Voyage Into History
Chapter 11: Recommendations

By William Harwood

From Executive Order 12546, Feb. 3, 1986:
Sec. 2. Functions.
(a) The Commission shall investigate the accident to the Space Shuttle Challenger, which occurred on January 28, 1986.
(b) The Commission shall:
(1) Review the circumstances surrounding the accident to establish the probable cause of the accident; and
(2) Develop recommendations for corrective or other action based upon the Commission's findings and determinations.
(c) The Commission shall submit its final report to the President and the Administrator of the National Aeronautics and Space Administration within one hundred and twenty days of the date of this order.

"The commission urges that NASA continue to receive the support of the Administration and the nation. The agency constitutes a national resource that plays a critical role in space exploration and development. It also provides a symbol of national pride and technological leadership. The Commission applauds NASA's spectacular achievements of the past and anticipates impressive achievements to come. The findings and recommendations presented in this report are intended to contribute to the future NASA successes that the nation both expects and requires as the 21st century approaches." - Conclusion of the Rogers Commission Report

The Cause of the Accident
The Rogers Commission listed 16 findings on the primary cause of the accident before stating the following conclusion:

"The commission concluded that the cause of the Challenger accident was the failure of the pressure seal in the aft field joint of the right Solid Rocket Motor. The failure was due to a faulty design unacceptably sensitive to a number of factors. These factors were the effects of temperature, physical dimensions, the character of materials, the effects of reusability, processing and the reaction of the joint to dynamic loading."

A thorough analysis of all available evidence showed no abnormalities with the external fuel tank, Challenger and its three main engines or the shuttle's payload and records showed all the hardware used in flight 51-L met NASA specifications. Launch processing, from the initial stacking of the rocket boosters to work done at the launch pad was normal, but during assembly of the right-side booster, engineers ran into snags. One of the fuel segments that mated at the aft field joint was severely out of round and had to be forced into the proper shape with a high-power hydraulic tool. In addition, measurements showed that because of previous use, the two fuel segments in question had slightly larger diameters than normal but they still were within specifications.

Recall for a moment the construction of the joint. The upper rim of the bottom fuel segment, called a clevis, is an upward-facing U-shaped groove. The lower rim of the fuel segment above, called a tang, slides into the clevis and the resulting interlocking joint is bolted together with 177 high-strength steel pins. Running around the interior of the inner leg of the clevis are the two rubber O-ring seals. Because of the larger than normal joint diameters, at the moment of ignition, the tang and clevis had an average gap of .004 inches, which would have compressed the O-rings severely. Because the fuel segments were slightly out of round, the smallest gap was in the area where the rupture occurred during flight, although it is not known if the high compression on the O-ring was present at liftoff.

It was a record 36 degrees when Challenger took off and infrared measurements taken at the launch pad showed the temperature around the circumference of the aft field joint was in the neighborhood of 28 degrees in the area where the rupture occurred, the coldest spot on the booster. To understand the significance of the temperature factor, consider again the operation of the rocket motor at ignition when internal pressure shoots from zero to nearly 1,000 pounds per square inch. This tremendous force pushes outward and causes the joints to bulge slightly, a phenomenon known as joint rotation. During the ignition transient, the tang and clevis typically separate as much as .017 and .029 inches where the primary and secondary O-rings are located. The gap opening reaches maximum about 600 milliseconds after ignition when the motor reaches full pressure. To keep the joint sealed as the tang-clevis separation increases during ignition, the O-rings must seat properly and the commission said cold O-rings take longer to reach the proper position.

"At the cold launch temperature experienced, the O-ring would be very slow in returning to its normal rounded shape. It would not follow the opening of the tang-to-clevis gap. It would remain in its compressed position in the O-ring channel and not provide a space between itself and the upstream channel wall. Thus, it is probable the O-ring would not be pressure actuated to seal the gap in time to preclude joint failure due to blow-by and erosion from hot combustion gases," the report said.

Further, the commission found that experimental evidence showed other factors, such as humidity and the performance of the heat-shielding putty in the joint "can delay pressure application to the joint by 500 milliseconds or more." Records showed that in each shuttle launch in temperature below 61 degrees, one or more booster O-rings showed signs of erosion or the effects of heat. Complicating the picture, there was the possibility of ice in the suspect joint because Challenger had been exposed to seven inches of rainfall during its month on the launch pad prior to blastoff. Research showed ice could have prevented proper sealing by the secondary O-ring.

Launch pad cameras showed puffs of black smoke shooting from the region of the aft field joint beginning about the same time the motor reached full pressure. The commission said two overall failure scenarios were possible: a small leak could have developed at ignition that slowly grew to the point that flame erupted through the joint as photographs indicated some 58 seconds after blastoff. More likely, however, the gap between the burned O-rings and the clevis probably was sealed up by "deposition of a fragile buildup of aluminum oxide and other combustion debris. The resealed section of the joint could have been disturbed by thrust vectoring (steering), space shuttle motion and flight loads induced by changing winds aloft." NASA revealed after the accident that wind shear was higher for Challenger's mission than for any previous shuttle flight.

That the shuttle booster joints were faulty and overly dependent on a variety of factors was clear. The commission's findings on the secondary causes of the disaster were more subtle but just as damning to the space agency.

The Contributing Cause of the Accident
"The decision to launch the Challenger was flawed," the Rogers Commission said. "Those who made that decision were unaware of the recent history of problems concerning the O-rings and the joint and were unaware of the initial written recommendation of the contractor advising against the launch at temperatures below 53 degrees Fahrenheit and the continuing opposition of the engineers at Thiokol after the management reversed its position. They did not have a clear understanding of Rockwell's concern that it was not safe to launch because of ice on the pad. If the decision makers had known all of the facts, it is highly unlikely that they would have decided to launch 51-L on January 28, 1986."

Before shuttles are cleared for flight, a formal "flight readiness review" is held by top NASA managers to discuss any open items that might affect a launch. Previous flights are reviewed to make sure any problems had been addressed before commiting the next shuttle for launch. Mulloy testified NASA management was well aware of the O-ring issue and cited the flight readiness review record as proof. He was correct in that during several preceding flight readiness reviews, the O-ring problem was mentioned. But it was only mentioned in the context that it was an acceptable risk and that the boosters had plenty of margin. It was not mentioned at all during the 51-L readiness review.

"It is disturbing to the commission that contrary to the testimony of the solid rocket booster project manager, the seriousness of concern was not conveyed in Flight Readiness Review to Level 1 and the 51-L readiness review was silent."

Keel said later the real turning point in the commission investigation came on Feb. 10 during a closed hearing in Washington. It was there the commission learned of the launch-eve debate over clearing Challenger for launch. Boisjoly would later recall the events of Jan. 27 in this manner:

Boisjoly: "I felt personally that management was under a lot of pressure to launch and that they made a very tough decision, but I didn't agree with it. One of my colleagues that was in the meeting summed it up best. This was a meeting where the determination was to launch and it was up to us to prove beyond a shadow of a doubt that it was not safe to do so. This is in total reverse to what the position usually is in a preflight conversation or a flight readiness review. It is usually exactly opposite that."

Commission member Arthur B.C. Walker: "Do you know the source of the pressure on management that you alluded to?"

Boisjoly: "Well, the comments made over the [teleconference network] is what I felt, I can't speak for them, but I felt it, I felt the tone of the meeting exactly as I summed up, that we were being put in a position to prove that we should not launch rather then being put in the position and prove that we had enough data for launch. And I felt that very real."

The Rogers Commission concluded that a "well structured" management system with the emphasis on flight safety would have elevated the booster O-ring issue to the status it deserved and that NASA's decision-making process was clearly faulty. One can only wonder how many other launch-eve debates occurred during the previous 24 missions that were never mentioned because the flight turned out to be a success.

"Had these matters been clearly stated and emphasized in the flight readiness process in terms reflecting the views of most of the Thiokol engineers and at least some of the Marshall engineers, it seems likely that the launch of 51-L might not have occurred when it did," the commission said.

The commission also determined that the waiving of launch constraints based on previous success came at the expense of flight safety because the waivers did not necessarily reach top-level management for a decision. Finally, the commission charged engineers at the Marshall Space Flight Center where the booster program was managed had a "propensity" for keeping knowledge of potentially serious problems away from other field centers in a bid to address them internally.

An Accident Rooted in History
"The Space Shuttle's Solid Rocket Booster problem began with the faulty design of its joint and increased as both NASA and contractor management first failed to recognize it as a problem, then failed to fix it and finally treated it as an acceptable flight risk," the Rogers Commission said.

Morton Thiokol won the contract to build shuttle boosters in 1973. Of the four competitors, Thiokol ranked at the bottom for design and development but came in first in the management category. NASA later said Thiokol was selected because "cost advantages were substantial and consistent throughout all areas evaluated." The result was an $800 million cost-plus-award-fee contract.

Morton Thiokol hoped to keep costs down by borrowing heavily from the design of the Titan 3 solid rocket motors. Both systems, for example, used tang and clevis joints but the shuttle design had major differences as well. Unlike in the Titan, which relied on a single O-ring seal, two rubber O-rings were employed in the shuttle booster and both faced heavy pressure loads at launch. The way the seals worked in the shuttle boosters was elegant in its simplicity. Before fuel joints were to be mated, an asbestos-filled putty would be used to fill in the gap between the two propellant faces of the fuel segments. The putty, then, would serve as a barrier to prevent hot gas from reaching the O-ring seals. But the putty was plastic so when the rocket was ignited, internal pressure would force the putty to flow toward the outside of the joint. In doing so, air between the putty and the O-ring would become pressurized, forcing the O-ring to "extrude" into the minute gap between the clevis and tang. In this manner, the joint would be sealed and even if the primary O-ring failed to operate, the secondary seal would fill in the gap, so to speak. To make sure the O-rings were, in fact, able to seal the joints prior to ignition, Thiokol included a "leak test port" in each booster joint. Once assembled, the space between the two O-rings could be pressurized with 50 psi air. If the pressure stayed steady, engineers would know the joint was airtight and that no path from the propellant to the primary O-ring existed for hot gas or flame.

So much for theory. When testing began, results were not what Thiokol engineers expected.

The design of the joint had led engineers to believe that once pressurized, the gap between the tang and clevis actually would decrease slightly, thereby improving the sealing action of the O-rings. To test the booster's structural integrity, Thiokol conducted "hydroburst" tests in 1977. In these tests, water was pumped inside a booster case and pressurized to 1.5 times actual operating pressure. Careful measurements were made and to their surprise, engineers realized that the tang and clevis joint actually bulged outward, widening the gap between the joint members. While Thiokol tended to downplay the significance of the finding at the time, engineers at Marshall were dismayed by the results. John Q. Miller, a chief booster engineer at the Alabama rocket center, wrote a memo on Jan. 9, 1978, to his superiors, saying, "We see no valid reason for not designing to accepted standards" and that improvements were mandatory "to prevent hot gas leaks and resulting catastrophic failure." This memo and another along the same lines actually were authored by Leon Ray, a Marshall engineer, with Miller's agreement. Other memos followed but the Rogers Commission said Thiokol officials never received copies. In any case, the Thiokol booster design passed its Phase 1 certification review in March 1979. Meanwhile, ground test firings confirmed the clevis-tang gap opening. An independent oversight committee also said pressurization through the leak test port pushed the primary O-ring the wrong way so that when the motor was ignited, the compression from burning propellant had to push the O-ring over its groove in order for it to extrude into the clevis-tang gap. Still, NASA engineers at Marshall concluded "safety factors to be adequate for the current design" and that the secondary O-ring would serve as a redundant backup throughout flight.

On Sept. 15, 1980, the solid rocket booster joints were classified as criticality 1R, meaning the system was redundant because of the secondary O-ring. Even so, the wording of the critical items list left much room for doubt: "Redundancy of the secondary field joint seal cannot be verified after motor case pressure reaches approximately 40 percent of maximum expected operating pressure." The joint was classified as criticality 1R until December 1982 when it was changed to criticality 1. Two events prompted the change: the switch to a non-asbestos insulating putty - the original manufacturer had discontinued production - and the results of tests in May 1982 that finally convinced Marshall management that the secondary O-ring would not function after motor pressurization. Criticality 1 systems are defined as those in which a single failure results in loss of mission, vehicle and crew. Even though the classification was changed, NASA engineers and their counterparts at Morton Thiokol still considered the joint redundant through the ignition transient. The Rogers Commission found this to be a fatal flaw in judgment.

Criticality 1 systems must receive a formal "waiver" to allow flight. On March 28, 1983, Michael Weeks, associate administrator for space flight (technical) signed the document that allowed continued shuttle missions despite the joint concerns.

"We felt at the time, all of the people in the program I think felt that this solid rocket motor in particular ... was probably one of the least worrisome things we had in the program," Weeks said.

Then came the flight of mission 41-B, the 10th shuttle mission, launched Feb. 3, 1984. Prior to that time, only two flights had experienced O-ring damage: the second shuttle mission and the sixth. In both cases, only a single joint was involved. But after 41-B, inspectors found damage to a field joint and a nozzle joint. Marshall engineers were concerned about the unexpected damage, but a problem assessment report concluded: "This is not a constraint to future launches." For the next shuttle flight, 41-C, NASA managers were advised launch should be approved but that there was a possibility of some O-ring erosion. Meanwhile, to make absolutely sure the O-rings were seated properly prior to launch, the leak test pressure was increased to 100 psi and later to 200 psi, even though Marshall engineers realized that increased the possibility of creating blow holes through the insulating putty. Such blow holes, in turn, could provide paths for hot gas to reach the O-rings. In any case, the statistics are simple: of the first nine shuttle flights, when joints were tested with 50 psi or 100 psi pressure, only one field joint problem was noticed. With the 200 psi tests, more than 50 percent of the shuttle missions exhibited some field joint O-ring erosion.

So even though research was underway to improve the joint design, shuttles continued flying. On Jan. 24, 1985, Discovery took off on the first classified military shuttle mission, flight 51-C. The temperature at launch time was a record 53 degrees and O-ring erosion was noted in both boosters after recovery. Damage was extensive: both booster nozzle primary O-rings showed signs of blow by during ignition and both the primary and secondary seals in the right booster's center segment field joint were affected by heat. Thiokol engineers would later say temperature apparently increased the chances for O-ring damage or erosion by reducing resiliency. Concern mounted after the flight of mission 51-B in April 1985 when engineers discovered a nozzle primary O-ring had been damaged and failed to seat at all and that the secondary seal also was eroded. This was serious and more studies were ordered. Mulloy then instituted a launch constraint, meaning a waiver was required before every succeeding mission. Mulloy signed such waivers six flights in a row before Challenger took off for the last time.

On Aug. 19, 1985, NASA managers in Washington were briefed on the O-ring issue and the next day, Morton Thiokol established an O-ring task force because "the result of a leak at any of the joints would be catastrophic." But company engineers told the commission the task force ran into red tape and a lack of cooperation.

"The genesis of the Challenger accident - the failure of the joint of the right solid rocket motor - began with decisions made in the design of the joint and in the failure by both Thiokol and NASA's solid rocket booster project office to understand and respond to facts obtained during testing," the Rogers Commission concluded.

The panel said NASA's testing program was inadequate, that engineers never had a good understanding of the mechanics of joint sealing and that the material presented to NASA management in August 1985 "was sufficiently detailed to require corrective action prior to the next flight."

Pressures on the System
"With the 1982 completion of the orbital test flight series, NASA began a planned acceleration of the Space Shuttle launch schedule," the Rogers Commission said. "One early plan contemplated an eventual rate of a mission a week, but realism forced several downward revisions. In 1985, NASA published a projection calling for an annual rate of 24 flights by 1990. Long before the Challenger accident, however, it was becoming obvious that even the modified goal of two flights a month was overambitious."

When the shuttle program was conceived, it was hailed as the answer to the high cost of space flight. By building a reusable space vehicle, the United States would be able to lower the cost of placing a payload into orbit while at the same time, increase its operational capability on the high frontier. The nation's space policy then focused on the shuttle as the premier launcher in the American inventory and expendable rockets were phased out. Once shuttle flights began, NASA quickly fell under pressure to meet a heavy schedule of satellite launches for commercial, military and scientific endeavors. And as the flight rate increased, the space agency's resources became stretched to the limit. Indeed, the Rogers Commission said evidence indicated even if the 51-L disaster had been avoided, NASA would have been unable to meet the 16-launch schedule planned for 1986.

But NASA's can-do attitude refused to let the agency admit its own limitations as it struggled along against increasingly significant odds and diminishing resources. The Rogers Commission found that astronaut training time was being cut back, that frequent and late payload changes disrupted flight planning and that a lack of spare parts was beginning to manifest itself in flight impacts at the time of the Challenger accident.

The Rogers Commission concluded:

1. "The capabilities of the system were stretched to the limit to support the flight rate in winter 1985/1986," the commission wrote. "Projections into the spring and summer of 1986 showed a clear trend; the system, as it existed, would have been unable to deliver crew training software for scheduled flights by the designated dates. The result would have been an unacceptable compression of the time available for the crews to accomplish their required training.
2. "Spare parts are in short supply. The shuttle program made a conscious decision to postpone spare parts procurements in favor of budget items of perceived higher priority. Lack of spare parts would likely have limited flight operations in 1986.
3. "Stated manifesting policies [rules governing payload assignments] are not enforced. Numerous late manifest changes (after the cargo integration review) have been made to both major payloads and minor payloads throughout the shuttle program.
4. "The scheduled flight rate did not accurately reflect the capabilities and resources.
5. "Training simulators may be the limiting factor on the flight rate; the two current simulators cannot train crews for more than 12-15 flights per year.
6. "When flights come in rapid succession, current requirements do not ensure that critical anomalies occurring during one flight are identified and addressed appropriately before the next flight."

Two types of shuttle aborts were possible at the time of the Challenger accident: the four intact aborts, in which the shuttle crew attempts an emergency landing on a runway, and contingency aborts, in which the shuttle is not able to make it to a runway and instead "ditches" in the ocean. But the commission said tests at NASA's Langely Research Center showed an impact in the ocean probably would cause major structural damage to the orbiter's crew cabin. In addition, "payloads in the cargo bay are not designed to withstand decelerations as high as those expected and would very possibly break free and travel forward into the crew cabin." Not a pleasant prospect.

"My feeling is so strong that the orbiter will not survive a ditching, and that includes land, water or any unprepared surface," astronaut Weitz told the commission. "I think if we put the crew in a position where they're going to be asked to do a contingency abort, then they need some means to get out of the vehicle before it contacts earth."

If there was a clear "winner" in the Rogers Commission report is was the astronauts. Nearly every concern raised by Young and his colleagues was addressed and NASA managers privately grumbled that with the re-emergence of "astronaut power," the agency would become so conservative it would be next to impossible to get a shuttle off the ground.

Recommendations
The Rogers Commission made nine recommendations to conclude its investigation of the worst disaster in space history.

1. A complete redesign of the solid rocket booster segment joints was required with the emphasis on gaining a complete understanding of the mechanics of seal operation; the joints should be as structurally stiff as the walls of the rockets and thus less susceptible to rotation; and NASA should consider vertical test firings to ensure duplication of the loads experienced during a shuttle launch. In addition, the panel recommended that NASA ask the National Research Council to set up an independent review committee to oversee the redesign of the booster joints.
2. NASA's shuttle program management system should be reviewed and restructured, with the program manger given more direct control over operations, and NASA should "encourage the transition of qualified astronauts into agency management positions" to utilize their flight experience and to ensure proper attention is paid to flight safety. In addition, the commission said NASA should establish a shuttle safety advisory panel.
3. The commission recommended a complete review of all criticality 1, 1R, 2 and 2R systems before resumption of shuttle flights. 4. NASA was told to set up an office of Safety, Reliability and Quality Control under an associate administrator reporting to the administrator of the space agency. This office would operate autonomously and have oversight responsibilities for all NASA programs.
4. Communications should be improved to make sure critical information about shuttle systems makes it from the lowest level engineer to the top managers in the program. "The commission found that Marshall Space Flight Center project managers, because of a tendency at Marshall to management isolation, failed to provide full and timely information bearing on the safety of flight 51-L to other vital elements of shuttle program management," the panel said. Astronauts should participate in flight readiness reviews, which should be recorded, and new policies should be developed to "govern the imposition and removal of shuttle launch constraints."
5. NASA should take action to improve safety during shuttle landings by improving the shuttle's brakes, tires and steering system and terminating missions at Edwards Air Force Base, Calif., until weather forecasting improvements are made at the Kennedy Space Center.
6. "The commission recommends that NASA make all efforts to provide a crew escape system for use during controlled gliding flight." In addition, NASA was told to "make every effort" to develop software modifications that would allow an intact landing even in the event of multiple engine failures early in flight.
7. Pressure to maintain an overly ambitious flight rate played a role in the Challenger disaster and the Rogers Commission recommended development of new expendable rockets to augment the shuttle fleet.
8. "Installation, test and maintenance procedures must be especially rigorous for space shuttle items designated criticality 1. NASA should establish a system of analyzing and reporting performance trends in such items."
9. In addition, the commission told NASA to end its practice of cannibalizing parts from one orbiter to keep another flying and instead to restore a healthy spare parts program despite the cost.