Spaced Out: Insights from the Accident to

the Space Shuttle Columbia.

This case has been prepared by Prof. S.Chandrashekar of the Indian Institute of
Management. It is based on the report put out in the public domain by the Columbia Accident
Investigation Board set up by the President of the United States of America to investigate the
accident to the Space shuttle orbiter Columbia. The objective of this case is to provide
students of the Post Graduate Programme in Management of IIMB with a flavour of the real
problems of decision making in complex environments. It is not intended to serve as an
endorsement of any of the actions undertaken by any of the parties described in the case.
Neither is it meant to illustrate effective or ineffective management practices.

Copyright © Indian Institute of Management, Bangalore, June, 2004.

Spaced Out: Insights from the Accident to the Space Shuttle Columbia.
1. The Accident and the Columbia Accident Investigation Board (CAIB)

On January 16th 2003 at 10.39 AM Eastern Standard Time (EST) the Space Shuttle Columbia
lifted off from the Kennedy Space Centre in Florida on the 113th mission of the Space
Transportation System (STS). There was no indication prior to the launch that this flight of
Columbia (STS 107 in NASA terminology) was doomed to be its last. Named after an
American sloop that was the first US vessel to circumnavigate the earth, Columbia was also
the first of the five original orbiters to fly into space and return to earth after a successful
mission. Before the ill-fated STS 107 mission Columbia had flown 27 times into space and
returned successfully. Two minutes and seven seconds after launch the Solid Rocket Boosters
separated from the Shuttle. They splashed down normally in the Atlantic Ocean and were
recovered successfully for refurbishment and reuse. Approximately 8 and a half minutes after
launch, the Space Shuttle Main Engines shut down. This was followed by the separation of
the External Tank. At 11.20 AM Columbia’s onboard engines fired to place Columbia in a
175 miles earth orbit with an orbit inclination of 39 degrees. The mission proceeded normally
with all experiments being carried out by the crew of seven members working on a double
shift basis. Re-entry of Columbia took place as planned on February 1st at 8.15 A.M. When
Columbia crossed the California coast on its long glide path at 8.53 A.M the first indications
of problems were seen. Left wing edge temperatures were higher than normal. At 8.54
Mission controllers detected the possible failures of some hydraulic sensors located near the
left wing. This was followed by the failure of other sensors indicating a major problem
possibly originating in the left wing of the orbiter. By 8.59 even before the crew could be
alerted all communications had been lost with the orbiter. By 9.00 A.M observers on the
ground saw pieces from the disintegrating orbiter streaking across the sky. The Columbia had
been lost. All seven members of the crew including Kalpana Chawla an American citizen
born in India perished. It had been a little over 17 years since the Space Shuttle Challenger
had disintegrated immediately after launch on the 28th of January 1986.

A Columbia Accident Investigation Board (CAIB) was constituted to understand the reasons
for the failure. (See Annexure 1 for details of the membership of the CAIB). After one of the
most thorough investigations of the causes behind the failure, the CAIB submitted its formal
report to the President of the United States. The Board in its summary statement said, “It is
our view that complex systems almost always fail in complex ways and we believe it would
be wrong to reduce the complexities and weaknesses associated with these systems to some
simple explanation. Too often accident investigations blame a failure only on the last step
in the complex process when a more comprehensive understanding of that process could
reveal that earlier steps might be equally or even more culpable”.

This case has been prepared by Prof. S.Chandrashekar of the Indian Institute of Management. It is based on the
report put out in the public domain by the Columbia Accident Investigation Board set up by the President of the
United States of America to investigate the accident to the Space shuttle orbiter Columbia. The objective of this
case is to provide students of the Post Graduate Programme in Management of IIMB with a flavour of the real
problems of decision-making in complex environments. It is not intended to serve as an endorsement of any of
the actions undertaken by any of the parties described in the case. Neither is it meant to illustrate effective or
ineffective management practices.

2
According to the CAIB the technical reason for the failure of Columbia was a strike by a
piece of foam insulation from the External Tank that caused a breach in the Thermal
Protection System of the Orbiters left wing.

Photographic evidence clearly showed that a piece of foam between 21 to 27 inches long and
between 12 to 18 inches wide had struck the underside of the left wing 81.7 seconds after lift
off. This strike breached the thermal protection system of the shuttle exposing the thin
aluminium layer. During reentry this breach allowed superheated air to penetrate the RCC
thermal insulation on the left wing leading to meltdown of the aluminium shell. This led to
loss of control, build up of aerodynamic forces that could no longer be handled by the
orbiters control system and finally
led to the breakup of the shuttle at
about 8.59 A.M over the Dallas
Fort Worth Area in Texas on
February 1st 2003. The Figure
shows the area of impact of the
foam strike.

The purpose of this necessarily

simplified account of the failure of
a complex system is to give
students of strategy a flavour of
how engineers and managers look
at the world and how events they
encounter, their experiences and
the expectations of other more
powerful people within the system
influence their thoughts and
actions. If strategy emerges as
patterns in decision-making,
obviously these processes by
means of which thinking and actions are influenced by the socio-technical system are crucial
for any understanding how strategies are formed and implemented.

2. NASA and the Space Shuttle Programme.

Annexure 2 provides an overview of NASA, its mission, the various centres their
responsibilities, and the various NASA programmes. It also provides details of the way in
which the space shuttle activities are organised. Annexure 3 provides a technical description
of the shuttle, the major components that make up the shuttle and a broad overview of how
they are put together to constitute the shuttle.

In order to be able to understand the causes of the accident we also need to understand the
technical tasks involved in preparing and launching the shuttles and the organizational
structure used by NASA for this purpose. With the help of the details available in Annexure 2
and 3 we can put together the following picture.

Each shuttle consists of the following:

• An orbiter that carries the crew and equipment into space and brings them back to
earth. Since each earth returning orbiter has to go through a very long controlled glide
 through the earth’s atmosphere its thin aluminium shell is covered with a Thermal
Protection System (TPS) so as to enable it to survive the high temperatures
encountered during re-entry. The Thermal Protection System consists of different
kinds of tiles that can withstand different kinds of temperatures. Most of them are
silica or other ceramic-based tiles that are specifically designed to handle very high
temperatures. Certain regions of the Orbiter especially in and around its wings require
higher protection. These areas are protected by Reinforced Carbon-Carbon Composite
(RCC) panels. The orbiter has its own rocket engines for use in orbit and for re-entry.
It also has the necessary airlocks for any Extra Vehicular Activity.
• The Space Shuttle Main Engine attached to the orbiter is the source of thrust for the
initial ascent of the Shuttle into space. These are reusable engines operating with
liquid hydrogen and liquid oxygen the most advanced rocket fuels currently in use.
The large bell-shaped nozzles are movable in two dimensions and provide control for
the shuttle during ascent. The engine is fixed to the orbiter on the aft or rear side.
• A very large External Tank provides the necessary liquid oxygen and liquid hydrogen
fuel for the Shuttle main engines. The External tank consists of 3 sub components - a
tank for carrying liquid hydrogen, a tank for carrying liquid oxygen and an intertank
area that separates them. The Orbiter and the Solid Rocket boosters are attached to
this External Tank to form the shuttle stack on the launch pad. Since the tank carries
liquid hydrogen and liquid oxygen that can evaporate easily, the tanks have to be
insulated from the outside temperatures. Insulating foam covers the whole of the
external tank to ensure that the cryogenic oxygen and hydrogen do not evaporate.
Under some weather conditions water can condense on the tanks leading to ice
formation. During launch these pieces of ice could fly off and critically damage parts
of the orbiter especially the Thermal Protection System. This could pose risks during
takeoff as well as during reentry especially if the Thermal Protection System is
damaged or breached during lift-off. The External Tank is jettisoned just before the
shuttle reaches orbit. It re-enters the earth’s atmosphere and burns up.
• Two Solid Rocket Boosters augment the thrust provided by the External Tank /
Shuttle Main Engine combination. They are connected to the External Tank. After
burnout they are separated from the shuttle recovered and reused.

Each of these components is a high tech product and its development fabrication and quality
assurance require highly advanced and specialized technical knowledge and skills. The
various elements arrive from the contractors to the Kennedy Space Centre where they are
integrated in a special assembly bay and then moved to the launch pad for launch.

This very simplified view of operations also dictates to some extent the organization of
shuttle related activities at NASA. (See the organization chart in Annexure 2 for more
details.) At the time of the Columbia accident there were 4 shuttles in operation. Each shuttle
mission could be used for science missions (a life sciences or materials sciences or an earth
sciences mission) or for a mission to the International Space Station – a low earth
permanently manned station in near earth orbit. After the Challenger accident in 1986 the
shuttle was banned from carrying satellites into orbit for launch from space. The number of
shuttles and the different missions also raise problems of scheduling, allotments of
components (which Solid rockets which main engine and which External Tank to use for
which orbiter). To take care of the whole programme, the main body responsible for all
shuttle activities is the Space Shuttle Programme Management Office at Johnson Space
Centre (JSC). Management integration in terms of scheduling, allocating engines, rockets and
4
tanks to the various orbiters, is carried out through a Shuttle Management Integration Office
functioning under the Shuttle Programme Management Office. After each mission the various
reusable elements of the shuttle have to be disassembled and returned to the various
contractors for refurbishement and re-certification. These activities fall within the ambit of
the Shuttle Processing Office under the main Shuttle Programme Management Office. The
technical aspects of checking out the propulsion elements – the External Tank, the Solid
Rocket Boosters and the Shuttle Main Engines is carried out by the Space Shuttle Projects
Office which though located at the Marshall Space Flight Centre comes under the purview of
the Shuttle Programme Management Office at JSC. Each shuttle mission involves a different
set of activities and astronauts have to train for them. This aspect of each mission is the
responsibility of the Flight Crew Operations Directorate. Extra Vehicular Activity of the crew
comes under the mandate of a separate entity under the main Programme Office. Each
mission involves the integration of different payloads with the orbiter, and the integration of
the orbiter with the External Tank and the Solid Rocket Boosters. The orbiter / payload
integration is the responsibility of the Shuttle Systems Integration Office, while the
integration of the orbiter and its interfaces with other propulsion elements comes under the
purview of the Space Shuttle Vehicle Engineering Office. The further integration of the
orbiter with the External Tank and the Solid Rocket Boosters along with other launch related
operations vests with the Launch Integration Office located at the Kennedy Space Centre. A
Launch Director is responsible for ensuring safe launch and a Flight Director is responsible
for all aspects of safe flight from preparation to launch to return.

The Mission Operations Directorate is responsible for the actual sequencing and conduct of
all activities related to the mission. This requires an understanding of the various interacting
hardware and software elements as well an understanding of crew activities, safety issues and
any problems of safety arising during the actual mission. Each mission involves a Mission
Management Team with representatives of the various key organizations and contractors
functioning under the direction of a mission manager from this directorate. The Mission
Management Team may need support in terms of engineering data, analysis etc. The Space
Shuttle Vehicle Engineering Office provides such support to the Mission Team through a
Mission Evaluation Room (MER). This MER is the focal point through which various
engineering inputs that is likely to affect the mission are coordinated and presented to the
Mission Management Team. Though not shown in the chart actual operations with the shuttle
are carried out by Mission Controllers who communicate and monitor all activities on the
shuttle. They of course function under the overall control of the Mission Management Team.
There is also a Space Shuttle Business Office that is responsible for managing the major
Shuttle Flight Operations Contract (SFOC) with United Space Alliance (USA). However
though the contract is managed by the Business Office every technical activity involved in
the shuttle operations would involve direct dealing between a NASA technical / managerial
team and their counter-part technical team of the contractor. There are various levels of
activities – System, Sub System, component etc. all of which involve significant levels of
information exchange and coordination between NASA and sub-contractor personnel. Most
NASA personnel come under both a Centre Directorate, or Discipline or Activity centre as
well as have a responsibility to the Shuttle programme and a specific Shuttle mission.
Activities take place at multiple sites depending on the specific operations involved. Email,
teleconferencing as well as face-to-face meetings are used for transferring information,
analysis and for coordinating activities and actions. A Space Shuttle Safety and Mission
Assurance team attached to the Shuttle Programme Management Office provides safety
related services for the shuttle missions. Though the Johnson Space Centre is the lead centre
5
for Shuttle activities, Kennedy Space Centre and the Marshall Space Flight Centre have
major roles to play in the Shuttle programme. Other NASA centres with specific expertise
either in some of the major programmes (Life Sciences or Earth Sciences) or in specific
technology areas (Materials, Aerodynamics, Structures) would be involved on a case-by-case
basis in terms of mission or on specific problems that may be encountered. A NASA Deputy
Administrator at NASA HQ is responsible for oversight over the International Space Station
and its linked Shuttle programmes.

The processes by means of which the various activities of each of the management and work
centres are linked are also worth highlighting to understand some possible causes behind the
Columbia failure. The operational routines followed by NASA before launching and
recovering the shuttle are well thought out and clear in terms of documentation, procedures
and practices. Project milestones and reviews, programme reviews at different times, and a
Flight Readiness Review with the NASA HQ Deputy Administrator in charge of the shuttle
takes stock of all activities related to the flight and the mission. This would cover the Orbiter,
the payloads, the propulsion elements, the integration and launch pad activities, the mission,
ground readiness, crew training, contingencies, reliability and safety. Any deviations are
specifically tagged for close out by the Mission Management team before the launch. The
Programme Requirements Control Board also reviews all data and anomalies reported from
previous flights. It classifies problems into different categories. Serious problems are tagged
as “In flight anomalies” that have to be analysed, understood and if necessary corrected
before the next shuttle mission. The Mission Management Team with representatives from
the various critical functional areas is constituted and prepares a detailed mission
management plan that covers all activities from count down to launch to in-orbit operations to
re-entry and landing. For Columbia the Mission Management Team consisted of technical
managers from Vehicle Engineering, Systems Integration, the Flight Operations Contract
Office, the Safety Office, and the Johnson Space Centre Directors of Flight Crew Operations,
Mission Operations as well as the Space Sciences and Life Sciences Directors. This Mission
Team typically starts full time functioning a few days before launch and disbands only after
the orbiter has landed. It directly reports to the Shuttle Programme Manager. It is responsible
for resolving all issues outside the authority of the Launch and the Flight Director. Before
launch this Mission Management Team is chaired by the Launch Integration Manager at the
Kennedy Space Centre. Once the shuttle clears the launch pad responsibility passes on to the
Flight Director at Johnson. During the flight the mission is also evaluated from the
engineering perspective. This is carried out at a Mission Evaluation Room with a manager
and functions under the Vehicle Engineering Office. The Manager of the Mission Evaluation
Room coordinates all evaluations drawing upon any expertise anywhere in the NASA system
and presents his findings to the Mission Management Team. If there are problems during the
flight they are grouped into different types. “In family problems” are problems that are not
serious and can be related to problems that have occurred in the past. They require to be
addressed but are not deemed critical. “Out of family problems” are problems that are serious
and could pose a threat to the mission. Although they could have occurred in the past the
nature of the risks posed by them have to be addressed. This often involves the setting up of a
special team that does all the analysis needed. These findings are routed through the Mission
Evaluation Room to the Mission Management Team for review and action.

6
 DEFINITIONS
In Family: A reportable problem that was previously experienced, analyzed, and understood. Out of limits
performance or discrepancies that have been previously experienced may be considered as in-family when
specifically approved by the Space Shuttle Program or design project. 8.

Out of Family: Operation or performance outside the expected performance range for a given parameter or
which has not previously been experienced.9

Accepted Risk: The threat associated with a specific circumstance is known and understood, cannot be
completely eliminated, and the circumstance(s) producing that threat is considered unlikely to reoccur.
Hence, the circumstance is fully known and is considered a tolerable threat to the conduct of a Shuttle
mission.
No Safety-of-Flight-Issue: The threat associated with a specific circumstance is known and understood and
does not pose a threat to the crew and/or vehicle.

3. Decision making at NASA during the Columbia STS 107 mission

The debris strike that led to the loss of Columbia was first noted on the 2nd day of the flight
by a ground support Intercenter Photo Working Group team of engineers at the Marshall
Space Flight Centre and confirmed by members of the same Working Group at the Kennedy
Space Centre almost immediately. The Working Group saw the strike while reviewing liftoff
camera and video imagery. Since they had never seen such a large piece of debris strike the
orbiter so late in the ascent the working group decided to ask for additional imagery of
Columbia’s left wing from military / defence sources. The Working Group Chair Bob Page
contacted Wayne Hale the Shuttle Programme Manager for Launch Integration at the
Kennedy Space Centre for getting such imagery. Almost immediately the Intercenter Photo
Working Group distributed a report with digitized clips of the strike to all involved NASA
and contractor communities. This resulted in a lot of exchanges between personnel at various
levels. The Mission Evaluation Room, the technical focal point for all technical inputs to the
Mission Management Team, its manager as well as all members of the Mission Management
Team were informed about the strike.

Later in the afternoon of the same day Bob Page Chair of the Intercenter Photo Working
Group informed Wayne Hale the Shuttle Programme Manager for Launch Integration at the
Kennedy Space Centre and Lambert Austin the head of the Space Shuttle Systems Integration
at the Johnson Space Centre that Boeing engineers were going to perform a detailed analysis
of the likely damage resulting from the foam / debris strike over the weekend. Wayne Hale
also telephoned Linda Ham, Chair of the Mission Management Team (responsible for the
mission) and Ron Dittermore Space Shuttle Programme Manager (Linda Ham’s boss for the
mission) informing them about the strike and the actions to be taken. As per the procedure to
deal with in flight anomalies, the sub-contractor Boeing had to set up a task force to
understand the anomaly, classify it and provide all the analysis and alternatives to deal with
it. John Disler a member of the Intercenter Photo Working Group also informed the Mission
Evaluation Room (MER) of the setting up of a Debris Assessment Team (DAT) to look into
the problem and provide inputs on a proper course of action.

Higher-level managers and working level engineers seemed to have different perceptions
about the nature of the problem. The log entry of a manager at the Mission Evaluation Room
reads “Bill Reeves called after a meeting with Ralph Roe. It is confirmed that that United
Space Alliance (USA), Boeing will not work the debris issue over the weekend but will wait
7
till Monday when the films are released. The LCC constraints on ice, the energy / speed of
impact at +81 seconds and the toughness of the RCC are two main factors for this low

-----Original Message-----
From:Stoner-1,Michael D
Sent:Friday,January 17,2003 4:03 PM
To:Woodworth,Warren H;Reeves,William D
Cc:Wilder,James;White,Doug;Bitner,Barbara K;Blank,Donald E;Cooper,Curt W;Gordon,Michael P.
Subject:RE: STS 107 Debris

Just spoke with Calvin and Mike Gordon (RCC SSM)about the impact. Basically the RCC is extremely resilient to
impact type damage. The piece of debris (most likely foam/ice)looked like it most likely impacted the WLE RCC
and broke apart. It did ’t look like a big enough piece to pose any serious threat to the system and Mike Gordon the
RCC SSM concurs. At T+81seconds the piece wouldn’t ’t have had enough energy to create a large damage to the
RCC WLE system. Plus they have analysis that says they have a single mission safe re-entry in case of impact that
penetrates the system.

As far as the tile goes in the wing leading edge area they are thicker than required (taper in the outer mold line)and
can handle a large area of shallow damage which is what this event most likely would have caused. They have
impact data that says the structure would get slightly hotter but still be OK.
Mike Stoner
USA TPS SAM
[RCC=Reinforced Carbon-Carbon,SSM=Sub-system Manager,WLE=Wing Leading Edge,TPS=Thermal
Protection System,
SAM=Sub-system Area Manager]

concern. Also analysis supports single mission safe re-entry for an impact that penetrates the
system”1.

The way in which the Debris Assessment Team (DAT) came into existence was also not
strictly according to procedure. The foam strike on the underside of the left wing was an
event that had to be classified in NASA terminology as “out of family”. Such events would
need to be thoroughly analysed and understood for their impact on the mission. This would
require active intervention and coordination from NASA management with their counterparts
from USA / Boeing and the setting up of a Tiger team reporting directly to the MER and via
the MER to the Mission Management Team. The DAT did not have the same locus standi or
the authority of such a Tiger Team though it had the necessary technical expertise.

Though senior managers within the shuttle management did not think there was any rush to
address the foam strike issue, engineers from Boeing worked over the weekend (3rd and 4th
day after launch) to analyse the implications of the strike. They assessed that the debris was
20x20x2 or 20x16x2 inches in size with a relative velocity of 750 metres per second (511
miles per hour) and had impacted the orbiter at an angle of about 20 degrees. Boeing
engineers used a software called Crater to understand the effects of the foam strike on the
RCC tiles and on the Thermal Protection System. Crater was a software that had traditionally
been developed to predict what very small pieces of debris (3 cubic inches in volume)
especially ice would do to the tiles and RCC panels of the orbiter. The piece of foam that
struck Columbia was 1200 cubic inches in volume about 400 times bigger with a density

1
The LCC refers to Launch Commit Criteria and refers to the fact that if there was excess ice formation during
launch, launch would be postponed. RCC is of course the Reinforced Carbon Carbon panels of the Thermal
Protection System. Ralph Roe was head of the Shuttle Programme Office of Vehicle Engineering at Kennedy
Space Centre, and Bill Reeves was his counterpart at United Space Alliance (USA). There already seems to be
an impression among managers that the problem is not a very serious one.

8
lower than ice. The Crater analysis indicated that penetration of the Thermal Protection
System including RCC panels was a possibility. The DAT in analyzing these findings had to
keep in mind the limitations of the Crater software – the relative size problem, the lower
density of foam as compared to ice and the fact that when Crater was calibrated with ground
experiments it always predicted a higher impact than what was seen in experiments. The
DAT also used another Crater like algorithm which also indicated that if there were impact
angles greater than 15 degrees penetration of the RCC panels was possible. The DAT
analysed various paths that the debris might have taken to get a better fix on the location of
the strike. The analysis seemed to suggest a fairly large number of paths above the threshold
impact angles. Based on this and keeping in mind the various limitations of software and
data, the DAT came to the conclusion that foam may not cause penetration of the Thermal
Protection System for impact angles of up to 21 degrees. To do better than this they needed
more data to narrow down the ranges and the locations.

The Monday after the weekend and the 5th day after the launch of Columbia, the DAT met
informally prior to their formal meeting scheduled for the next day (Tuesday) to take stock of
its work. They agreed that to resolve the foam strike issue they needed imagery of the
Shuttle’s left wing. This was put on the agenda for the formal meeting. However managers
once again seemed to have a different view. An entry in the MER manager’s logbook read,
“the debris blob is estimated at 20 inches plus or minus 10 inches in some direction using the
Orbiter hatch as a basis. It appears to be similar size as seen in STS 112. There will be more
comparison work done and more info and details in tomorrows report”2.

On the 6th day after launch i.e. a Tuesday the DAT team briefed the Mission Evaluation
Room (MER) Manager Dan McCormack about the strike. Apart from the strike the DAT
briefing also indicated that Boeing would also address damage to the Orbiter from previous
strikes observed in STS 112 and STS 87. An hour after the DAT presentation McCormack
relayed this analysis to the Mission Management Team that met after its long Martin Luther
King weekend. After addressing other issues the Mission Management Team discussed the
foam strike issue. Salient excerpts from this meeting are produced in the box below.

Transcript Excerpts from the January 21,Mission Management Team Meeting

Ham :“Alright I know you guys are looking at the debris.”

McCormack :“Yeah ,as everybody knows, we took a hit on the, somewhere on the left wing
leading edge and the photo TV guys have completed I think, pretty much their work although
I'm sure they are reviewing their stuff and they’ve given us an approximate size for the debris
and approximate area for where it came from and approximately where it hit, so we are
talking about doing some sort of parametric type of analysis and also we're talking about what
you can do in the event we have some damage there.”

Ham :“That comment, I was thinking that the flight rationale at the FRR from tank and orbiter
from STS-112 was.…I 'm not sure that the area is exactly the same where the foam came
from but the carrier properties and density of the foam wouldn't do any damage. So we ought
to pull that along with the 87 data where we had some damage pull this data from 112 or
whatever flight it was and make sure that …you know I hope that we had good flight rationale
then.”

2
STS 112 was the last but one mission before Columbia where foam from the external tank had struck the Solid
Rocket Booster (SRB).
9
 Transcript Excerpts from the January 21,Mission Management Team Meeting
contd
Ham :“Alright I know you guys are looking at the debris.”

McCormack : “Yeah, and we'll look at that, you mentioned 87,you know we saw some
fairly significant damage in the area between RCC panels 8 and 9 and the main landing
gear door on the bottom on STS-87 we did some analysis prior to STS-89 so uh …”

Ham : “And I 'm really I don 't think there is much we can do so it 's not really a factor
during the flight because there is not much we can do about it. But what I 'm really
interested in is making sure our flight rationale to go was good and maybe this is foam
from a different area and I 'm not sure and it may not be co-related, but you can try to
see what we have.

”McCormack :“Okay.”

Linda Ham was the Chair for Mission Management for the Columbia Mission STS 107 and
the boss for the mission. Lambert Austin the Head of the Space Shuttle Integration Office at
Johnson also briefed the Mission Management Team about the analysis of the strike. He said
that engineers were reviewing other film footage and stated that the foam hitting the leading
edge of the left wing might have come from the left bipod attachment of the Orbiter to the
External Tank. Communications from Linda Ham to her boss Ron Dittermore Space Shuttle
Programme Manager indicate that foam loss problems observed in STS 87 and STS 112
coupled with foam loss from STS 107 could arouse concerns that might jeopardize the
immediately following Shuttle missions including the next one where she was assigned to be
the Launch Integration Manager along with Wayne Hale. Senior Managers also seemed to be
concerned about schedule slippages that might delay NASA commitments to the International
Space Station and prolong the stay of astronauts who had a 180-day limit on the space
station.

Mission controllers also received film footage from the astronauts that had been taken during
flight into orbit. Since however they did not know about the foam they did not ask the
astronauts if they had any additional footage taken of the External Tank before separation that
might have shed some light on the foam strike. After the Mission Management Team
meeting, the Flight Director (overall boss of the flight) Steven Stitch was briefed by Phil
Engleauf a member of the Mission Operations Directorate. There is no evidence that any of
these mangers were concerned about the strike. Neither did they indicate any desire to get
imagery from the Defence Department.

On the 6th day United Space Alliance manager Bob White called Lambert Austin the Head of
the Space Shuttle Integration at Johnson asking him whether he would obtain in orbit imagery
of Columbia’s left wing. He was responding to pressures from Boeing engineers who were a
part of the DAT. Austin initiated informal discussions with the Department of Defence on the
feasibility of obtaining such imagery. Evidence shows that the Department of Defence had
begun to act on the possibility that such a request would be made. The DAT also met
formally for the first time and made an additional request for in-orbit imagery of Columbia’s
left wing. This was the third request for imagery. However instead of following the
hierarchical route of the Mission Evaluation Room - Mission Management - Programme
Manager / Flight Director route DAT requested one of its members and Co-Chairs Rodney
Rocha to pursue the request through his parent division – the Engineering Directorate at
Johnson Space Centre. Rocha sent a message to Paul Shack. His message is reproduced in the
box.
10
---Original Message-----
From:ROCHA, ALAN R.(RODNEY)(JSC-ES2)(NASA)
Sent:Tuesday, January 21,2003 4:41 PM
To:SHACK, PAUL E.(JSC-EA42)(NASA);HAMILTON,DAVID A.(DAVE)(JSC-EA)(NASA);MILLER,GLENN J.(JSC-
EA)(NASA)
Cc:SERIALE-GRUSH,JOYCE M.(JSC-EA)(NASA);ROGERS,JOSEPH E.(JOE)(JSC-ES2)(NASA);GALBREATH,
GREGORY F.(GREG)(JSC-ES2)(NASA)
Subject:STS-107 Wing Debris Impact, Request for Outside Photo-Imaging Help

Paul and Dave,

The meeting participants (Boeing, USA, NASA ES2 and ES3,KSC)all agreed we will always have big
uncertainties in any transport/trajectory analyses and applicability/extrapolation of the old Arc-Jet test
data until we get definitive, better, clearer photos of the wing and body underside. Without better
images it will be very difficult to even bound the problem and initialize thermal, trajectory, and structural
analyses. Their answers may have a wide spread ranging from acceptable to not acceptable to
horrible, and no way to reduce uncertainty. Thus, giving MOD options for entry will be very difficult.
Can we petition (beg) for outside agency assistance? We are asking for Frank Benz with Ralph Roe or
Ron Dittemore to ask for such. Some of the old timers here remember we got such help in the early
1980 ’s when we had missing tile concerns. Despite some nay-Sayers, there are some options for the
team to talk about: On-orbit thermal conditioning for the major structure (but is in contradiction with tire
pressure temp. cold limits),limiting high cross-range de-orbit entries, constraining right or left had turns
during the Heading Alignment Circle (only if there is structural. damage to the RCC panels to the extent
it affects flight control.

Rodney Rocha
Structural Engineering Division (ES-SED)
• ES Div.Chief Engineer (Space Shuttle DCE)
• Chair,Space Shuttle Loads &Dynamics Panel

Mail Code ES2

[USA=United Space Alliance, NASA ES2,ES3=separate divisions of the Johnson Space Center Engineering Directorate,
KSC=Kennedy Space Center, MOD=Missions Operations Directorate,or Mission Control ]

On the 6th day Calvin Schomburg an engineer from Johnson and an expert on Thermal
Protection System with close connections to Shuttle management, provided an input that
suggested that the foam strike was only a minor problem that would damage the tiles and
increase the turnaround time for Columbia rather than cause any major problem. The Shuttle
top managers Linda Ham, Ralph Roe and Lambert Austin seem to think that this and other
problems from earlier missions STS 112, STS 87 were really “in family problems” not “out
of family problems” posing no additional risk to the shuttle.

Wayne Hale the Shuttle Programme Integration Manager who already had Bob Page’s
request for imagery from the first day was contacted by Lambert Austin the Head of the
Shuttle Integration Programme office on the question of getting in-orbit imagery of
Columbia. After initiating some informal contacts, Hale contacted Phil Engelauf of the
Mission Management Directorate to inform him about the action. He asked him to ask the
Flight Dynamics Officer at Johnson to make an official request to the NORAD Operations
Centre located in Cheyenne Mountain Colorado. Lambert Austin after hearing from Wayne
Hale then called Linda Ham the Mission chair for Columbia about the request for imagery.
11
In response to this request the Department of Defence must have also initiated some actions
with NASA HQ. Mike Card a NASA HQ Safety & Mission Assurance Manager called Mark
Erminger at the Johnson Space Centre Safety & Mission Assurance for the Shuttle Safety
Programme and Bryan O’Connor Associate Administrator asking them about the problem
and the request for in-orbit imagery. Erminger’s response was that to his knowledge this was
an “in family event” – by inference not very critical. O’ Connor said that he would defer to
the Shuttle Management’s decision on this matter. All these events happened early morning
of the seventh day of the mission. By 8.30 A.M the request for imagery had been
cancelled. Apparently Ham had asked Austin about the request. Austin admitted his
involvement in the request outside of the official channel and indicated that he was
responding to concerns raised from NASA, United Space Alliance (USA) and Boeing
engineers of the DAT in making the request. Ham had then called the various members of the
Mission Management Team – Ralph Roe of the Space Shuttle Vehicle Engineering Office,
Loren Shriver the USA Deputy Programme Manager for the Shuttle and David Moyer the on-
duty manager at the Mission Evaluation Room – asking them whether they had requested for
imagery. She also called Phil Engleauf of the Mission Operations Directorate if he had a
requirement for imagery of Columbia’s left wing. All of them are reported to have said that
they had not requested for the imagery, were not aware of any official request for imagery
and could not identify a requirement for the imagery. Ham cancelled the request for imagery
killing al three requests with varying degrees of official and unofficial sanction. Linda Ham
was also apparently concerned about what imaging the orbiter would do to the experiments.
Apparently she also had reservations about the resolution of the imagery and whether it
would help in resolving the problem. The following Excerpts provide some indication about
management thinking.

-----Original Message---
From:HAM, LINDA J.(JSC-MA2)(NASA)
Sent:Wednesday, January 22,2003 9:33 AM
To:AUSTIN ,LAMBERT D.(JSC-MS)(NASA);ROE,RALPH R.(JSC-MV)(NASA)
Subject:ET Foam Loss
Can we say that for any ET foam lost, no ‘safety of flight ’ damage can occur to the Orbiter because of
the density?
[ET=External Tank ]

Responses included the following.

-----Original Message-----
From: ROE, RALPH R.(JSC-MV)(NASA)
Sent: Wednesday , January 22,2003 9:38 AM
To:SCHOMBURG,CALVIN (JSC-EA)(NASA)
Subject: FW: ET Foam Loss
Calvin,
I wouldn’t think we could make such a generic statement but can we bound it some how by size or
acreage?
[Acreage=larger areas of foam coverage]

12
 Original Message-----
From: DITTEMORE, RONALD D.(JSC-MA)(NASA)
Sent: Wednesday, January 22,2003 10:15 AM
To: HAM,LINDA J.(JSC-MA2)(NASA)
Subject: RE:ET Briefing -STS-112 Foam Loss
Another thought, we need to make sure that the density of the ET foam cannot damage the tile to where it is
an impact to the orbiter...Lambert and Ralph need to get some folks working with ET.

The following is an e-mail from Calvin Schomburg to Ralph Roe.

-----Original Message-----
From: SCHOMBURG,CALVIN (JSC-EA)(NASA)
Sent: Wednesday,January 22,2003 10:53 AM
To: ROE,RALPH R.(JSC-MV)(NASA)
Subject: RE:ET Foam Loss
No-the amount of damage ET foam can cause to the TPS material-tiles is based on the amount of impact
energy-the size of the piece and its velocity (from just after pad clear until about 120 seconds-after that it will
not hit or it will not enough energy to cause any damage)-it is a pure kinetic problem-there is a size that can
cause enough damage to a tile that enough of the material is lost that we could burn a hole through the skin
and have a bad day-(loss of vehicle and crew -about 200-400 tile locations (out of the 23,000 on the lower
surface)-the foam usually fails in small popcorn pieces-that is why it is vented-to make small hits-the two or
three times we have been hit with a piece as large as the one this flight-we got a gouge about 8-10 inches long
about 2 inches wide and 3/4 to an 1 inch deep across two or three tiles. That is what I expect this time-nothing
worst. If that is all we get we have no problem-will have to replace a couple of tiles but nothing else.
[ET=External Tank TPS=Thermal Protection System ]

The following is a response from Lambert Austin to Linda Ham.

-----Original Message-----
From: AUSTIN,LAMBERT D.(JSC-MS)(NASA)
Sent: Wednesday,January 22,2003 3:22 PM
To: HAM,LINDA J.(JSC-MA2)(NASA)
Cc: WALLACE,RODNEY O.(ROD)(JSC-MS2)(NASA);NOAH,DONALD S.(DON)(JSC-MS)(NASA)
Subject: RE:ET Foam Loss
NO.I will cover some of the pertinent rationale....there could be more if I spent more time thinking about it.
Recall this issue has been discussed from time to time since the inception of the basic “no debris ” requirement in
Vol..X and at each review the SSP has concluded that it is not possible to PRECLUDE a potential catastrophic
event as a result of debris impact damage to the flight elements. As regards the Orbiter, both windows and tiles
are areas of concern. You can talk to Cal Schomberg and he will verify the many times we have covered this in
SSP reviews. While there is much tolerance to window and tile damage, ET foam loss can result in impact
damage that under subsequent entry environments can lead to loss of structural integrity of the Orbiter area
impacted or a penetration in a critical function area that results in loss of that function. My recollection of the
most critical Orbiter bottom acreage areas are the wing spar, main landing gear door seal and RCC panels...Of
course Cal can give you a much better run down. We can and have generated parametric impact zone
characterizations for many areas of the Orbiter for a few of our more typical ET foam loss areas. Of course, the
impact/damage significance is always a function of debris size and density, impact velocity, and impact angle--
these latter 2 being a function of the flight time at which the ET foam becomes debris. For STS-107 specifically,
we have generated this info and provided it to Orbiter. Of course, even this is based on the ASSUMPTION that
the location and size of the debris is the same as occurred on STS-112------this cannot be verified until we receive
the on-board ET separation photo evidence post Orbiter landing. We are requesting that this be expedited. I have
the STS-107 Orbiter impact map based on the assumptions noted herein being sent down to you. Rod is in a
review with Orbiter on this info right now.
[SSP=Space Shuttle Program, ET=External Tank ]

13
After the failure of the Imagery request the DAT presented their formal findings to managers
from NASA, Boeing and USA. Mission control personnel also informed the Commander of
Columbia Rick Husband and Pilot William McCool about the problem. This was done on the
8th day of the mission. The tone of the message was that the strike was not something for
them to worry about it as a safety issue but more to be prepared for a Press Conference.

Some disagreements seem to have taken place between Rocha and Schomburg as well as
some engineers from Boeing on the 9th day prior to the formal presentation of the DAT to the
MER manager. The DAT made a well-attended presentation to Dan McCormack the Chief
Manager of the Mission Evaluation Room. The analysis largely focused on possible tile
damage and did not address RCC damage. They emphasized many of the uncertainties and
finally concluded that though there were limitations in the procedures used for analysis there
was no safety of flight issue. They did not include any slide that talked about the imagery
request though it had been one of the issues debated in the DAT. They left it out after the
imagery request had been refused. After this the MER manager Dan McCormack briefed the
Mission Management Team. The Mission Management Team meeting concluded after stating
that the debris / foam strike was only a turnaround issue and not an in flight safety issue.

This decision more or less terminated any debate and discussions though Rocha seems to
have pursued the issue a bit further. Concerns from others especially the Langley Research
Centre about possible landing problems incase critical elements of the orbiter landing gear
had been damaged did not even reach the Mission Management Team. The rest as we know
is history.

4. Could the Columbia have been saved if the DAT inputs had been favourably viewed?

The CAIB assessment was that if proper action had been taken the Columbia could have been
saved. Even if the imagery from Defence was inconclusive a space walk for assessing the
damage was a feasible option. Putting Columbia on a minimum ration mode would have
conserved scarce resources, and a rescue operation via Atlantis though complex was
achievable. It may have also been possible to repair Columbia with suitable materials
transported on Atlantis.

5. Was the foam loss for Columbia a unique event or were there other missions with
significant foam and debris caused damage?

As we had mentioned in introducing the shuttle, foam insulation of the External Tank is
necessary to ensure that liquid hydrogen and Liquid Oxygen (stored at – 423 degrees F and –
297 degrees F) remain liquid without evaporating. In spite of the foam, depending on the
conditions ice can form on the surface at various locations around the External Tank. During
lift off these can fly off and damage sensitive parts of the orbiter. Impacts can be sufficiently
large to penetrate the Thermal Protection System consisting of different kinds of ceramic-
based tiles as well as Reinforced Carbon Carbon Composite panels. Foam loss from the
External Tank has been a feature of many shuttle flights including the first shuttle flight –
Columbia in 1981. There is no doubt that debris of all kinds including foam pose a major
problem for shuttle safety.

14
The baseline design requirements for the shuttle as specified in the Shuttle Flight and Ground
systems specifications Book 1 state “3.2.1.2.14 Debris Prevention: The Space Shuttle System
including the Ground System shall be designed to preclude the shedding of ice and / or other
debris from the shuttle elements during pre-launch and flight operations that would
jeopardize the flight crew, vehicle or mission success or would adversely affect turnaround
operations”. Section 3.2.1.1.17 also states “External Tank Debris Limits”: No debris shall
emanate from the critical zone of the External Tank on the Launch Pad or during ascent
except for such material as may result from normal thermal protection system recession due
to ascent heating.3 The assumption that only tiny pieces of debris would impact the orbiter
was also built into the original design requirements. The specifications for the thermal control
system tiles and the RCC panels were such that they should be designed to handle impacts
with a kinetic energy less than 0.006 foot pounds. This is not a very high number making the
orbiters fairly vulnerable to larger size debris / foam strikes.

Even during the first shuttle flight Columbia in 1981 the orbiter Thermal Protection System
suffered a lot of damage not from foam but from debris with more than 300 tiles having to be
replaced. The damage was such that engineers were reported to have said that had they
known about the damage they would not have launched Columbia. There is evidence of foam
shedding for about 79 of the 113 flights of the shuttle till the Columbia disaster. Some of
them can be termed minor. However a significant number involved strikes from fairly big
pieces of foam or debris. Apart from foam, other debris can also cause damage to the Orbiter.
After Columbia the CAIB analysed many Shuttle missions where foam and debris events
were witnessed and tried to relate these events to management practices within the Agency.
The Board identified 14 Flights that had significant Thermal Protection System damage or
major foam loss. Two of the bipod foam loss events had not been detected by NASA prior to
the Columbia Accident Investigation Board requesting a review of all launch images. Table 1
provides details of Shuttle missions with major problems of foam / debris strikes.

Table 1
Incidents of Major Foam Debris Strikes on Shuttle Missions

MISSION DATE COMMENTS

STS- 1 April 12, Lots of debris damage. 300 tiles replaced.

1981
June 18,
STS-7 First known left bipod ramp Foam shedding event.
1983

STS-27R Dec. 2, 1988 Debris knocks off tile; structural damage and near burn through results.

STS-32R Jan. 9, 1990 Second known left bipod ramp foam event.

First time NASA calls Foam debris "safety of flight issue," and "re-use or turn
STS-35 Dec. 2, 1990
around issue."

First mission after which the next mission (STS-45) launched without debris
STS-42 Jan. 22, 1992
In-Flight Anomaly closure/resolution.

Damage to wing RCC Panel 10-right. Unexplained Anomaly, "most likely orbital
STS-45 Mar.24, 1992
debris."

3
Recession refers to loss of material by heating and evaporation during ascent and reentry
15
 MISSION DATE COMMENTS

STS-50 June 25, 1992 Third known bipod ramp Foam event. Hazard Report 37: an "accepted risk."

STS-52 Oct. 22, 1992 Undetected bipod ramp foam loss (Fourth bipod event).

Acreage tile damage (large area). Called "within experience base" and considered
STS-56 April 8, 1993
"in family."

STS-62 Oct. 4, 1994 Undetected bipod ramp foam loss (Fifth bipod event).

Damage to Orbiter Thermal Protection System spurs NASA to begin 9 Fight tests
STS-87 Nov.19, 1997 to resolve foam shedding. Foam fix ineffective. In-Flight Anomaly eventually
closed after ST5-101 as "accepted risk."

Sixth known left bipod ramp foam loss. First time major debris event not assigned
STS-112 Oct. 7, 2002 an In-Flight Anomaly. External Tank Project was assigned an Action. Not closed
out until after STS-113 and STS-107.

STS 107 Jan 16, 2003 Columbia launch. Seventh known left bipod ramp foam loss event.

Despite the specifications spelt out debris and foam strikes on the orbiter have had a long
history. STS 1 the first shuttle flight and also the first flight of Columbia had major damage
requiring the replacement of over 300 tiles.

STS 7 flight of the Challenger was the first flight to encounter foam loss from External Tank
bipod area a problem similar to that encountered in STS 107. The problem was reported and
dealt with as an “in-flight anomaly”. As per the rules of procedure it had to be resolved
before the next flight of the shuttle. The Orbiter Analysis Group reported that repairs to the
Orbiter had been carried out as per the requirements. Based on this the Flight Readiness
Board cleared the next flight. There is no recorded evidence to show that any attempt was
made to fix the problem – the cause of the foam debris.

One of the most serious debris problem (not foam) occurred during the flight of STS 27-R
(Atlantis) in December 1988. The post launch Inter center Photo Working Group identified a
large piece of debris striking the Thermal Protection System 85 seconds after Lift off. The
origin of the debris was ablator material from the nose cap of the right side Solid Rocket
Booster. Mission Controllers on the Ground alerted the shuttle Commander “Hoot” Gibson
and asked the crew to use the Shuttles Remote Manipulator Arm with a camera mounted on it
to inspect the area of impact. According to Gibson (in his testimony to the CAIB) Atlantis
“looked like it had been blasted by a shotgun”. The image obtained from the crew was
transferred to Mission Control. After landing, inspection revealed that a tile had come off
because of the strike and the underlying aluminium skin exposed. Luckily for Atlantis a thick
Aluminium plate covering for an antenna was there just below the exposed area. This
prevented a burn through. After this incident the Program Requirements Control Board asked
both the Solid Rocket Booster Project and the Orbiter project to address this issue. After the
Solid Rocket Booster Project indicated that a new ablator material would be used for coating
the nose cone of the Solid Rocket Booster the issue was considered closed. All these actions
were carried out before the next shuttle was cleared for flight. An STS 27 R investigation had
the following things to say, “it is observed that program emphasis and attention to damage
assessments varies with severity and that detailed records could be augmented to ease trend
16
maintenance”. “It is recommended that the program actively solicit design improvements
directed towards eliminating debris sources or minimizing damage potential”. Maybe they
saw a future Columbia in the making4.

STS 35 also revealed higher than average damage to the Orbiter surface during post flight
inspection. Damage had been caused by foam from a flange connecting the Liquid Hydrogen
Tank to the intertank. The in-flight anomaly assigned to External Tank Project was closed by
it by stating that the foam strike did not increase the Thermal Protection System damage and
that it was not a safety – of – flight concern.

The next shuttle flight to encounter a more than average damage from foam / debris happened
on STS mission 32 R of Columbia. Orbiter post flight analysis indicated 111 hits 13 of which
were greater than 1 inch in at least one dimension. Post mission analysis of the imagery
indicated that tile damage came from intertank foam of the External Tank. An “in flight
anomaly” was assigned to this event and the External Tank was asked to provide the inputs
for closing out this anomaly. The External Tank Project reported back saying that the foam
loss most probably had its origins in trapped gases within the foam. If vent holes could be
provided so that gases could flow out the problem could be resolved. Based on this input the
“in flight anomaly” was closed and the next shuttle flight STS 36 cleared for flight. CAIB
analysis, as well as other inputs available within NASA, indicate other possible mechanisms
for foam loss during launch. The Flight Readiness Review (FRR) of STS 36 that included
inputs from both STS 32 R and STS 35 on foam strikes was also the first FRR to treat foam
strikes as a “turnaround issue”. Though as a procedure NASA still designated them as in
flight anomalies, the practice seems to be veering towards treating them more as operational
rather than flight or mission safety issues.

The Discovery STS 42 mission also witnessed more than average damage of the Thermal
Protection System of the orbiter. Foam from the intertank area was identified as the source
for the damage. The “in flight anomaly” was closed by the External Tank project as an
“isolated event”. The next shuttle mission STS 45 was the first shuttle flight that was cleared
for flight before the in flight anomaly on STS 42 had been resolved and cleared.

STS 45 (Atlantis) also witnessed damage to the RCC panel 10 on the right wing with
exposure of the substrate. The “in flight anomaly” was closed before the next flight with the
explanation that the cause of the damage was unexplained but most likely to be orbital debris.
The Safety and Mission Assurance Office did raise this issue at the pre-launch Mission
Management Team Meeting before the launch of the next mission STS 49. In spite of this the
mission was cleared for launch.

A 26 inch by 10 inch piece of foam that separated from the bipod area (similar to Columbia
STS 107) caused a very large crater of 9 x 4.5 x 1 on the tiles during the Columbia STS 50
Mission. The “in flight anomaly” investigation was assigned to both the External Tank
Project and the Integration Office. In closing out the anomaly, 2 days before the next shuttle
mission, the Integration Office STS 46 noted that the damage was shallow, the loss did not
come from excessive aerodynamic forces and the source of the foam debris was inadequate

4
They were effectively saying keep a detailed tag on foam strikes and build up a proper database for future
evaluation of risk. Also take steps to avoid foam strikes completely.
17
venting of the foam. It termed the anomaly “accepted flight risk”. The External Tank Project
closed out the same anomaly as “not considered a flight or safety issue”.

The STS 52 mission had foam strikes from the bipod area. These were not identified in the
post launch or post mission analysis. They surfaced only during the CAIB
investigations. Since they were not seen there were no anomalies to report and no
actions taken. Why were the foam strikes not seen and reported?

The Program Requirements Control Board assigned in flight anomalies to the External Tank
Project after foam losses on both STS 56 and STS 58 both of which were launched in 1993.
After post flight analysis had determined that foam had come from the intertank and the
bipod areas the rationale for closing the anomalies are stated as “in family” occurrences or
within the data base of experiences.

Foam from the bipod ramp area also caused damage to the STS 62 Columbia mission. This
was not detected at that time and was revealed only after the CAIB investigation. There
was no in flight anomaly declared and no management action.

During the launch of STS 87 (Columbia) in 1997 a debris event took place that served to
refocus management attention on foam issues. Foam from where the Solid Rocket Boosters
are connected to the external tank had impacted the Orbiter and created 308 hits with 244 of
them on the more risky underside of the orbiter. 109 of these hits were larger than 1 inch.
Based on data collected over 71 flights this was considered to be an “out of family event”.
Though as mentioned earlier foam loss happens in most flights, it happened much earlier in
STS-87 and the damage was also greater. The problem was traced to a change in the blowing
agent used in applying the foam to the orbiter surface. Due to environmental considerations
NASA had switched from a CFC blowing agent to HCFC blowing agent. This practice had
happened for External Tanks starting from STS 84. Based on this the Programme
Requirements Control Board asked the External tank Project to address the foam loss
problem. Over the next 9 missions changes were incorporated. This consisted of reducing the
thickness of the foam in certain areas as well as providing additional venting to release
trapped gases. Following STS 101 the 10th mission after STS 87 the Programme
Requirements Control Board closed out the in flight anomaly. The logic was that foam losses
were now at a tolerable non-serious level.

The last major foam strike problem prior to Columbia occurred in the flight of Atlantis (STS
112). 33 seconds after launch at about Mach 0.75 a piece of debris from the External Tank
impacted the Solid Rocket / External Tank Attachment ring. The post external tank separation
photography by the crew showed that a 4-inch by 5 by 12-inch piece of the left bipod ramp
was the source of the debris. It created a 4-inch wide and 3 inch deep hit on the External Tank
attachment ring. Since this problem occurred only 2 flights before Columbia STS 107, the
CAIB looked at the NASA handling of this event in some detail. The Intercenter Photo
Working Group recommended to the Programme Requirements Control Board meeting after
the STS 112 mission and before the scheduled STS 113 mission that the bipod loss of foam
event be classified as an “in flight anomaly”. In a meeting chaired by the Shuttle Programme
Manager Ron Dittermore and attended by many of the managers including Linda Ham the
Programme Requirements Control Board decided against such a classification. After
discussions with the Integration Office and the External Tank Project the Programme
Requirements Control Board assigned an “action” to determine the cause of the bipod foam
18
loss and suggest corrective action. This meant in effect that subsequent flights could go ahead
even without an understanding of the root problem of bipod foam loss. As a matter of fact
both STS 113 and STS 107 (Columbia) flew before the analysis was available.

The last known flight where bipod foam loss occurred was the STS 107 Columbia mission.

Foam strikes were also a matter of concern to Rogers Commission that investigated the
causes for the Challenger disaster. Shuttle Programme Manager Arnold Aldrich briefed the
Rogers Commission on how well the Shuttle Programme manages risk:
“On a series of four or five external tanks the thermal insulation around the inner tank....had
large divots of insulation coming off and impacting the Orbiter. We found significant amount
of damage to one Orbiter after a flight....and on the subsequent flight we had a camera in the
equivalent of the wheel well, which took a picture of the separation and we determined that
this was in fact the cause of the damage. At that time, we wanted to be able to proceed with
the launch programme if it was acceptable...so we undertook discussions of what would be
acceptable in terms of potential field repairs, and during those discussions, Rockwell was
very conservative because rightly, damage to the Orbiter TPS (Thermal Protection System) is
damage to the Orbiter system, and it has a very stringent environment to experience during
the re-entry phase”. Aldrich described the pieces of foam as “.....half a foot square or a foot
by half a foot and some of them much smaller and localized to a specific area but fairly high
up on the tank. So they had a good shot at the Orbiter underbelly and this is where we had
the damage”

6. External Factors: the Politics behind decision-making on the Shuttle

The Shuttle programme as well as NASA before the Columbia accident appeared to be on
probation. By the middle of 2001 the International Space Station (ISS) Project5 was behind
schedule and over budget by at least $ 1 billion. A review by the White House Office of
Management & Budget worked out a plan that would put things back on course. NASA
management committed itself to completing Node 2 of the ISS by February 19 2004. This
would ensure that the US contribution to the ISS core would be complete giving the Agency
credibility to propose further additions to the Station. This was considered a major credibility
issue and when Sean O’Keefe the architect of the plan became the NASA Administrator this
was the main thrust of the NASA HQ and NASA management strategy. Unlike other shuttle
missions where missions could be easily reassigned if there were problems with any one
shuttle, ISS required missions to follow a certain sequence of shuttle launches. International
partners and their activities also added to constraints on the schedule. Delays in such
situations tend to have a cumulative impact. While aggressive schedules are often signs of a
healthy organization, in high-risk situations this can force take managers to take higher risks.
If there are no immediate problems surfacing after such risky decisions they become routines
and procedures for dealing with them may become legitimized. By the time of the STS 107
the slips in schedule had become serious – at least in the eyes of the managers. For meeting
the February 19th 2004 deadline and restoring NASA credibility 10 flights of the shuttle had
to take place in the space of 16 months. With an aging fleet, many years of budget cutting as
well as a significant move to reduce costs by outsourcing schedule pressures often needed to

5
The International Space Station is a multinational space facility in which astronauts from different countries
would spend time. To build this facility would call for manned launches of Russian rockets as well as the shuttle.
A series of launches is necessary to establish the station and to keep a permanent human presence in space.
Shuttle schedules are largely determined by the requirements of this international co-operative programme.
19
forget the fact that in spite of many successes the Shuttle was still a high-risk vehicle and one
could not wish these risks away before any launch. As one employee remarked “I guess my
frustration was ... I know the importance of showing that you... manage your budget and
that’s an important impression to make to Congress so you can continue the future of the
agency, but to a lot of people, February 19th6 seemed like an arbitrary date....It doesn’t make
sense to me why at all costs we are marching to this date”.7

7. The Safety of the Shuttle: Policy, Structure & Process

The attached organization chart provides details of the organization of safety function at the
Johnson Space Centre, the lead center for the management of the shuttle programme.

We provide a brief description of safety activities based on this chart. NASA philosophy for
safety and mission assurance of the shuttle at the time of the Columbia accident called for
centralized oversight of safety at NASA HQ with decentralized execution of safety activities
at the Centre, Programme and Project levels. In operational terms this meant that the onus of
safety rests largely with shuttle programme and project managers. These managers are given
the flexibility to organize safety efforts as they think appropriate. NASA HQ is charged with
the responsibility of maintaining oversight through independent surveillance and assessment.

Safety Operations at the JSC (Centre level safety) are centralized under a Director, the
Director for Safety, Reliability and Quality Assurance (Director, SR&QA) who oversees 5
divisions and an independent assessment office. One of the 5 divisions is headed by the Space
Shuttle Division Chief. He is responsible for Shuttle related safety, reliability and quality
assurance. He represents the JSC on all matters related to safety and reliability of the shuttle.

Apart from representing JSC, the Space Shuttle Division Chief also supports the Space
Shuttle Programme by serving as the Safety, Reliability and Quality Assurance (SR&QA)
Director for the Shuttle Programme Manager and the Shuttle Programme. The JSC Space
Shuttle SR&QA Division Chief also represents JSC on matters related to safety and
reliability in discussions and meetings with NASA HQ and other agencies.

In addition to this support from the JSC the Shuttle Programme Manager also has a Space
Shuttle Safety and Mission Assurance Manager working under him. This Safety & Mission
Assurance Manager oversees the United Space Alliance (contractor for all shuttle operations)
safety organization.

The Space Shuttle Programme provides funding support for the JSC Safety and Reliability
activities including the Space Shuttle SR & QA Division.

Safety and Reliability activities at the Marshall Space Flight Centre (responsible for the
Shuttle Main Engine, the Solid Rocket Motor, and the External Tank) are organised in almost

6
This is the date for completion of Node 2 for the International Space Station
7
Top managers at NASA oversold the shuttle to Congress and the White House during its initial days. The
Shuttle was to replace all launchers as the cheapest way to space. This focus on operations and scale led to an
over emphasis on turnaround and schedules that led directly to the failure of Challenger. These pressures seem
to be there even during Columbia. Do people who decide and people who sell ideas like the ISS really know the
risks

20
 The Organisation Chart of Safety Activities for the Shuttle at JSC

NASA Administrator

Office of Space flight Safety & Mission Assurance

Associate Administrator HQ Associate. Administrator HQ

Deputy AA JSC Center Space Shuttle SR

ISS / SSP HQ Director & QA Manager

Same person, multiple

roles. Represents, shuttle JSC SR & QA
JSC Orgn mgrs SR & QA Space Director
programme, JSC, NASA
Shuttle Division HQ
Director

ISS Space Shuttle

Program Program Manager
Manager
Space Shuttle SR & Independent
QA Division Chief Assessment
Office

Space Shuttle Space Shuttle Elements

S &MA Manager Organisation Managers

Shuttle direct tasks

Shuttle element managers endorse funding via

United Space Integrated Task Agreements
Alliance Vice
President SQ & MA
AA: Associate Administrator
ISS: International Space Station
SSP: Space Shuttle Programme
JSC: Johnson Space Centre
SR & QA: Safety, Reliability & Quality Assurance
SQ & MA: Safety, Quality & Mission Assurance
S & MA: Safety & Mission Assurance
Direct line responsibility
Policy / advice / oversight
the same way as at Johnson. At the Kennedy Space Centre Safety and Mission Assurance
components are decentralized and assigned to the Shuttle Processing Directorate.

8. History repeats but do managers learn from history? Can groups of humans learn at
all?

In the word of Dr. Richard Feynman – a member of the Presidential Commission on the
Space Shuttle Challenger Accident “The phenomenon of accepting.... flight seals that had
shown erosion and blow by in previous flights is very clear. The Challenger flight is an
excellent example. There are several references to flights that have gone before. The
acceptance and success of these flights is taken as evidence of safety. But erosion and blow-
by are not what the design expected. They are warnings that something is wrong....The O-
rings of the Solid Rocket Booster were not designed to erode. Erosion was a clue that
something was wrong. Erosion was not something from which safety can be inferred.... If a
reasonable launch schedule is to be maintained, engineering often cannot be done fast
enough to keep up with the expectations of a originally conservative certification criteria
designed to guarantee a very safe vehicle. In these situations, subtly, and often with
apparently logical arguments the criteria are altered so that flights may still be certified on
time. They therefore fly in a relatively unsafe condition with a chance of failure of the order
of a percent (it is difficult to be more accurate)”.

17 years later was it any different for Columbia?

23
24
25
26
27