Missed Warnings: The Fatal Flaws Which Doomed Challenger 32 Years Ago (Part 1)

On 7 March 1986, six weeks after the loss of Challenger, divers from the U.S.S. Preserver found the remains of the ill-fated shuttle’s crew cabin. It “was disintegrated, with the heaviest fragmentation and crash damage on the left side,” read the Rogers Commission’s final report into the cause of the disaster. “The fractures examined were typical of overload breaks and appeared to be the result of high forces generated by impact with the surface of the water.”

U.S. Navy spokesperson Deborah Burnette told a Washington Post journalist that “we’re talking debris, not a crew compartment, and we’re talking remains, not bodies.” The last vestiges of Challenger lay in 100 feet (30 meters) of water, about 16 miles (27 km) northeast of the Kennedy Space Center (KSC), and their discovery would help to unlock many of the mysteries of what happened on the tragic morning of 28 January, when America’s dreams of space exploration were cruelly shattered in the Florida sky and on millions of television screens around the world.

Veteran astronaut Mike Coats—later to serve as Director of the Johnson Space Center from 2005-2012—was among the first to examine the wreckage, and he described it as resembling “aluminum foil that had been crushed into a ball.” It contained the remains of the crew, but their horrific condition could be guessed from pathologists’ difficulty in identifying them: a few strands of Judy Resnik’s hair and a necklace were all that was left of Mission Specialist Two. Indeed, in the months after the disaster all astronauts were required to submit a clip of hair and a footprint to NASA for identification. In the case of the 51L remains, apparently, even dental records were insufficient for positive identification.

In his 2006 memoir, Riding Rockets, astronaut Mike Mullane expressed fervent hope that the explosive burn of the External Tank’s propellants had been enough to completely destroy Challenger’s crew cabin, or at least breach her flight deck windows, thereby causing a rapid depressurization and a mercifully rapid death. Having said this, when tested to 140 percent of its design strength in Lockheed’s Plant 42 rig almost a decade earlier, that same cabin had proved to be extremely hardy, and certainly its wreckage showed little evidence of having experienced an explosive depressurization.

Such an eventuality would have led to an upward “buckling” of the flight deck floor as air from the middeck rapidly expanded; no such buckling was detectable. Additionally, wrote JSC’s head of life sciences, former astronaut Joe Kerwin, in a 28 July letter to NASA Associate Administrator for Space Flight Dick Truly, the “impact damage to the windows [examined after recovery from the Atlantic] was so extreme that the presence or absence of in-flight breakage could not be determined. The estimated breakup forces would not in themselves have broken the windows. A broken window due to flying debris remains a possibility; there was a piece of debris embedded in the frame between two of the forward windows. We could not positively identify the origin of the debris or establish whether the event occurred in flight or at water impact … Impact damage was so severe that no positive evidence for or against in flight pressure loss could be found.”

Astronauts Jim Bagian and Manley “Sonny” Carter, both physicians, speculated that penetrations in the cabin’s aft bulkhead, created by the violently severed payload bay umbilical lines, could have led to a slower depressurization and quick unconsciousness for the seven astronauts, although this was conjectural. More conclusive evidence that at least some of the crew had remained alive and conscious for most of the fall to Earth came in mid-March 1986, when four Personal Egress Air Packs (PEAPs) were recovered. These were to provide each astronaut with a limited amount (about six minutes’ worth) of breathing air for use in emergencies. Analysis of the packs led to an announcement on 21 May that at least one had been activated in the seconds after structural breakup and, later, that this activation was not caused accidentally at water impact. Then, on 9 June, investigators revealed that one of the packs belonged to Pilot Mike Smith.

This raised an interesting scenario. Smith’s PEAP was affixed to the back of his seat, placing it out of his reach, which implied that either Judy Resnik or Ellison Onizuka, seated behind him on the flight deck, had leaned forward and switched it on in a valiant effort to save his life. A second identifiable PEAP belonged to Commander Dick Scobee and had not, apparently, been activated. The owners of the two other packs were never identified. The quantity of air which remained in Smith’s PEAP, in particular, led to a suggestion that apparent “crew inactivity” after breakup could be an indication that they had rapidly lost consciousness. Every scrap of paper from Challenger’s wreckage was analyzed, and it was determined that none of the astronauts had written a note; moreover, Smith’s air pack was depleted by barely two and a half minutes, almost precisely the length of time it took for the cabin to fall from the fireball to the Atlantic, which suggested he had kept his helmet visor closed during the descent. If it had remained open, all six minutes of his PEAP air would have leaked out.

Immediately after breakup, Challenger’s intercom, lights, computers, and electronics went dead. Bagian and Carter postulated that, in order to communicate, the crew’s only option would have been to raise their visors and speak aloud. Unfortunately, the helmets themselves were obliterated, which rendered it almost impossible to determine how, or if, the astronauts communicated during those final frantic minutes. However, Mullane believes from his own experience as a U.S. Air Force navigator, flying in the back seat of F-4 Phantoms in the 1960s and 1970s, that hand signals as a means of communication would have worked perfectly well. Scobee and Smith’s years of experience as fighter and test pilots would have taught them to keep their visors down, rather than risk lifting them and suffocating.

One factor is almost certain: most, if not all, of the astronauts were aware of their dire predicament. Milliseconds before the External Tank disintegrated, at T+73 seconds into the 51L ascent, a bright sheet of white vapor flooded across Challenger’s nose. It was probably visible to Smith, sitting in the right-hand seat, and may have prompted him to utter a brief exclamation (“Uh, oh”), which turned out to be the last vocal communication from the orbiter. It is also quite possible that he saw the top of the right SRB pivot into the side of the External Tank. Despite hoaxed intercom “transcripts” which alleged that the panic-stricken crew screamed and cursed their way down to the Atlantic, Mike Mullane expressed confidence that Scobee and Smith would have fought to the end to regain control of their crippled ship.

In the days after the disaster, most of the astronauts became convinced that a failure or explosion of one or more of the shuttle’s main engines was the most likely cause. Remnants of all three were dredged from the Atlantic on 23 February, each still attached to the thrust structure, and the controllers for the Number Two and Three engines were found, disassembled, flushed with deionized water, dried, vacuum-baked, and their data extracted. All of the engine debris exhibited burn damage caused, according to the Rogers report, “by internal over-temperature typical of oxygen-rich shutdown.”

Thus, the loss of hydrogen fuel after the rupturing of the lower part of the External Tank appeared to have caused all three units to begin shutting themselves down within milliseconds of each other at around T+73.5 seconds. Overall, the performance of the main engines was satisfactory and in line with observations from previous missions. They first exhibited “abnormal” behavior about a second before breakup, when their fuel tank pressures dropped and the controllers responded by opening the fuel flow-rate valves.

Next, turbine temperatures increased due to the leaner fuel mixture feeding into the combustion chambers from the External Tank. Otherwise, the Rogers report continued, “engine operation was normal.” They did not contribute to the loss of 51L. Nor did the gigantic tank itself, of which 20 percent was recovered, mostly debris from the inter-tank and the lowermost hydrogen section. Initial speculation that there had been premature detonation of range safety explosives was discounted, partly because the unexploded ordnance was among the debris, as were theories of structural imperfections in the tank’s design or damage incurred at liftoff. The possibility of a liquid hydrogen leak at liftoff was also dismissed, since it would immediately have been ignited by the exhaust from the Solid Rocket Boosters or main engines and would have been evident in the downlinked telemetry data.

In total, around 30 percent of Challenger was found, and inspections revealed that she had disintegrated as a result of massive aerodynamic overloads, with no evidence of internal burn damage or exposure to explosive forces. Chemical analyses indicated that her right side had been sprayed with hot gases from the leaking SRB, but telemetry indicated that all of her systems operated normally until shortly prior to the breakup. No problems were detected with either of her payloads. The Spartan-203 free-flying solar satellite was unpowered during ascent and the deployment ordnance for the Inertial Upper Stage (IUS) and the Tracking and Data Relay Satellite (TDRS-B) showed no indication of having prematurely activated.

The finger of blame pointed squarely at the boosters and, in particular, at the leaking right-side booster. Initial suspicion that its range safety explosive charges had been inadvertently fired was dismissed when telemetry data revealed that no such commands were sent to either booster until both were remotely destroyed by the Range Safety Officer at T+110 seconds. For a number of engineers and managers at SRB manufacturer Morton Thiokol and within NASA, however, the cause of the disaster had been identified more than a year before Challenger’s maiden voyage: the primary and secondary O-rings meant to prevent a leakage of hot gases were incapable of properly sealing the gaps between the SRB joints in extremely cold weather. Already, catastrophe had been averted on one previous cold-weather launch in January 1985 and conditions in the hours leading up to 51L’s liftoff were colder still. Moreover, an application of zinc chromate putty, intended as a “thermal barrier” to keep the combustion gas path away from the two O-rings, had been shown as early as 1984 to be susceptible to the formation of “blow holes,” which compromised its effectiveness.

“It was intended,” read the Rogers report, “that the O-rings be actuated and sealed by combustion gas pressure displacing the putty in the space between the motor segments. The displacement of the putty would act like a piston and compress the air ahead of the primary O-ring and force it into the gap between the [field joint’s] tang and clevis. This process is known as ‘pressure actuation’ of the O-ring seal. This pressure-actuated sealing is required to occur very early during the solid rocket motor ignition transient, because the gap between the tang and clevis increases as pressure loads are applied to the joint during ignition. Should pressure actuation be delayed to the extent that the gap has opened considerably, the possibility exists that the rocket’s combustion gases will blow-by the O-rings and damage or destroy the seals. The principal factor influencing the size of the gap opening is motor pressure, but gap opening is also influenced by external loads and other joint dynamics.”

One of these external factors was the detrimental impact of low launch temperatures, together with the effect of water and ice, on the O-rings. In the case of 51L, on the night of 27 January 1986, ambient temperatures had dipped to the lowest ever recorded for a shuttle launch: around -13 degrees Celsius (8.6 degrees Fahrenheit). Indeed, at the moment of ignition the following day, the right-hand booster’s aft field joint was the coldest part of the stack at -2.2 degrees Celsius (28 degrees Fahrenheit). Ground tests had already confirmed that reduced temperatures could cause the O-rings’ resiliency to degrade, and during the Rogers investigation it was learned that a small quantity of rainwater had been found in Columbia’s SRB joints during preparations for STS-9 in November 1983. It was theorized that 51L, which had been sitting on Pad 39B for a total of 38 days and been exposed to significantly more rainfall than Columbia, could have suffered from the further disruption, and perhaps even “unseating,” of its O-rings by frozen water.

The observed problem with the boosters first arose in November 1981, shortly after STS-2. Routine inspections revealed significant erosion of the right-hand SRB’s primary O-ring due to hot combustion gases, yet the secondary seal remained intact and the anomaly went unreported at the Flight Readiness Review for STS-3 in March 1982. Morton Thiokol believed that the erosion had been caused by blow holes in the zinc chromate putty and began tests to alter the method of its application and the assembly of the booster segments. The manufacturer of the original putty, Fuller-O’Brien, discontinued its use and a new putty from the Randolph Products Company was selected in May 1982; however, after more changes, it was substituted for the original putty the following summer, shortly before the launch of STS-8.

Since December 1982, the O-rings had been designated a “Criticality 1” item by NASA, denoting a component without a backup, whose failure would result in the loss of the shuttle and its crew. Prior to that, they had been labeled by NASA as “Criticality 1R,” meaning that, although “total element failure … could cause loss of life or vehicle,” the presence of primary and secondary O-rings lent “redundancy” to the design: in effect, the secondary seal would expand to fill the joint if its primary counterpart failed. However, in its Critical Items List of November 1980, NASA acquiesced that “redundancy of the secondary field joint seal cannot be verified after motor case pressure reaches approximately 40 percent of maximum expected operating pressure. It is known that joint rotation occurring at this pressure level … causes the secondary O-ring to lose compression as a seal.”

Following a series of high-pressure tests of the O-rings, conducted by Morton Thiokol in May 1982, it became clear that the secondary seal did not provide sufficient redundancy, and NASA changed their criticality listing later that year. According to then-Associate Administrator for Space Flight (Technical) Michael Weeks, who signed a waiver to accept the new criticality level in March 1983, “we felt at the time that the Solid Rocket Booster was probably one of the least worrisome things we had in the program.” This view was shared by managers and astronauts, too. But not by Thiokol structural engineer Roger Boisjoly.

By the time Boisjoly inspected severely damaged field joints from Mission 51C’s boosters in January 1985, a number of other missions had yielded disturbing O-ring erosion. On Mission 41B, almost a year earlier, in February 1984, the left-hand SRB’s forward field joint and the nozzle joint belonging to its right-hand counterpart were found to be badly degraded, to such an extent that NASA requested Thiokol to investigate means of preventing further erosion. A week prior to the launch of the next flight, Mission 41C, the company concluded that blow holes in the zinc chromate putty were one “possible cause,” and NASA’s SRB project office at the Marshall Space Flight Center in Huntsville, Ala., decided that, as long as the secondary O-ring could survive gas impingement, the mission was safe to fly. It was the beginning of a disturbing chain of thought within NASA and Thiokol, explained the Rogers report, that “there was an early acceptance of the problem” and both organizations “continued to rely on the redundancy of the secondary O-ring long after NASA had officially declared that the seal was a non-redundant, single-point [Criticality 1] failure.”

One of the members of the Rogers inquiry was the celebrated physicist Richard Feynman, who judged the cavalier attitude of NASA and Thiokol as representing “a kind of Russian roulette … [the shuttle] flies [with O-ring erosion] and nothing happens. Then it is suggested, therefore, that the risk is no longer so high for the next flights. We can lower our standards a little bit because we got away with it last time. You got away with it, but it shouldn’t be done over and over again like that.” Mike Mullane scornfully called it the “normalization of deviance.”

The damage from Mission 51C was among the most serious yet seen. Launched in freezing conditions of just 11 degrees Celsius (51.8 degrees Fahrenheit) on 24 January 1985, its recovered left and right SRB nozzles showed evidence of “blow-by” between the primary and secondary O-rings, and, moreover, it proved to be the first shuttle mission in which the secondary seal displayed the effects of heat. “SRM [Solid Rocket Motor]-15,” said Boisjoly of one of the 51C boosters, “actually increased concern because that was the first time we had actually penetrated a primary O-ring on a field joint with hot gas, and we had a witness to that event because the grease between the O-rings was blackened, just like coal. That was so much more significant than had ever been seen before on any blow-by on any joint.” When the blackened material was analyzed, Boisjoly told the Rogers hearing, “we found the products of putty in it [and] the products of O-ring in it.” Four days after 51C landed, on 31 January, Lawrence Mulloy, head of the SRB office at the Marshall Space Flight Center, expressed concern over the impact O-ring problems may have on the next scheduled flight, Mission 51E, then projected for launch in late February. One of Thiokol’s conclusions before the Flight Readiness Review was that, while “low temperature enhanced probability of blow-by … the condition is not desirable, but is acceptable.”

It was the first occasion on which a link between cold weather and O-ring damage had been officially acknowledged. Yet far more missed warnings were to come … and in doing so, they would set up the cards for the worst and most public disaster in NASA’s history.

The second part of this article will appear tomorrow.

.

.