Chain of Errors Doomed Shuttle : Many Factors Converged to Bring About Disaster

Benjamin Franklin said it 228 years ago: “A little neglect may breed great mischief . . . for want of a nail the shoe was lost; for want of a shoe the horse was lost, and for want of a horse the rider was lost.”

Thus, it appears, was lost the American spaceship Challenger with the lives of all seven aboard.

Nineteen days of frenetic investigation have yet to establish that “a little neglect” sparked the fireball that consumed the space shuttle on Jan. 28, but an accumulating chain of clues and evidence suggests just such an inexorable progression led to the worst tragedy of the Space Age.

That scenario was bolstered Saturday when William P. Rogers, the head of the presidential investigative commission, said that the decision-making process that led to the launching “may have been flawed.”

The massive inquiry by NASA and the special commission named by President Reagan have increasingly raised questions about two related issues: possible flaws in the Challenger’s elegant hardware and the question of whether pressure on the launch crews to meet NASA’s crowded schedules led to the shattering “great mischief.”

Official denials notwithstanding, there is substantial evidence that engineers and launch crews did work in an environment of intense and mounting pressure. The shuttle program was entering its busiest year ever, and it was doing so at a time when economic and other considerations militated strongly against delay.

‘Tremendous Pressure’

“Don’t let anybody kid you about that,” said a veteran engineer at the National Aeronautics and Space Administration’s Marshall Space Flight Center. “There was tremendous pressure on people at the working level.”

Ben Franklin’s words--an embellishment of George Herman’s lines written in 1633--echoed last week in the conversations of aerospace engineers from Washington to Houston to Huntsville to Cape Canaveral.

Less than two weeks after the accident, there was overwhelming evidence that the fatal sequence began in the innards of one of the 149-foot-tall solid rocket boosters bolted to the spacecraft’s huge external fuel tank.

The questions are how and why.

Was it a design weakness, a fatal risk taken by NASA management, a manufacturing flaw, one human lapse, even a peculiarity of the jet stream in the upper atmosphere that drove a Midwestern chill into central Florida? Incredibly, one NASA official said, all of these may have converged upon Challenger at the moment it took flight, one vulnerability interacting with another.

Where Did Fire Break Out?

Perhaps uppermost among the thousands of questions before investigators is whether the fire that broke out of the right solid booster came through the seam between two of the rocket’s segments or burned like a torch through the steel casing.

For now, the strongest suspicion is that the 5,900-degree blaze that exists inside the booster at launch did not burst through the steel sidewall but, instead, ate through the complex connection between two lower segments. Indeed, a scenario for a seam failure began to take shape four days after the accident.

It began with the release of pictures showing a plume of flame spurting from the side of the booster 58.77 seconds after liftoff, the beginning of a hellish fire that swirled beneath Challenger’s belly for 13 seconds before the massive external fuel tank exploded.

There followed the disclosure of space agency documents showing a longstanding concern over the performance--and possible failure--of the quarter-inch-thick synthetic rubber O-rings that extend around the circumference of the 12-foot-diameter booster.

These O-rings, two in each joint, provide the seal that is supposed to prevent the flames of the burning rocket propellant from reaching the mechanical steel structure that locks the booster’s segments together. Inspection of boosters recovered from the sea after previous shuttle flights turned up five instances in which a primary O-ring had been eroded, and one in which the backup, or secondary ring, had shown the effects of heat.

NASA studies showed that the tremendous surge of power at ignition of the boosters--with their 3.3 million pounds of thrust--created rotational stresses that could prevent the secondary O-ring from seating firmly into its gap.

After ignition of the massive solid boosters, their internal pressure surges from zero to 1,000 pounds per square inch in half a second. The surge causes even the steel rocket cases to bulge, but the connection between segments remains rigid.

For a fraction of a second, it is a situation comparable to a stiff elastic belt tied around a balloon being rapidly inflated: The resulting stresses try to pull the segments apart, subjecting the connections to their most severe test as the massive rockets bearing the 100-ton spaceship heave slowly upward.

Suspicion Reinforced

And the suspicion that the Challenger accident may have sprung from failure of an O-ring was reinforced last Thursday night when the presidential commission released photographs showing a puff of black smoke on the side of the suspect booster 0.445 seconds after ignition.

The puff of smoke came close to the time when the O-ring assembly would have experienced its most severe stress.

If these violent launch stresses prevented the secondary ring from seating properly, then only a quarter-inch band of man-made rubber stood between the American space program, the lives of the astronauts and disaster.

NASA had long recognized that the recurrent problems with the secondary O-rings, along with the occasional charring of the primary rings, confronted it with a “single failure point”--a situation where one malfunction would trigger disaster.

Despite that, it gave the O-ring an exemption from one of its most sacrosanct requirements--that any component directly vital to the safety of the shuttle and its crew have a complete backup system.

Pictures of the flame protruding from the booster 13 seconds before the explosion were not precise enough to pinpoint whether it came from a seam or through the wall of the casing.

But the puff of black smoke was taken by some experts as confirmation of a failure of the O-rings. “That is what you would expect if there had been a rupture of the seals,” said Gary Flandro, a professor at Georgia Institute of Technology.

A NASA booster expert concurred, speculating that the black puff was, in fact, soot escaping through the seal.

The first two of the six new photographs came at 0.67 seconds after ignition. They showed no evidence of the smoke, but a third picture at 1.80 seconds showed the puff clearly, extending upward from the joint between the two lowermost segments of the rocket where the flame appeared to break through about 57 seconds later.

The newest evidence did nothing to blunt speculation that the O-rings had been affected by the unusually cold weather. Nor, apparently, did it eliminate the possibility that a tiny inspection port was left open, providing a direct route for the flame to break out.

Torrent of Flame

According to engineers familiar with the booster system, an opening even as small as the inspection port would have permitted a searing torrent of flame to escape within seconds.

NASA officials carefully skirted the possibility of an open inspection port when they were asked about it at their only press conference since the accident.

When the O-rings are put in place during the assembly of the solid boosters, their seal is verified by forcing pressure between them, using a port the diameter of the needle used to inflate a football.

After this test is completed, the port is closed by screwing a threaded plug into it. It is later checked in the course of three inspections, the first by the installer, the second by a contractor representative and the third by a government inspector.

But it is a situation tailor-made for human frailty. One NASA engineer, who declined to be identified, questioned whether the practice of multiple inspections could be counterproductive. “I believe we should ask whether it might cause people, in times of fatigue, to shift their responsibility to others,” he said.

“It is not difficult to envision an inspector skipping an item because he is sure that the next inspector will check it, or the last inspector assuming that the two people ahead of him checked it.”

The proof of whether the failure occurred at a seam or within a rocket segment probably lies on the floor of the Atlantic, where the remains of the solid boosters plunged down from space.

Officials believe the casings, ripped apart by a destruct device, now lie at a depth of about 1,100 feet, about 40 miles offshore, meaning that it will be difficult to bring them up even if they remain intact.

Even if efforts to recover them fail, NASA sources said it may be possible to get pictures that would establish whether the failure was at a seam or a burn-through.

Booster experts interviewed in recent days said they consider the seam failure far more likely. If there were a basic design flaw causing the kind of uneven burning of the propellant that would lead to a burn-through of the casing, it would have shown up long before now, they said.

Cold temperatures also figured in another scenario for the disaster.

O-Rings Frozen?

Aviation Week and Space Technology magazine reported in its edition dated Feb. 17 that one possibility under intensive study is that a leak from the external tank containing super-cold liquid fuels had so chilled the solid booster that the O-rings were frozen and thus failed when the engines ignited.

According to the magazine, ice inspectors who visited the launch pad before Challenger’s liftoff found temperatures of 7 degrees and 9 degrees on the lower portion of the right-hand booster--much lower than the outside air temperature--but did not report the findings to launch managers.

NASA sources told The Times that experts studying photographs of moments leading up to ignition and the firing of the rockets turned up photographs several days ago, possibly showing smoke or vapor adjacent to the tank, which could have been a tell-tale sign of a fuel tank leak.

The suggestion that the seals between segments were frozen brittle by a leak of liquid rocket propellant was an ironic twist to an unfolding drama already heavy with irony. For a full week, speculation--encouraged in the second public hearing of the presidential commission--had been rife that the abnormally cold Florida weather at launch time had been the underlying cause of the disaster.

The commission planned to devote a coming session exclusively to the weather question, with at least one of its members--Nobel laureate Richard P. Feynman--on record as believing the weather was possibly a contributing factor.

Feynman suggested that the O-rings could have lost flexibility because of the cold and thus might have failed to seat themselves properly after ignition.

Others have suggested that flame-proof putty intended to protect the joint seals might have become loose because of the low temperature.

At the time of the launch, the air temperature was 38 degrees--13 degrees lower than on any previous shuttle liftoff, and it had dropped down into the 20s the previous night.

Because of the cold, the Challenger’s departure was delayed for two hours and, at one point during the previous night, booster experts from Morton Thiokol questioned whether it was advisable to go ahead with the flight when temperatures were far lower than previously experienced during launch operations.

Earlier, Aviation Week reported that the flame pouring from the side of the booster cut like a welding torch through the lower structure linking the booster and fuel tank. This was said to have permitted the rocket to pivot on the remaining attachment, swinging its tip into the upper portion of the external tank, causing the explosion.

THE LEADING SUSPECT: BOOSTER O-RINGS

NASA has not theorized what caused the escape of inferno-like exhaust from the side of Challenger’s right solid rocket booster, leading to the shuttle’s explosion. However, some NASA engineers and other solid rocket experts believe a defective seal between segments of the booster is to blame. The key element of the seals are two quarter-inch O-rings, which act like gaskets to prevent combustion from escaping between the fuel segments.

Experts say the seal could have failed if one ring became unseated during blastoff, leaving the other ring as the only barrier. That ring might have failed if cold temperatures made it brittle, if it were improperly made, or if inspection failed to detect flaws in installation.

Another possible suspect is the test port, an aperture in the seal that allows technicians to measure pressures inside. It might also be vulnerable to cold or faulty handling.