difficult, as did Mr. Aldrich, to conclude that there was a no-launch recommendation. Moreover, all parties were asked specifically to contact Aldrich or Moore about launch objections due to weather. Rockwell made no phone calls or further objections to Aldrich or other NASA officials after the 9:00 Mission Management Team meeting and subsequent to the resumption of the countdown. 2. The commission is also concerned about the NASA response to the Rockwell position at the 9:00 a.m. meeting. While it is understood that decisions have to be made in launching a shuttle, the commission is not convinced Levels I and II appropriately considered Rockwell's concern about the ice. However ambiguous Rockwell's position was, it is clear that they did tell NASA that the ice was an unknown condition. Given the extent of the ice on the pad the admitted unknown effect of the Solid Rocket Motor and Space Shuttle Main Engines ignition on the ice, as well as the fact that debris striking the Orbiter was a potential flight safety hazard, the commission finds the decision to launch questionable under those circumstances. In this situation, NASA appeared to be requiring a contractor to prove that it was not safe to launch, rather than proving it was safe. Nevertheless, the commission has determined that the ice was not a cause of the 51-L accident and does not conclude that NASA's decision to launch specifically overrode a no-launch recommendation by an element contractor. 3. The commission concluded that the freeze protection plan for launch pad 39B was inadequate. The commission believes that the severe cold and presence of so much ice on the fixed service structure made it inadvisable to launch on the morning of January 28, and that margins of safety were whittled down too far. Additionally, access to the crew energency slide wire baskets was hazardous due to ice conditions. Had the crew been required to evacuate the Orbiter on the launch pad, they would have been running on an icy surface. The commission believes the crew should have been made aware of the situation, and based on the seriousness of the condition, greater consideration should have been given to delaying the launch. An Accident Rooted in History Early Design The Space Shuttle's Solid Rocket Booster problem began with the faulty design of its joint and increased as both NASA and contractor management first failed to recognize it as a problem, then failed to fix it and finally treated it as an acceptable flight risk. Morton Thiokol, Inc., the contractor, did not accept the implication of tests early in the program that the design had a serious and unanticipated flaw. NASA did not accept the judgment of its engineers that the design was unacceptable, and as the joint problems grew in number and severity NASA minimized them in management briefings and reports. Thiokol's stated position was that "the condition is not desirable but is acceptable." Neither Thiokol nor NASA expected the rubber O-rings sealing the joints to be touched by hot gases of motor ignition, much less to be partially burned. However, as tests and then flights confirmed damage to the sealing rings, the reaction by both NASA and Thiokol was to increase the amount of damage considered "acceptable." At no time did management either recommend a redesign of the joint or call for the shuttle's grounding until the problem was solved. Findings The genesis of the Challenger accident -- the failure of the joint of the right Solid Rocket Motor -- began with decisions made in the design of the joint and in the failure by both Thiokol and NASA's Solid Rocket Booster project office to understand and respond to facts obtained during testing. The commission has concluded that neither Thiokol nor NASA responded adequately to internal warnings about the faulty seal design. Furthermore, Thiokol and NASA did not make a timely attempt to develop and verify a new seal after the initial design was shown to be deficient. Neither organization developed a solution to the unexpected occurrences of O-ring erosion and blow-by even though this problem was experienced frequently during the shuttle flight history. Instead, Thiokol and NASA management came to accept erosion and blow-by as unavoidable and an acceptable flight risk. Specifically, the commission has found that: 1. The joint test and certification program was inadequate. There was no requirement to configure the qualifications test motor as it would be in flight, and the motors were static tested in a horizontal position, not in the vertical flight position. 2. Prior to the accident, neither NASA nor Thiokol fully understood the mechanism by which the joint sealing action took place. 3. NASA and Thiokol accepted escalating risk apparently because they "got away with it last time." As Commissioner Feynman observed, the decision making was: "a kind of Russian roulette . . . . (The shuttle) flies (with O-ring erosion) and nothing happens. Then it is suggested, therefore, that the risk is no longer so high for the next flights. We can lower our standards a little bit because we got away with it last time . . . . You got away with it, but it shouldn't be done over and over again like that." 4. NASAS's system for tracking anomalies for Flight Readiness Reviews failed in that, despite a history of persistent O-ring erosion and blow-by, flight was still permitted. It failed again in the strange sequence of six consecutive launch constraint waivers prior to 51-L, permitting it to fly without any record of a waiver, or even of an explicit constraint. Tracking and continuing only anomalies that are "outside the data base" of prior flight allowed major problems to be removed from, and lost by, the reporting system. 5. The O-ring erosion history presented to Level I at NASA Headquarters in August 1985 was sufficiently detailed to require corrective action prior to the next flight. 6. A careful analysis of the flight history of O-ring performance would have revealed the correlation of O-ring damage and low temperature. Neither NASA nor Thiokol carried out such an analysis; consequently, they were unprepared to properly evaluate the risks of launching the 51-L mission in conditions more extreme than they had encountered before. The Silent Safety Program The commission was surprised to realize after many hours of testimony that NASA's safety staff was never mentioned. No witness related the approval or disapproval of the reliability engineers, and none expressed the satisfaction or dissatisfaction of the quality assurance staff. No one thought to invite a safety representative or a reliability and quality assurance engineer to the January 27, 1986, teleconference between Marshall and Thiokol. Similarly, there was no representative of safety on the Mission Management Team that made key decisions during the countdown on January 28, 1986. The commission is concerned about the symptoms that it sees. The unrelenting pressure to meet the demands of an accelerating flight schedule might have been adequately handled by NASA if it had insisted upon the exactingly thorough procedures that were its hallmark during the Apollo program. An extensive and redundant safety program comprising interdependent safety, reliability and quality assurance functions existed during and after the lunar program to discover any potential safety problems. Between that period and 1986, however, the program became ineffective. this loss of effectiveness seriously degraded the checks and balances essential for maintaining flight safety. On April 3, 1986, Arnold Aldrich, the Space Shuttle program manager, appeared before the commission at a public hearing in Washington, D.C. He described five different comunication or organization failures that affected the launch decision on January 28, 1986. Four of those failures relate directly to faults within the safety program. these faults include a lack of problem reporting requirements, inadequate trend analysis, misrepresentation of criticality and lack of involvement in critical discussions. A properly staffed, supported, and robust safety organization might well have avoided these faults and thus eliminated the communication failures. NASA has a safety program to ensure that the communication failures to which Mr. Aldrich referred do not occur. In the case of mission 51-L, that program fell short. Findings 1. Reductions in the safety, reliability and quality assurance work force at Marshall and NASA Headquarters have seriously limited capability in those vital functions. 2. Organizational structures at Kennedy and Marshall have placed safety, reliability and quality assurance offices under the supervision of the very organizations and activities whose efforts they are to check. 3. Problem reporting requirements are not concise and fail to get critical information to the proper levels of management. 4. Little or no trend analysis was performed on O-ring erosion and blow-by problems. 5. As the flight rate increased, the Marshall safety, reliability and quality assurance work force was decreasing, which adversely affected mission safety. 6. Five weeks after the 51-L accident, the criticality of the Solid Rocket Motor field joint was still not properly documented in the problem reporting system at Marshall. Pressures on the System With the 1982 completion of the orbital flight test series, NASA began a planned acceleration of the Space Shuttle launch schedule. One early plan contemplated an eventual rate of a mission a week, but realism forced several downward revisions. In 1985, NASA published a projection calling for an annual rate of 24 flights by 1990. Long before the Challenger accident, however, it was becoming obvious that even the modified goal of two flights a month was overambitious. In establishing the schedule, NASA had not provided adequate resources for its attainment. As a result, the capabilities of the system were strained by the modest nine-mission rate of 1985, and the evidence suggests that NASA would not have been able to accomplish the 15 flights scheduled for 1986. These are the major conclusions of a commission examination of the pressures and problems attendant upon the accelerated launch schedule. Findings 1. The capabilities of the system were stretched to the limit to support the flight rate in winter 1985/1986. Projections into the spring and summer of 1986 showed a clear trend; the system, as it existed, would have been unable to deliver crew training software for scheduled flights by the designated dates. The result would have been an unacceptable compression of the time available for the crews to accomplish their required training. 2. Spare parts are in critically short supply. The shuttle program made a conscious decision to postpone spare parts procurements in favor of budget items of perceived higher priority. Lack of spare parts would likely have limited flight operations in 1986. 3. Stated manifesting policies are not enforced. Numerous late manifest changes (after the cargo integration review) have been made to both major payloads and minor payloads throughout the shuttle program. -- Late changes to major payloads or program requirements can require extensive resources (money, manpower, facilities) to implement. -- If many late changes to "minor" payloads occur, resources are quickly absorbed. -- Payload specialists frequently were added to a flight well after announced deadlines. -- Late changes to a mission adversely affect the training and development of procedures for subsequent missions. 4. The scheduled flight rate did not accurately reflect the capabilities and resources. -- The flight rate was not reduced to accommodate periods of adjustment in the capacity of the work force. There was no margin in the system to accommodate unforeseen hardware problems. -- Resources were primarily directed toward supporting the flights and thus not enough were available to improve and expand facilities needed to support a higher flight rate. 5. Training simulators may be the limiting factor on the flight rate: the two current simulators cannot train crews for more than 12-15 flights per year. 6. When flights come in rapid succession, current requirements do not ensure that critical anomalies occurring during one flight are identified and addressed appropriately before the next flight. WASHN: next flight. Other Safety Considerations In the course of its investigation, the commission became aware of a number of matters that played no part in the mission 51-L accident but nonetheless hold a potential for safety problems in the future. Some of these matters, those involving operational concerns, were brought directly to the commission's attention by the NASA astronaut office. They were the subject of a special hearing. Other areas of concern came to light as the commission pursued various lines of investigation in its attempt to isolate the cause of the accident. These inquiries examined such aspects as the development and operation of each of the elements of the Space Shuttle -- the Orbiter, its main engines and the External Tank; the procedures employed in the processing and assembly of 51-L, and launch damage. This chapter examines potential risks in two general areas. The first embraces critical aspects of a shuttle flight; for example, considerations related to a possible premature mission termination during the ascent phase and the risk factors connected with the demanding approach and landing phase. The other focuses on testing, processing and assembling the various elements of the shuttle. Ascent: A Critical Phase The events of flight 51-L dramatically illustrated the dangers of the first stage of a Space Shuttle ascent. The accident also focused attention on the issues of Orbiter short capabilities and crew escape. Of particular concern to the commission are the current abort capabilities, options to improve those capabilities, options for crew escape and the performance of the range sfety system. It is not the commission's intent to second-guess the Space Shuttle design or try to depict escape provisions that might have saved the 51-L crew. In fact, the events that led to destruction of the Challenger progressed very rapidly and without warning. Under those circumstances, the commission believes it is highly unlikely that any of the systems discussed below, or any combination of those systems, would have saved the flight 51-L crew. Findings 1. The Space Shuttle System wa not designed to survive a failure of the Solid Rocket Boosters. There are no corrective actions that cn be taken if the boosters do not operate properly after ignition, i.e., there is no ability to separate an Orbiter safely from thrusting boosters and no ability for the crew to escape the vehicle during first-stage ascent. -- Neither the Mission Control Team nor the 51-L crew had any warning of impending disaster. -- Even if there had been warning, there were no actions available to the crew or the Mission Control Team to avert the disaster. Landing Another Critical Phase The consequences of faulty performance in any dynamic and demanding flight environment can be catastrophic. The commission was concerned that an insufficient safety margin may have existed in areas other than shuttle ascent. Entry and landing of the shuttle are dynamic anbd demanding with all the risks and complications inherent in flying a heavyweight glider with a very steep glide path. Since the shuttle crew cannot divert to any alternate landing site after entry, the landing decision must be both timely and accurate. In addition, the landing gear, which includes wheels, tires and brakes, must function properly. In summary, although there are valid programmatic reasons to land routinely at Kennedy, there are concerns that suggest that this is not wise under the present circumstances. While planned landings at Edwards carry a cost in dollars and days, the realities of weather cannot be ignored. Shuttle program officials must recognize that Edwards is a permanent, essential part of the program. The cost associated with regular, scheduled landing and turnaround operations at Edwards is thus a necessary program cost. Decisions governing Space Shuttle operations must be consistent with the philosophy that unnecessary risks have to be eliminated. Such decisions cannot be made without a clear understanding of margins of sfety in each part of the system. Unfortunately, margins of safety cannot be assured if performance characteristics are not thoroughly understood, nor can they be deduced from a previous flight's "success." The Shuttle Program cannot afford to operate outside its experience in the areas of tires, brakes, and weather, with the capabilities of ther system today. Pending a clear understanding of all landing and deceleration systems, and a resolution of the problems encountered to date in shuttle landings, the most conservative course must be followed in order to minimize risk during this dynamic phase of flight. Shuttle Elements The Space Shuttle Main Engine teams at Marshall and Ricketdyne have developed engines that have achieved their performance goals and have performed extremely well. Nevertheless the main engines continue to be highly complex and critical components of the shuttle that involve an element of risk principally because importnt components of the engines degrade more rapidly with flight use than anticipated. Both NASA and Rocketdyne have taken steps to contain that risk. An important aspect of the main engine program has been the extensive "hot fire" ground tests. Unfortunately, the vitality of the test program has been reduced because of budgetary constraints. The number of engine test firings per month has decreased over the past two years. Yet this test program has not yet demonstrated the limits of engine operation parameters or included tests over the full operating envelope to show full engine capability. In addition, tests have not yet been deliberately conducted to the point of failure to determine actual engine operating margins. Recommendations The commission has conducted an extensive investigation of the Challenger accident to determine the probable cause and necessary corrective actions. Based on the findings and determinations of its investigation, the commission has unanimously adopted recommendations to help assure the return to safe flight. The commission urges that the administrator of NASA submit, one year from now, a report to the president on the progress that NASA has made in effecting the commission's recommendations set forth below: ONE Design. The faulty Solid Rocket Motor joint and seal must be changed. this could be a new design eliminating the joint or a redesign of the current joint and seal. No design options should be prematurely precluded because of schedule, cost or reliance on existing hardware. All Solid Rocket Motor joints should satisfy the following requirements: -- The joints should be fully understood, tested and verified. -- The integrity of the structure and of the seals of all joints should be not less than that of the case walls throughout the design envelope. -- The integrity of the joints should be insensitive to: -- Dimensional tolerances. -- Transportation and handling. -- Assembly procedures. -- Inspection and test procedures. -- Environmental effects. -- Internal case operating pressure. -- Recovery and reuse effects. -- Flight and water impact loads. -- The certification of the new design should include: -- Tests which duplicate the actual launch configuration as closely as possible. -- Full consideration should be given to conducting statis firings of the exact flight configuration in a vertical attitude. Independent Oversight. The Administrator of NASA should request the national Research Council to form an independent Solid Rocket Motor design oversight committee to implement the commission's design recommendations and oversee the design effort. This committee should: -- Review and evaluate certification requirements. -- Provide technical oversight of the design, test program and certification. -- Report to the Administrator of NASA on the adequacy of the design and make appropriate recommendations. TWO Shuttle Management Structure. The Shuttle Program Structure should be reviewed. the project managers for the various elements of the shuttle program felt more accountable to their center management than to the shuttle program organization. Shuttle element funding, work package definition, and vital program information frequently bypass the National STS (Shuttle) Program Manager. A redefinition of the Program Manager's responsibility is essential. This redefinition should give the Program Manager the requisite authority for all ongoing STS operations. Program funding and all Shuttle Program work at the centers should be placed clearly under the Program Manager's authority. Astronauts in Management. The commission observes that there appears to be a departure from the philosophy of the 1960s and 1970s relating to the use of astronauts in management positions. These individuals brought to their positions flight experience and a keen appreciation of operations and flight safety. -- NASA should encourage the trqansition of qualified astronauts into agency management positions. -- The function of the Flight Crew Operations director should be elevated in the NASA organization structure. Shuttle Safety Panel. NASA should establish an STS Safety Advisory Panel reporting to the STS Program Manager. The charter of this panel should include shuttle operational issues, launch commit criteria, flight rules, flight readiness and risk management. The panel should include representation from the safety organization, mission operations, and the astronaut office. THREE Criticality Review and Hazard Analysis. NASA and the primary shuttle contractors should review all Criticality 1, 1R, 2, and 2R items and hazard analyses. This review should identify those items that must be improved prior to flight to ensure mission success and flight safety. An Audit Panel, appointed by the National Research Council, should verify the adequacy of the effort and report directly to the Administrator of NASA. FOUR Safety Organization. NASA should establish an Office of Safety, Reliability and Quality Assurance to be eaded by an Associate Administrator, reporting directly to the NASA Administrator. It would have direct authority for safety, reliability, and quality assurance throughout the agency. The office should be assigned the work force to ensure adequate oversight of its functions and should be independent of other NASA functional and program responsibilities. The responsibilities of this office should include: -- The safety, reliability and quality assurance functions as they relate to all NASA activities and programs. -- Direction of reporting and documentation of problems, problem resolution and trends associated with flight safety. FIVE Improved Communications. The commission found that Marshall Space Flight Center project managers, because of a tendency at Marshall to management isolation, failed to provide full and timely information bearing on the sfety of flight 51-L to other vital elements of shuttle program management. -- NASA should take energetic steps to eliminate this tendency at Marshall Space Flight Center, whether by changes of personnel, organization, indoctrination or all three. -- A policy should be developed which governs the imposition and removal of shuttle launch constraints. -- Flight Readiness Reviews and Mission Management Team meetings should be recorded. -- The flight crew commander, or a designated representative, should attend the Flight Readiness Review, participate in acceptance of the vehicle for flight, and certify that the crew is properly prepared for flight. SIX Landing Safety. NASA must take actions to improve landing safety. -- The tire, brake and nosewheel steering systems must be improved. these systems do not have sufficient safety margin, particularly at abort landing sites. -- The specific conditions under which planned landings at Kennedy would be acceptable should be determined. Criteria must be established for tires, brakes and nosewheel steering. Until the systems meet those criteria in high fidelity testing that is verified at Edwards, landing at Kennedy should not be planned. -- Committing to a specific landing site requires that landing area weather be forecast more than an hour in advance. During unpredictable weather periods at Kennedy,, program officials should plan on Edwards landings. Increased landings at Edwards may necessitate a dual ferry capability. SEVEN Launch Abort and Crew Escape. The shuttle program management considered first-stage abort options and crew escape options several times during the history of the program, but because of limited utility, technical infeasibility, or program cost and schedule, no systems were implemented. The commission recommends that NASA: -- Make all efforts to provide a crew escape system for use during controlled gliding flight. -- Make every effort to increase the range of flight conditions under which an emergency runway landing can be successfully conducted in the event that two or three main engines fail early in ascent. EIGHT Flight Rate. The nation's reliance on the shuttle as its principal space launch capability created a relentless pressure on NASA to increase the flight rate. Such reliance on a single launch capability should be avoided in the future. NASA must establish a flight rate that is consistent with its resources. A firm payload assignment policy should be established. The policy should include rigorous controls on cargo manifest changes to limit the pressures such changes exert on schedules and crew training. NINE Maintenance Safeguards. Installation, test, and maintenance procedures must be especially rigorous for Space shuttle items designated Criticality 1. NASA should establish a system of analyzing and reporting performance trends of such items. Maintenance procedures for such items should be specified in the Critical Items List, especially for those such as the liquid-fueled main engines, which require unstinting maintenance and overhaul. With regard to the Orbiters, NASA should: -- Develop and execute a comprehensive maintenance inspection plan. -- Perform periodic structural inspections when scheduled and not permit them to be waived. -- Restore and support the maintenance and spare parts programs, and stop the practice of removing parts from one Orbiter to supply another. CONCLUDING THOUGHT The commission urges that NASA continue to receive the support of the Administration and the nation. The agency constitutes a national resource that plays a critical role in space exploration and development. It also provides a symbol of national pride and technological leadership. The commission applauds NASA's spectacular achievements of the past and anticipates impressive achievements to come. the findings and recommendations presented in this report are intended to contribute to the future NASA successes that the nation both expects and requires as the 21st century approaches.