The Challenger accident was caused by the failure of a solid rocket booster joint that NASA and the booster manufacturer had failed to improve despite eight years of warnings that it was dangerous, the presidential commission investigating the disaster said in its final report yesterday.
A major reason for the space agency's failure to heed the warnings, the report says, was pressure to meet an "over-ambitious" schedule of 24 shuttle flights a year by 1990. The pressure caused such extensive disruption that the shuttle program probably would have soon broken down, even in the absence of an accident, it says.
The commission's study goes well beyond the problems with the joints. It found serious flaws in the National Aeronautics and Space Administration's overall safety program, its system of checking flight hardware, its crew training, its testing of the orbiter engines, its paper work and its abrupt and disruptive changes in flight payloads to accommodate commercial customers.
In addition, it says spare parts were being cannibalized from one shuttle for another and that program technicians were overworked and fatigued. All these factors compromised flight safety, it says.
The strongly worded report calls for a sweeping overhaul of NASA's management practices. It also urges the creation of several safety review panels within the agency as well as an outside body to ensure that the booster joint is redesigned to meet stringent criteria set out in the report.
And it urges a return to use of the more traditional unmanned expendable rockets for launching payloads, concluding that "reliance on the shuttle" created "a relentless pressure on NASA."
The 256-page report, which includes photographs, charts and diagrams, lays out a highly detailed and richly documented case that the space agency's management practices have failed for years to resolve a variety of safety problems, including the joints.
"I think, in a sense, this is a kind of national tragedy that a lot of us are to blame for," commission Chairman William P. Rogers said at a White House ceremony yesterday when he formally presented the report to President Reagan. "I think, in a sense, the administration, Congress, the press -- all of us were too optimistic, too willing to accept the fact that this [shuttle] is operational. I don't think there's anything to gain by trying to assess blame."
Yet Lawrence B. Mulloy, head of the booster program at the Marshall Space Flight Center in Huntsville, Ala., and the Marshall Center itself figure prominently in the report as the most serious trouble spots. The report says the panel found evidence that some of Mulloy's commission testimony was false. The report says Marshall failed to communicate serious safety problems to NASA headquarters.
Mulloy earlier was transferred from his previous job, a move Rogers referred to yesterday as "constructive."
"NASA's attitude historically has reflected the position that 'we can do anything,' and while that may essentially be true, NASA's optimism must be tempered by the realization that it cannot do everything," the report says.
The destruction of Challenger and its seven-member crew Jan. 28 was an accident that did not have to happen, the report says, citing not only the unheeded warnings but a number of close calls in flight since the second shuttle launch in 1981.
"Not recognizing and reporting this trend can only be described, in NASA terms, as a 'quality escape,' a failure of the program to preclude an avoidable problem. If the program had functioned properly, the Challenger accident might have been avoided," the report says.
"The space shuttle's solid rocket booster problem began with the faulty design of its joint and increased as both NASA and contractor management first failed to recognize it as a problem, then failed to fix it and finally treated it as an acceptable flight risk," the report says.
Among the commission's chief findings:
*The cause of the Challenger accident was determined to be the failure of O-rings in the right-hand booster joint to contain the pressure of hot gases produced by burning rocket fuel. Flames burned through the booster wall, causing the booster to tear away from the external tank, which ruptured, spilling highly flammable liquid hydrogen and liquid oxygen.
*Low temperatures on launch day stiffened the rubber O-rings so much that they could not maintain a seal in a joint that, because of poor design, opened the gap the rings were supposed to seal in the first second after ignition.
*Neither NASA nor booster manufacturer Morton Thiokol Inc. understood how the joints worked nor did they test the joints in a reasonable simulation of how they would be used in flight.
*Both NASA and Thiokol were playing "a kind of Russian roulette" by continuing to fly the shuttle despite known problems. They "accepted escalating risk apparently because they 'got away with it last time.' "
*Although NASA officials repeatedly told the commission that there was no correlation between cold temperatures and O-ring problems on previous flights, the commission found the opposite and said that NASA should have, too. In all four prior flights that launched below 65 degrees, there was damage to O-rings. By contrast, of 20 flights in warmer weather, only three experienced O-ring damage.
*Top NASA officials in Washington received a sufficiently detailed briefing on the O-ring problems in August 1985 to have stopped shuttle flights long enough to correct the problem. But they did not.
*The commission was "surprised" that in all the testimony it heard, "NASA's safety staff was never mentioned." A report chapter, called "The Silent Safety Program," says no member of the safety staff was invited to key meetings leading to launch. Cutbacks in safety department staffing weakened its role, and at Marshall and the Kennedy Space Center, safety offices are supervised by the same people they are supposed to check on.
*The night before launch, when Thiokol management reversed the no-go recommendation of its engineers, the switch was made not on the basis of sound safety concerns but "to accommodate a major customer."
*On the morning of Jan. 28, when orbiter manufacturer Rockwell International advised against launch because of ice on the launch tower, the company's degree of expressed concern was ambiguous -- but NASA should have scrubbed anyway.
The commission's specific recommendations are:
*Eliminate or redesign the joint. A panel of the National Research Council should oversee the effort. NASA is already doing this.
*Reorganize the shuttle program so managers are accountable to the overall program rather than their individual NASA centers, and include more astronauts in management.
*Review the shuttle's most critical parts to see that they are as safe as possible, and have the findings verified by an independent panel of the National Research Council.
*Create a larger, more powerful Office of Safety, Reliability and Quality Assurance, headed by an associate administrator who reports directly to the NASA administrator.
*Improve communications between Marshall and other NASA centers and keep better records of flight readiness meetings.
*Improve tires, brakes and steering systems critical to landing safety. Land only at Edwards Air Force Base until improvements are made.
*Reexamine whether to provide means of crew escape once the orbiter is free of solid rockets. (Escape before this point is not feasible.)
*Establish a rigorous system for maintaining highly critical shuttle parts and have enough spare parts to stop cannibalizing one orbiter to supply another.
The commission urged that NASA report to the president in a year on its progress in fulfilling the recommendations.
Perhaps the most damning chapter in the report deals with the history of the booster's joint design. Under the heading "An Accident Rooted in History," the chapter shows that the Challenger disaster could be seen coming as far back as 1977, four years before the first shuttle flight.
Engineers at Marshall were evaluating early laboratory tests of the joints that showed that the gap opened when subjected to pressure, the opposite of what Thiokol designers assumed. Thiokol disputed the findings.
In 1977, Marshall engineers Leon Ray and John Q. Miller wrote a report calling for a redesign of the joint, saying, "We see no valid reason for not designing to accepted standards." Redesign, they said, was "mandatory to prevent hot gas leaks and resulting catastrophic failure." NASA rejected the judgment of its engineers.
In 1980 a NASA panel appointed to review the safety of the shuttle in preparation for its first flight wrote that the lab findings showed the O-rings "inadequate to provide operational program reliability and marginal to provide adequate safety factor confidence." Despite this, NASA declared the joints safe enough to fly and continued to do so, even as Thiokol engineers warned in memos of potential "catastrophe."
Over the years, the report says, concern about the problem grew only slowly until 1985 when a rash of O-ring damage cases, including a severe instance in 53-degree weather, caused Thiokol to reexamine the seal's reliability. The company tested the effects of temperature on O-ring resiliency, the ability to spring back from a squeezed condition and maintain a seal as the joint's gap widens. The findings indicated that at 75 degrees, resiliency was diminished and at 50 degrees, virtually nonexistent.
"As the joint problems grew in number and severity," the report says, "NASA minimized them in management briefings and reports. Thiokol's stated position was that 'the condition is not desirable but is acceptable.' "
"At no time," the commissioners wrote, "did management either recommend a redesign of the joint or call for the shuttle's grounding until the problem was solved."
The report says nothing about what happened to the crew as the cabin fell. Privately, however, some commissioners say there is reason to believe the crew may have been alive and conscious for at least the first few seconds after the cabin emerged from the fire.
Loss of pressure and oxygen as well as the forces of rapid tumbling, they say, probably rendered crew members unconscious after perhaps 10 to 20 seconds.
The seven crew members killed in the accident were shuttle commander Francis R. (Dick) Scobee, pilot Michael J. Smith, mission specialists Ellison S. Onizuka, Judith A. Resnik and Ronald E. McNair, payload specialist Gregory B. Jarvis and teacher in space Christa McAuliffe.
In the chapter called "The Silent Safety Program," the commission documents the almost total absence of a safety program in prelaunch decision-making.
The report singles out for attention a 1983 change requested by Martin Raines, director of safety, reliability and quality assurance at the Johnson Space Center in Houston, which eliminated much reporting of flight safety problems to top NASA officials.
"With this action, Level II [top shuttle program managers] lost all insight into safety, operational and flight schedule issues resulting from Level III [middle managers such as the Marshall propulsion officials]," the report says. Raines had said the change was to "streamline the system" after it had become "operational."
The safety program at Marshall "should have tracked and discovered the reason" for a "striking change in performance" of the booster joints beginning in January 1984.
Another failure of the safety program cited in the report is the continuing uncertainty surrounding the "criticality" -- the potential risk -- of the booster joint.
Though the joint had been officially categorized as posing the highest possible risk to mission and crew as early as 1982, most of the paper work on the problem done by Thiokol and Marshall listed it as Criticality 1R -- meaning there was backup hardware, or redundancy, in the system to reduce the risk, although there was not.
"As a result," the report says, "informed decision-making by key managers was impossible." As late as March 7, five weeks after the accident, the problem assessment system operated by Rockwell contractors at Marshall still listed the joint as Criticality 1R.
Jesse W. Moore, chief of the shuttle program at the time of the accident, was "misinformed" about what Marshall was doing to fix the joint problem and about the issue of joint risk, the report says.
In establishing the flight schedule after President Reagan declared the shuttle operational on July 4, 1982, the report says, "NASA had not provided adequate resources for its attainment." As a result, the capabilities of the system were strained even by the modest nine-mission rate of 1985, and the evidence suggests that NASA would not have been able to accomplish the 15 flights scheduled for 1986.
The panel urges NASA to develop firm new ground rules for flight rates based on "a realistic assessment of what NASA can do safely and well."
NASA was allowing disruptions to build up, which meant that the "end of the production chain: crew training," was getting increasingly squeezed, the report says. It quoted astronaut Henry Hartsfield as saying, "Had we not had the accident, we were going to be up against a wall . . . . For the first time, somebody was going to have to stand up and say we have got to slip the launch because we are not going to have the crew trained."
Among the disruptions were those caused when shuttle customers requested changed launch dates because of "development problems, financial difficulties or changing market conditions. NASA generally accedes to these requests and has never imposed the penalties available" against the customers, the report says.
Even small cargo changes take a lot of time if they are made late, Johnson Space Center official Harold Draughon told the commission.
"Accomplishing the more pressing immediate requirements diverted attention from what was happening to the system as a whole," the report says. "In many respects, the system was not prepared to meet an 'operational' schedule."
"At Kennedy Space Center, numerous contract employes have worked 72 hours per week or longer and frequent 12-hour shifts," the report says. "The potential implications of such overtime for safety were made apparent during the attempted launch of mission 61C on Jan. 6, 1986, when fatigue and shiftwork were cited as major contributing factors to a serious incident involving a liquid oxygen depletion that occurred less than five minutes before scheduled liftoff."
The spare parts problem also was coming to a head at the time of the accident. By last January, "only 32,000 of the required 50,000 items (65 percent) had been delivered." Funding cuts "necessitated major deferrals of spare parts purchases."
It became an "essential modus operandi" for NASA to cannibalize spares, that is, to remove parts from one shuttle orbiter for installation in another. "This practice is costly and disruptive and introduces opportunities for component damage . . . and is a potential threat to flight safety."
"I think we would have been brought to our knees this spring by this problem if we had kept trying to fly," Horace Lamberth, director of shuttle engineering at Kennedy, told the commission in an interview.
As of spring 1986, the shuttle logistics program was approximately one year behind, the report says. "Unless logistics support is improved, the ability to maintain even a three-orbiter fleet is in jeopardy."
A "serious problem" among shuttle technicians is a perception that they might be "punished" or even lose their jobs if they report accidental damage to the space craft, the report says. Consequently, "accidental damage is not consistently reported."
In an appendix to the report, the panel is harshly critical of NASA's system of documenting shuttle processing problems and concludes that the system itself is a problem. "The amount of flawed paper work -- approximately 50 percent -- is unacceptable," it says.