THE CHALLENGER: AN AVOIDABLE TRAGEDY : Excerpts: Why It Happened and Recommendations

The following is a collection of excerpts from the Rogers commission report: Preface

The accident of space shuttle Challenger, mission 51-L, interrupting for a time one of the most productive engineering, scientific and exploratory programs in history, evoked a wide range of deeply felt public responses. There was grief and sadness for the loss of seven brave members of the crew; firm national resolve that those men and women be forever enshrined in the annals of American heroes, and a determination, based on that resolve and in their memory, to strengthen the space shuttle program so that this tragic event will become a milestone on the way to achieving the full potential that space offers to mankind. . . . Events Leading Up to the Challenger Mission

The weather was forecast (on Jan. 27, the day before the launch) to be clear and very cold, with temperatures dropping into the low 20s overnight. The management team directed engineers to assess the possible effects of temperature on the launch. No critical issues were identified to management officials, and while evaluation continued, it was decided to proceed with the countdown and the fueling of the external tank.

Ice had accumulated in the launch pad area during the night and it caused considerable concern for the launch team. In reaction, the ice inspection team was sent to the launch pad at 1:35 a.m., Jan. 28, and returned to the Launch Control Center at 3 a.m. After a meeting to consider the team’s report, the space shuttle program manager decided to continue the countdown. Another ice inspection was scheduled at launch minus three hours. . . .

At the weather briefing (shortly before the crew boarded the shuttle), the temperature and ice on the pad were discussed, but neither then nor in earlier weather discussions was the crew told of any concern about the effects of low temperature on the shuttle system. The seven crew members left the crew quarters and rode the astronaut van to launch pad B, arriving at 8:03. They were in their seats in the Challenger at 8:36 a.m.

At 8:44 a.m. the ice team completed its second inspection. After hearing the team’s report, the program manager decided to allow additional time for ice to melt on the pad. He also decided to send the ice team to perform one final ice assessment at launch minus 20 minutes. . . .

At 11:15 the ice inspection was completed, and during the hold at launch minus nine minutes, the mission 51-L crew and all members of the launch team gave their “go” for launch. The final flight of the Challenger began at 11:38:00.010 a.m. . . .

From liftoff until the signal from the shuttle was lost, no flight controller observed any indication of a problem. The shuttle’s main engines throttled down to limit the maximum dynamic pressure, then throttled up to full thrust as expected. Voice communications with the crew were normal. The crew called to indicate the shuttle had begun its roll to head due east and to establish communication after launch. Fifty-seven seconds later, Mission Control informed the crew that the engines had successfully throttled up and all other systems were satisfactory. The commander’s acknowledgment of this call was the last voice communication from the Challenger.

There were no alarms sounded in the cockpit. The crew apparently had no indication of a problem before the rapid breakup of the space shuttle system. The first evidence of an accident came from live video coverage. Radar then began to track multiple objects. The flight dynamics officer in Houston confirmed to the flight director that “RSO (range safety officer) reports vehicle exploded,” and 30 seconds later he added that the range safety officer had sent the destruct signal to the solid (fuel) rocket boosters.

During the flight when the solid rocket boosters are thrusting, there are no survivable abort options. There was nothing that either the crew or the ground controllers could have done to avert the catastrophe. The Accident

Just after liftoff at 0.678 seconds into the flight, photographic data show a strong puff of gray smoke was spurting from the vicinity of the aft field joint on the right solid rocket booster. . . . The vaporized material streaming from the joint indicated there was not complete sealing action within the joint.

Eight more distinctive puffs of increasingly blacker smoke were recorded between 0.836 and 2.500 seconds. . . .

The black color and dense composition of the smoke puffs suggest that the grease, joint insulation and rubber O-rings in the joint seal were being burned and eroded by the hot propellant gases. . . .

Main engines had been throttled up to 104% thrust when the first flickering flame appeared on the right solid rocket booster in the area of the aft field joint. . . .

As the flame plume increased in size, it was deflected rearward by the aerodynamic slipstream and circumferentially by the protruding structure of the upper ring attaching the booster to the external (liquid fuel) tank. These deflections directed the flame plume onto the surface of the external tank. . . .

The first visual indication that swirling flame from the right solid rocket booster breached the external tank was at 64.660 seconds, when there was an abrupt change in the shape and color of the plume. . . .

Beginning at about 72 seconds, a series of events occurred extremely rapidly that terminated the flight. . . .

At about 72.20 seconds the lower strut linking the solid rocket booster and the external tank was severed or pulled away from the weakened hydrogen tank, permitting the right solid rocket booster to rotate around the upper attachment strut. . . .

At 73.124 seconds, a circumferential white vapor pattern was observed blooming from the side of the external tank bottom dome. This was the beginning of the structural failure of the hydrogen tank. . . .

Within milliseconds there was massive, almost explosive, burning of the hydrogen streaming from the failed tank bottom and the liquid oxygen breach in the area of the intertank. . . .

At this point in its trajectory, while traveling at a Mach number of 1.92 at an altitude of 46,000 feet, the Challenger was totally enveloped in the explosive burn. . . .

The orbiter, under severe aerodynamic loads, broke into several large sections which emerged from the fireball. . . . The Cause of the Accident

The consensus of the commission and participating investigative agencies is that the loss of the space shuttle Challenger was caused by a failure in the joint between the two lower segments of the right solid rocket motor. The specific failure was the destruction of the seals that are intended to prevent hot gases from leaking through the joint during the propellant burn of the rocket motor. . . .

During stacking operations at the launch site, four segments are assembled to form the solid rocket motor. The resulting joints (are sealed) by two rubber O-rings with diameters of 0.280 inches. . . .

A combustion gas leak through the right solid rocket motor aft field joint initiated at or shortly after ignition eventually weakened and/or penetrated the external tank, initiating vehicle structural breakup. . . .

The ambient temperature at time of launch was 36 degrees Fahrenheit, or 15 degrees lower than the next coldest previous launch. . . . Of 21 launches with ambient temperatures of 61 degrees Fahrenheit or greater, only four showed signs of O-ring thermal distress; i.e., erosion or blow-by and soot. Each of the launches below 61 degrees Fahrenheit resulted in one or more O-rings showing signs of thermal distress. . . .

There is a possibility that there was water in (the Challenger’s) joints. . . . At time of launch, it was cold enough that water present in the joint would freeze. Tests show that ice in the joint can inhibit proper secondary seal performance. The Contributing Cause of the Accident

The decision to launch the Challenger was flawed. Those who made that decision were unaware of the recent history of problems concerning the O-rings and the joint and were unaware of the initial written recommendation of the contractor (Morton Thiokol Inc.) advising against the launch at temperatures below 53 degrees Fahrenheit and the continuing opposition of the engineers at Thiokol after the management reversed its position. They did not have a clear understanding of concern (by Rockwell International Corp., prime contractor for the shuttle orbiter) that it was not safe to launch because of ice on the pad. If the decision-makers had known all of the facts, it is highly unlikely that they would have decided to launch 51-L (Challenger) on Jan. 28. . . .

(Testimony to the commission) reveals failures in communication that resulted in a decision to launch 51-L based on incomplete and sometimes misleading information, a conflict between engineering data and management judgments, and a NASA management structure that permitted internal flight safety problems to bypass key shuttle managers. . . .

In the launch preparation for 51-L, relevant concerns of Level III NASA personnel (at Marshall, Kennedy and Johnson space centers) and element contractors were not, in the following crucial areas, adequately communicated to the NASA Level I and II management responsible for the launch:

--The objections to launch voiced by Morton Thiokol engineers about the detrimental effect of cold temperatures on the performance of the solid rocket motor joint seal.

--The degree of concern of Thiokol and Marshall about the erosion of the joint seals in prior shuttle flights. . . .

Since December, 1982, the O-rings had been designated a “Criticality 1” feature of the solid rocket booster design, a term denoting a failure point--without backup--that could cause a loss of life or vehicle if the component fails. In July, 1985, after a nozzle joint on (space shuttle) 51-B showed erosion of a secondary O-ring, indicating that the primary seal failed, a launch constraint was placed on flight 51-F and subsequent launches. These constraints had been imposed and regularly waived by the solid rocket booster project manager at Marshall, Lawrence B. Mulloy.

Neither the launch constraint, the reason for it, or the six consecutive waivers prior to 51-L were known to (top NASA officials Jesse Moore, Arnold Aldrich or James A. Thomas) at the time of the flight readiness review process for 51-L. . . .

No mention of the O-ring problems in the solid rocket booster joint appeared in the certification of flight readiness, signed for Thiokol on Jan. 9, 1986, by Joseph Kilminster. . . .

Similarly, no mention appeared in the certification endorsement, signed on Jan. 15, 1986, by Kilminster and by Mulloy. . . .

It is disturbing to the commission that contrary to the testimony of the solid rocket booster project manager (Mulloy), the seriousness of concern was not conveyed in flight readiness review to Level I and the 51-L readiness review was silent. . . .

The waiving of launch constraints appears to have been at the expense of flight safety. There was no system which made it imperative that launch constraints and waivers of launch constraints be considered by all levels of management.

The commission is troubled by what appears to be a propensity of management at Marshall to contain potentially serious problems and to attempt to resolve them internally rather than communicate them forward. The commission concluded that the Thiokol management reversed its position and recommended the launch of 51-L, at the urging of Marshall and contrary to the views of its engineers in order to accommodate a major customer.

The commission is concerned about three aspects of the ice-on-the-pad issue.

An analysis of all of the testimony and interviews establishes that Rockwell’s recommendation on launch was ambiguous. The commission finds it difficult . . . to conclude that there was a no-launch recommendation. Moreover, all parties were asked specifically to contact Aldrich or Moore about launch objections due to weather. Rockwell made no phone calls or further objections to Aldrich or other NASA officials (on launch day) after the 9 a.m. mission management team meeting and subsequent to the resumption of the countdown.

The commission is also concerned about the NASA response to the Rockwell position at the 9 a.m. meeting. While it is understood that decisions have to be made in launching a shuttle, the commission is not convinced Levels I and II appropriately considered Rockwell’s concern about the ice. However ambiguous Rockwell’s position was, it is clear that they did tell NASA that the ice was an unknown condition. Given the extent of the ice on the pad, the admitted unknown effect of the solid rocket motor and space shuttle main engines’ ignition on the ice, as well as the fact that debris striking the orbiter was a potential flight safety hazard, the commission finds the decision to launch questionable under those circumstances. In this situation, NASA appeared to be requiring a contractor to prove that it was not safe to launch, rather than proving it was safe. Nevertheless, the commission has determined that the ice was not a cause of the 51-L accident and does not conclude that NASA’s decision to launch specifically overrode a no-launch recommendation by an element contractor.

The commission concluded that the freeze protection plan for launch pad 39B was inadequate. The commission believes that the severe cold and presence of so much ice on the fixed service structure made it inadvisable to launch on the morning of Jan. 28, and that margins of safety were whittled down too far. . . . An Accident Rooted in History

The space shuttle’s solid rocket booster problem began with the faulty design of its joint and increased as both NASA and contractor management first failed to recognize it as a problem, then failed to fix it and finally treated it as an acceptable flight risk.

Morton Thiokol Inc., the contractor, did not accept the implication of tests early in the program that the design had a serious and unanticipated flaw. NASA did not accept the judgment of its engineers that the design was unacceptable, and as the joint problems grew in number and severity NASA minimized them in management briefings and reports. Thiokol’s stated position was that “the condition is not desirable but is acceptable.”

Neither Thiokol nor NASA expected the rubber O-rings sealing the joints to be touched by hot gases of motor ignition, much less to be partially burned. However, as tests and then flights confirmed damage to the sealing rings, the reaction by both NASA and Thiokol was to increase the amount of damage considered “acceptable.” At no time did management either recommend a redesign of the joint or call for the shuttle’s grounding until the problem was solved. . . .

The record of the fateful series of NASA and Thiokol meetings, telephone conference, notes, and facsimile transmissions on Jan. 27, the night before the launch of flight 51-L, shows that only limited consideration was given to the past history of O-ring damage in terms of temperature. . . .

Consideration of the entire launch temperature history indicates that the probability of O-ring distress is increased to almost a certainty if the temperature of the joint is less than 65. . . .

The commission’s review of the Marshall and Thiokol documentary presentations at the various flight readiness reviews revealed several significant trends. First, O-ring erosion was not considered early in the program when it first occurred. Second, when the problem grew worse . . . the initial analysis of the problem did not produce much research; instead, there was an early acceptance of the phenomenon. Third, because of a belief that in-flight O-ring erosion was “within the data base” of prior experience, later flight readiness reviews gave a cursory review and often dismissed the recurring erosion as within “acceptable” or “allowable” limits. Fourth, both Thiokol and Marshall continued to rely on the redundancy of the secondary O-ring long after NASA had officially declared that the seal was a non-redundant single point failure. Finally, in 1985 when temperature became a major concern . . . NASA Levels I and II were not informed of these developments in the flight readiness review process. . . .

NASA and Thiokol accepted escalating risk apparently because they “got away with it last time.” As Commissioner (Richard P.) Feynman observed, the decision-making was “a kind of Russian roulette . . . (The shuttle) flies (with O-ring erosion) and nothing happens. Then it is suggested, therefore, that the risk is no longer so high for the next flights. We can lower our standards a little bit because we got away with it last time. . . . You got away with it, but it shouldn’t be done over and over again like that. . . .” The Silent Safety Program

The commission was surprised to realize after many hours of testimony that NASA’s safety staff was never mentioned. . . . No one thought to invite a safety representative or a reliability and quality assurance engineer to the Jan. 27, 1986, teleconference between Marshall and Thiokol. Similarly, there was no representative of safety on the mission management team that made key decisions during the countdown on Jan. 28. . . .

Reductions in the safety, reliability and quality assurance work force at Marshall and NASA headquarters have seriously limited capability in those vital functions. Recommendations

The commission urges that the administrator of NASA submit, one year from now, a report to the President on the progress that NASA has made in effecting (these) recommendations: I--Design and Independent Oversight.

The faulty Solid Rocket Motor joint seal must be changed. This could be a new design, eliminating the joint, or a redesign of the current joint and seal. No design options should be prematurely precluded because of schedule, cost or reliance on existing hardware. . . .

The administrator of NASA should request the National Research Council to form an independent solid rocket motor design oversight committee to implement the commission’s design recommendations and oversee the design effort. . . . II--Shuttle Management Structure.

The shuttle program structure should be reviewed. . . . A redefinition of the program manager’s responsibility is essential. . . . Program funding and all shuttle program work at the (space) centers (near Cape Canaveral, Fla., in Huntsville, Ala., and near Houston) should be placed clearly under the program manager’s authority (in Washington). . . .

NASA should encourage the transition of qualified astronauts into agency management positions. . . . NASA should establish (a space shuttle) safety advisory panel reporting to the (shuttle) program manager. . . .

III--Criticality Review and Hazard Analysis.

NASA and the primary shuttle contractors should review all Criticality 1, 1R, 2 and 2R items and hazard analyses. This review should identify those items that must be improved prior to flight to ensure mission success and flight safety. . . .

IV--Safety Organization.

NASA should establish an Office of Safety, Reliability and Quality Assurance to be headed by an associate administrator, reporting directly to the NASA administrator. . . .

V--Improved Communications.

The commission found that Marshall Space Flight Center project managers, because of a tendency at Marshall to management isolation, failed to provide full and timely information bearing on the safety of flight 51-L to other vital elements of shuttle program management. NASA should take energetic steps to eliminate this tendency . . . whether by changes of personnel, organization, indoctrination or all three.

VI--Landing Safety.

Criteria must be established for tires, brakes and nosewheel steering. Until the systems meet those criteria in high fidelity testing that is verified at Edwards, landing at Kennedy should not be planned. . . .

VII--Launch Abort and Crew Escape.

The commission recommends that NASA:

--Make all efforts to provide a crew escape system for use during controlled gliding flight.

--Make every effort to increase the range of flight conditions under which an emergency runway landing can be successfully conducted in the event that two or three engines fail early in ascent.

VIII--Flight Rate.

The nation’s reliance on the shuttle as its principal space launch capability created a relentless pressure on NASA to increase the flight rate. Such reliance on a single launch capability should be avoided in the future. . . .

IX--Maintenance Safeguards.

Installation, test and maintenance procedures must be especially rigorous for space shuttle items designated Criticality 1. NASA should establish a system of analyzing and reporting performance trends of such items. Maintenance procedures for such items should be specified in the Critical Items List, especially for those such as the liquid-fueled main engines, which require unstinting maintenance and overhaul. . . .