Parts Wrongly Designed 13 Years Ago, Never Changed

Behind the expected conclusion that the immediate cause of the Challenger disaster was the failure of a rocket seal, the presidential commission investigating the Jan. 28 explosion reported a far more complex and disturbing account of the multibillion-dollar accident that claimed seven lives and NASA’s once-spotless reputation.

Using computer reconstructions of Challenger’s flight and small-scale tests of booster components, the panel concluded that the O-rings and the rocket joints they were supposed to protect were in fact wrongly designed 13 years before the doomed Challenger flight and never changed despite persistent doubts about their integrity.

For that, the panel indicted a National Aeronautics and Space Administration bureaucracy that ignored a crucial safety problem and a rocket maker, Morton Thiokol Inc., with an apparently equal distaste for bad news.

The panel stated that several previous shuttle missions skirted the same catastrophe that felled the Challenger flight. What may have doomed Challenger and spared the others, it implied, was an ominous conjunction of man-made and natural events.

The circumstances included soaking rains that may have formed puddles within the suspect rocket joint, frigid weather that reduced the O-rings’ resiliency, an asbestos joint putty that failed to perform as expected, a steel rocket section that was not perfectly round at a crucial location and launching stresses and gusty high-altitude winds that flexed and shook the booster at the worst possible points and times.

In purely physical terms, the panel stated, the destruction of the Challenger and its crew appears to have begun at 11:38.00.688 a.m. last Jan. 28--barely two-thirds of a second after the shuttle’s two solid rocket motors were ignited--as the spacecraft struggled to rise from Kennedy Space Center’s Pad 39B into its first inches of flight.

At that instant, a single jet of inky smoke spurted skyward from near a joint that connects two sections of the aft portion of the spacecraft’s right-hand booster rocket. It was followed 0.158 seconds later by a second jet of smoke; then, in the next 1.664 seconds, by seven more, escaping in rough syncopation with liftoff vibrations that were then flexing the left and right rocket boosters some three times a second.

In the two minutes before they burn off, the two rockets are supposed to propel the shuttle off the ground to a speed of about 1,900 m.p.h. The plumes emerged from that part of the right-hand rocket that abutted the shuttle’s external fuel tank. The huge red tank was actually two sheathed tanks, one filled with liquid hydrogen and the other with liquid oxygen, that fed the Challenger’s main engines and were meant to keep the shuttle on its course to orbit after the booster rockets had burned off.

First Plume Noted

No other abnormalities in the booster rocket were visible until some 58.8 seconds into the flight, when film of the mission revealed a first faint plume of rocket thrust bursting from the same location.

Less than a half-second later, the plume had become “continuous and well-defined,” the commission stated. At 60 seconds into the flight, thrust pressure in the right-hand rocket began to decline compared with that of the undamaged left-side booster. Then, according to the commission, the following sequence occurred in rapid-fire succession:

60.988 seconds: The plume continuously deflected off the external tank.

62 seconds: The shuttle’s left-hand booster began changing the direction of its thrust to offset the sideways push of escaping gas from the right booster leak.

64.660 seconds: Hydrogen began burning from a hole seared in the external tank.

72.2 seconds: The plume bored through the lower strut holding the booster to the external tank. The bottom of the rocket flailed outward, forcing the top into the oxygen-filled part of the external fuel tank.

73.124 seconds: The hydrogen tank began to disintegrate and the exploding gas “created a sudden forward thrust of about 2.8 million pounds,” pushing into and bursting the bottom of the oxygen tank.

Fireball Develops

Within milliseconds, a massive explosion of mixing hydrogen and oxygen destroyed the spacecraft, rupturing the Challenger orbiter’s own rocket fuel tanks and enveloping the orbiter in a reddish brown fireball.

The shuttle was at 46,000 feet, moving upward at 1.92 times the speed of sound. Its computers functioned to the last millisecond, shutting down the orbiter’s three main engines one by one until the last radio transmission was recorded, 74.13 seconds into the mission.

The recovered right-hand booster sections show a burned-out hole, 33 inches wide. That is larger than the estimated 6- to 8-inch gap that triggered the explosion because the booster continued to burn for 37 seconds after the fireball. It was finally destroyed on radio command from the ground.

Evidence of the burn through is reinforced by “beveling” of the steel rocket case on the interior near the gap--an indication that super hot gases were rushing out, carrying molten steel with them.

The “how” of the accident, however, does not begin to explain why it occurred.

For that, the panel turned to Nov. 20, 1973, when NASA officials chose Morton Thiokol over three competitors to build the craft’s solid rocket boosters. While Thiokol was rated second overall in “suitability” for the contract, the company’s “cost advantages were substantial and consistent,” NASA evaluators wrote.

Design ‘Innovative’

Evaluators at that time singled out the design of the rocket joint as “innovative.” In truth, the accident panel concluded, the rocket’s failings “began with the faulty design of its joint” and grew when officials ignored its failings.

The panel said that Thiokol’s $800-million contract employed a booster design like that of the much smaller but highly reliable Air Force Titan 3 missile. Four steel cylinders, each filled with fuel, were bolted to a cone-shaped top and a cylindrical bottom holding the nozzles.

The design for the joints between sections, however, differed from those of the Titan. Both employed a “tang”--a thin strip of metal--that fit into a U-shaped joint called a “clevis.” Both used rubbery, circular O-rings on the inside of the clevis to prevent gases from blowing through the joint.

The panel noted, however, that interior insulation in the Titan formed an even tighter gas seal than the Thiokol design, which used asbestos putty as its first defense against leaking gases. The insulation kept the high internal pressures of the rockets’ startup from reaching the Titan O-rings. The shuttle’s O-rings, the panel stated, “were designed to take the brunt of the combustion pressure,” using a second backup O-ring as a safeguard in case the first one failed.

Moreover, the panel stated, the joint design praised by NASA as “innovative” was in fact scrapped “with NASA’s concurrence” before the first booster was built. Thiokol junked an interior face-to-face seal between the tang and clevis in favor of two side-by-side O-rings.

Thiokol admitted then that the original design “provides (better) redundancy” against gas leaks. But it said that design also posed assembly and inspection problems.

Despite NASA’s initial blessing, the commission stated, the new design encountered serious problems in testing. A 1977 firing test found that the tang and clevis unexpectedly bent away from--not toward--each other in the instant after ignition, reducing gas pressures that caused the O-rings to flatten out and seal the tang-clevis gap.

NASA engineers warned in various memos that the design was “completely unacceptable” and that a leak could lead to “catastrophic failure” of a booster. Not until new tests in 1980 disclosed that the bending was even worse than thought, however, was a formal inquiry ordered. The first shuttle flight was launched in April, 1981, with the problems unresolved.

After the second shuttle launch that November produced evidence of O-ring erosion by hot gases, the O-rings were made a “Criticality 1” item on the shuttle parts list--the official warning that a single failure would be catastrophic. The change was made based on warnings of NASA engineers that the second, backup O-ring was useless under the worst bending.

But Thiokol officials, convinced that the erosion was due to faulty insulating putty, substituted a new kind of putty. And top NASA officials, unconvinced that the problem was serious, waived their Criticality 1 rating for successive launches despite increasingly dire evidence of failure.

Worse Damage Reported

By 1984, launches at successively lower temperatures began producing worse seal damage, and NASA ordered Thiokol to devise a remedy to the O-ring problem. Thiokol produced a study--but not until Aug. 19, 1985.

Meanwhile, an April, 1985, shuttle launch produced the greatest erosion seen so far, causing a loss of seal on one primary O-ring and a 0.03-inch erosion of the backup O-ring. But although Thiokol informed NASA in August that it had formed an O-ring task force to study “both long-term and short-term solutions,” it deemed the spacecraft safe to fly. A series of launches that fall and winter produced more warning memos and more erosion.

Those concerns reached a crescendo the night of Jan. 27 and early Jan. 28, when Challenger sat on Pad 39B sheathed in icicles and Thiokol engineers issued their prescient warnings of a launch disaster.

Beginning at 1 p.m. on the 27th and proceeding through two lengthy teleconferences, NASA and Thiokol officials considered the effect of cold on the O-rings and dismissed them in a carefully worded Thiokol memorandum, wired to NASA offices at Kennedy Space Center.

The commission did not dismiss the effect of cold. While the temperature was 36 degrees at the time of launch, the commission estimated that the temperature on the surface of the rocket in the area where the failure occurred was about 28 degrees.

“At the cold launch temperature experienced, the O-ring would be very slow in returning to its normal rounded shape” the report said, and thus it probably did not seal in time to prevent the hot gas from leaking through in the split second after the motor fired.

Related to Temperature

The resiliency of the O-rings--and their ability to seal the rocket joint upon ignition--is directly correlated to temperature, the commission found. It said that an O-ring at 75 degrees is five times more responsive than one at 30 degrees.

That, in turn, proved critical because the stresses of blastoff inevitably caused the separate sections of the booster rockets’ steel outer casings to flex. That flexing caused the top of the boosters to sway as much as six inches from vertical. The commission noted that the greatest stresses ran almost precisely through the point where the burn-through occurred.