More than three years before the fatal flight of the space shuttle Challenger, National Aeronautics and Space Administration officials concluded that the mechanism they devised to seal solid rocket booster segments could fail and cause "loss of mission, vehicle and crew," according to documents released yesterday by the agency.
Six weeks later, in February 1983, NASA officially acknowledged the defect by reclassifying the seals into a category called "criticality 1." This meant, according to the documents, that a system originally thought to be fail-safe was not.
As late as last Aug. 19, Morton Thiokol, the booster manufacturer, told NASA that under certain circumstances there was a "high probability" that the seals could fail completely during the first two minutes after liftoff.
This situation would occur, the company said, because the backup O-ring seal does not work properly. Thus, if the main O-ring seal failed during ignition, there would be no barrier to prevent leakage of the hot exhaust gases inside the booster rockets, which help power the shuttle during the first two minutes.
The right-hand booster on the Challenger shuttle, which exploded shortly after liftoff Jan. 28, apparently failed about a minute into the flight. A burn-through of the righthand booster at or near one of the joints between its segments is being studied as a possible cause of the disaster, in which Challenger's crew of seven died.
In its 1982 report, NASA said that if the two O-ring seals in any joint failed, the result could be "loss of mission, vehicle and crew due to metal erosion, burn-through, and probable case burst resulting in fire and deflagration."
The documents reveal that the space agency worked with an increasing sense of urgency and rising concern about the defect, examining but never implementing a wide variety of proposed corrective measures, all of which would have required considerable expense and delay. Meanwhile, NASA was stepping up its pace of shuttle flights, trying to show it had a reliable, reusable vehicle that could attract commercial customers.
Other documents, from last year, show that NASA was beginning to settle on two corrective measures that were to have been tested for the first time today in a ground firing of a booster. The test has been postponed.
"Efforts need to continue at an accelerated pace to eliminate SRM [solid rocket motor] seal erosion," officials of Morton Thiokol wrote in a detailed review of the problem last August.
Despite the reclassification to the "criticality 1" level, NASA officials said yesterday at a briefing that they felt it was safe to continue flying shuttles because the seals had never failed entirely in ground tests or in the five flights that preceded the reclassification.
"Those tests and those analyses led us to conclude that the maximum erosion that could occur under the conditions of the gas flow were acceptable by a factor of two or three," said Lawrence B. Mulloy, head of the booster program at the Marshall Space Flight Center in Huntsville, Ala.
While conceding that the defect could lead to "a catastrophic loss of the vehicle and life," Mulloy said, "we concluded that we had a safe situation to fly with."
Two O-rings, a primary ring and a secondary, or backup ring, are used in each joint on the solid rocket booster. The problem that was recognized at least as far back as 1982 involved a warping of the portion of the steel joint that is supposed to hold the O-rings in place.
As long as the steel is not warped, there is a relatively small gap into which the O-rings must seat to seal the joint against leakage of the booster's hot exhaust gases.
After the first few shuttle flights NASA engineers examined the recovered boosters and found that pressures inside caused their walls to bulge, which warped the joints and expanded the gap. As a result, hot gases could rush past the primary seal, eroding it for at least a fraction of a second before the pressure forced it into place.
The documents confirmed a report on Tuesday to the presidential commission investigating the Challenger disaster that NASA had known of 22 instances in which primary O-rings had been partially eaten away by hot gases and 12 instances in which soot was found between the two rings. In one case the primary ring was completely burned through but the secondary, or backup, ring held. There has also been some erosion of secondary rings, according to the documents.
The documents show that in some cases more than half the diameter of the quarter-inch O-ring had burned away and that the burned areas extended as much as a foot along the length of the ring, which is about 37 feet long.
Although the rupture of Challenger's booster is thought to have occurred at a joint in the lower part of the main casing -- only one of three types of joints in the 149-foot, 1.3 million-pound booster rocket -- the documents reveal that similar problems have arisen at all joints.
One factor that made Challenger's flight different, and that may have further compromised the O-rings, was the 38-degree air temperature during launch.
Mulloy said there was concern before the launch that the cold might stiffen the O-rings, impairing their ability to seal.
He said a telephone conference was held between Morton Thiokol in Wasatch, Utah, and NASA officials at Cape Canaveral and Huntsville.
"The initial recommendation of Thiokol engineering was that we should launch within our experience base," Mulloy said. That meant not launching if the temperature was below 51, the coldest temperature encountered during any of the previous 24 launches.
However, after further analysis, Mulloy said it was decided "that should we compromise the primary ring, the secondary ring would seat as it has done in the past, even under those temperature conditions . . . . He recommended proceeding with the launch . . . . "
The agency is testing O-rings to see whether cold can rob them of the resiliancy needed to seat properly. Still another concern discussed in the documents is the putty used inside the booster to close the gap between segments of solid fuel. The putty is supposed to prevent hot gases from reaching the O-rings but the documents reveal that in every instance of O-ring erosion, the gases had blown a hole through the putty.
A Thiokol study, included in the documents, said that putty blow-holes can also form if the putty is improperly installed, leaving a gap, or when the O-rings are tested by forcing pressure from the outside through a small "test port" into the space between the two rings.
If the rings do not immediately seat properly, the test pressure can leak into the putty, creating a path for hot gases. There is evidence that the putty used in Challenger was more vulnerable to blow-through than the putty first used in the shuttles. In the first 12 shuttle flights there were four blow-holes. In four flights with new putty, there were seven.