Theory Into Practice
As the history and experience of the space shuttle would clearly demonstrate, the possibility that hot exhaust gases could leak through the rocket sections during the ignition sequence was hardly theoretical. Such concerns emerged almost immediately. The solid rocket motors were used multiple times. After detaching from the shuttle they landed in the Atlantic Ocean where they were recovered, examined and then refurbished. Beginning with STS-2 and at least 10 times thereafter, there was clear and alarming evidence that under a variety of normal operating conditions, hot gases were leaking from the motor sections and impinging on and damaging the primary and occasionally, the secondary O-ring systems (see Field Joint Distress Table).
The failure of an SRB joint was a criticality one event which would result in the loss of the shuttle. Despite this fact, the reaction of many involved in the launch decision chain, including managers and engineers, was to examine the event, identify the cause and attendant risk and then accept that risk as normal. Since no catastrophic failure had occurred, only damage, often of increasing severity to an SRB joint, risk was both accumulated and tolerated. NASA continued to tolerate clearly unacceptable risk because they "got away with it last time."
One aspect of the post-NFPA 1500 (Standard on Fire Department Occupational Safety and Health) period in which we find ourselves is the continuing ability of the fire service to accept or tolerate unnecessary accumulated risk. Currently, the three primary sources of unwarranted aggregate risk (or potential criticality one events) are:
- Employment of firefighters with a cardiac condition (known or unknown)
- Dangerous operation of response vehicles by unqualified personnel
- Placing firefighters in a "forward" fire environment where civilian life safety is not a rational consideration
A Fateful Decision
January 25, 1986, was by far the coldest launch weather to date. An unseasonable cold snap had plunged pre-dawn temperatures into the mid-20's. The lowest previous launch temperature was 53 degrees F. Given the forecasted extremely low temperatures, some engineers, in fact, those with the most direct knowledge of the O-ring and joint problems, expressed alarm that the launch might go forward. They were gravely concerned that the frigid temperatures would reduce the ability of the O-rings to seal properly and retard the flow of hot gases through the joints.
Their unease resulted in a series of teleconferences between personnel at Morton Thiokol in Utah, at the Marshall Space Flight Center in Huntsville, AL and in Florida. Morton Thiokol, led by their engineers, recommended against the launch at such a cold temperature. NASA managers, some in senior positions, were unhappy with the Morton Thiokol decision but unwilling to overrule a contractor regarding their system. NASA managers were under pressure to launch. One stated that he was appalled at the Morton Thiokol position and another asked "Are we supposed to wait until April?"
This caused a stir in Utah and Morton Thiokol asked for a recess in the conference call, which was granted. Offline, Morton Thiokol managers and engineers debated their position. Finally, Morton Thiokol managers, stating that it was time to make a management decision, as opposed to an engineering decision, excluded the engineers and voted to revise their earlier position and instead recommend launching. They returned to the conference call and relayed their new position. Clearly focused on concerns other than crew safety, they allowed external pressures to overturn the correct assessments of seasoned, experienced professionals.
While STS-51 had received what would be a fatal green light as far as the SRBs were concerned, cold weather was also causing other problems on the pad. Large amounts of water are needed at launch to protect the shuttle and launch facilities from engine exhaust gases and dynamic forces. This water is provided at the launch pad by way of above ground piping which was in danger of freezing and bursting. The time-honored solution to this problem was to allow the pipes to drip continuously through the night. The result was no burst pipes but a launch service structure and other areas sheathed in ice. This included the path the astronauts would need to traverse in the event of an emergency evacuation. The ice, in the opinion of a shuttle contractor in California, posed unknown risks to the space craft. Chunks of ice knocked loose during ignition or as the orbiter left the pad could strike it, causing catastrophic damage. Despite these concerns, the launch was a go.