| The spreadsheet is organized primarily according to the sections discussed in the CAIB report. RTF indicates that the recommendation must be addressed before the shuttles return to flight. The findings have been placed with the recommendations that correspond to them. You will note that some of the findings have been cited more than once. A synopsis to summarize the recommendation(s) and its corresponding findings has also been added. The colors serve only to distinguish between recommendation sections. For a complete analysis of the Columbia accident, please see the CAIB report, available from the Government Printing Office. | ||||
| Rec # | Recommendation/ Comments |
Find# | Findings | |
| Part One-The Accident | ||||
| Thermal Protection System | ||||
| R3.2-1 | Initiate an aggressive program
to eliminate all External Tank Thermal Protection System debris-shedding at the source with particular emphasis on the region where the bipod struts attach to the External Tank. [RTF] (p. 55, 225) |
F3.2-1 | NASA does not fully understand
the mechanisms that cause foam loss on almost all flights from larger areas
of foam coverage and from areas that are sculpted by hand. (p. 55) |
|
| F3.2-2 | There are no qualified non-destructive evaluation techniques for the as-installed foam to determine the characteristics of the foam before flight.(p. 55) | |||
| Synopsis | Foam is applied to the external
tank and the bipod foam ramp (the y juncture that attaches the External Tank
to the Shuttle) to keep the gas in the external tank at a super cool
temperature. The shedding of the foam
during takeoff has happened before and is a threat to the shuttle and
crew. To prevent future incidents,
CAIB recommends looking into the foam shedding problem and developing
technologies to troubleshoot and eliminate it. These technologies include better imaging and different
inspection procedures. CAIB hopes
that by better understanding the incidents of foam loss, the root causes of
it may be eliminated. |
F3.2-3 | Foam loss from
an External Tank is unrelated to the tank’s age and to its total pre-launch
exposure to the elements. Therefore, the foam loss on STS-107 is unrelated to
either the age or exposure of External Tank 93 before launch.(p. 55) |
|
| F3.2-4 | The Board found no indications of negligence in the application of the External Tank Thermal Protection System.(p. 55) | |||
| F3.2-5 | The Board found instances of left bipod ramp shedding on launch that NASA was not aware of, bringing the total known left bipod ramp shedding events to 7 out of 72 missions for which imagery of the launch or External Tank separation is available.(p. 55) | |||
| F3.2-6 | Subsurface
defects were found during the dissection of three bipod foam ramps,
suggesting that similar defects were likely present in the left bipod ramp of External Tank 93 used on STS-107.(p. 55) |
|||
| F3.2-7 | Foam loss occurred on more than 80 percent of the 79 missions for which imagery was available to confirm or rule out foam loss.(p. 55) | |||
| F3.2-8 | Thirty percent of all missions lacked sufficient imagery to determine if foam had been lost.(p. 55) | |||
| F3.2-9 | Analysis of numerous separate variables indicated that none could be identified as the sole initiating factor of bipod foam loss. The Board therefore concludes that a combination of several factors resulted in bipod foam loss.(p. 55) | |||
| R3.3-1 | Develop and implement a
comprehensive inspection plan to determine the structural integrity of all Reinforced Carbon-Carbon system components. This inspection plan should take advantage of advanced non-destructive inspection technology. [RTF] (p. 59,225) |
F3.3-1 | The original design specifications required the RCC components to have essentially no impact resistance.(p.58) | |
| Synopsis for R3.3-1 |
The CAIB is suggesting that a means to inspect the RCC tile be developed to ascertain their strength. The RCC inspection plan will need to include a mechanism for inspecting tiles both on Earth and in orbit. | |||
| R3.3-2 | Initiate a program designed to
increase the Orbiter’s ability to sustain minor debris damage by measures such as improved impact-resistant Reinforced Carbon-Carbon and acreage tiles. This program should determine the actual impact resistance of current materials and the effect of likely debris strikes. [RTF] (59,225) |
F3.3-2 | Current inspection techniques are not adequate to assess structural integrity of the RCC components.(p.58) | |
| Synopsis for R3.3-2 |
The impact of foam on the RCC tiles can compromise the orbiter's structural integrity. Many factors can lead to the weakening of the RCC tiles, potentially endangering the shuttle and crew. CAIB is essentially recommending that the RCC tiles be strengthened in effort to reduce the risk of breakage. | |||
| R3.3-3 | To the extent possible, increase
the Orbiter’s ability to successfully re-enter Earth’s atmosphere with minor
leading edge structural sub-system damage.(p.59, 225) |
F3.3-3 | After manufacturer’s acceptance non-destructive evaluation, only periodic visual and touch tests are conducted.(p.58) | |
| Synopsis for R3.3-3 |
The goal is to safely return the shuttle and crew home from orbit. By studying the RCC panels that have already flown in orbit, CAIB suggests that NASA develop a procedure that would allow the shuttle to land safely-despite minor damage to the TPS System. | |||
| R3.3-4 | In order to understand the true material characteristics of Reinforced Carbon-Carbon components, develop a comprehensive database of flown Rein-forced Carbon-Carbon material characteristics by destructive testing and evaluation. (59,225) | F3.3-4 | RCC components are weakened by mass loss caused by oxidation within the substrate, which accumulates with age. The extent of oxidation is not directly measurable, and the resulting mission life reduction is developed analytically.(p.58) | |
| R3.3-5 | Improve the maintenance of launch pad structures to minimize the leaching of zinc primer onto Reinforced Carbon-Carbon components. (p.59,225) | F3.3-5 | To date, only two flown RCC panels, having achieved 15 and 19 missions, have been destructively tested to determine actual loss of strength due to oxidation.(p.58) | |
| Synopsis for R3.3-5 |
The RCC panels were found to be subject to since contamination from the launch pad. CAIB recommends that the launch pad be carefully maintained to avoid zinc contamination to the RCC components. | F3.3-6 | Contamination from zinc leaching from a primer under the paint topcoat on the launch pad structure increases the opportunities for localized oxidation.(p.58) | |
| R6.4-1 | For missions to the International Space Station, develop a
practicable capability to inspect and effect emergency repairs to the widest
possible range of damage to the Thermal Protection System, including both tile
and Reinforced Carbon-Carbon, taking advantage of the additional capabilities
available when near to or docked at the International Space Station. For non-Station missions, develop a comprehensive autonomous (independent of Station) inspection and repair capability to cover the widest possible range of damage scenarios. Accomplish an on-orbit Thermal Protection System inspection, using appropriate assets and capabilities, early in all missions. The ultimate objective should be a fully autonomous capability for all missions to address the possibility that an International Space Station mission fails to achieve the correct orbit, fails to dock successfully, or is damaged during or after undocking. [RTF] (p. 174, 225) |
F6.4-1 | The repair option, while logistically viable using existing materials onboard Columbia, relied on so many uncertainties that NASA rated this option “high risk.” (p. 174) | |
| Synopsis | The safe and effective functioning of the TPS system is vital to the successful and safe return of the shuttle and crew. CAIB recommends that the RCC system be thoroughly inspected while on orbit to determine its status. This will require the development of new technology to view and inspect the RCC system. CAIB further suggests that TPS inspections become a routine operation for shuttle crews once achieving orbit on every mission. | F6.4-2 | If Program managers were able to unequivocally determine before Flight Day Seven that there was potentially catastrophic damage to the left wing, accelerated processing of Atlantis might have provided a window in which Atlantis could rendezvous with Columbia before Columbia’s limited consumables ran out.(p. 174) | |
| R3.8-1 | Obtain sufficient spare
Reinforced Carbon-Carbon panel assemblies and associated support components to ensure that decisions on Reinforced Carbon-Carbon maintenance are made on the basis of component specifications, free of external pressures relating to schedules, costs, or other considerations. (p. 83, 225) |
No Findings Listed for this Recommendation | ||
| Synopsis | The existence of spare parts will eliminate some of the pressure associated with launch schedules. | |||
| R3.8-2 | Develop, validate, and maintain
physics-based computer models to evaluate Thermal Protection System damage from debris impacts. These tools should provide realistic and timely estimates of any impact damage from possible debris from any source that may ultimately impact the Orbiter. Establish impact damage thresholds that trigger responsive corrective action, such as on-orbit inspection and repair, when indicated. (p. 83, 226) |
F3-8-1 | The impact test program demonstrated that foam can cause a wide range of impact damage, from cracks to a 16- by 17-inch hole.(p. 83) | |
| Synopsis | The creation of comprehensive, accurate computer models to measure debris impact damage will assist engineers in evaluating the need for repair and inspection of the system. | F3.8-2 | The wing leading
edge Reinforced Carbon-Carbon composite material and associated support hardware are remarkably tough and have impact capabilities that far exceed the minimal impact resistance specified in their original design requirements. Nevertheless, these tests demonstrate that this inherent toughness can be exceeded by impacts representative of those that occurred during Columbia’s ascent. (p. 83) |
|
| F3.8-3 | The response of
the wing leading edge to impacts is complex and can vary greatly, depending on the location of the impact, projectile mass, orientation, composition, and the material properties of the panel assembly, making analytic predictions of damage to RCC assemblies a challenge.(p.83) |
|||
| F3.8-4 | Testing
indicates the RCC panels and T-seals have much higher impact resistance than the design specifications call for.(p.83) |
|||
| F3.8-5 | NASA has an
inadequate number of spare Reinforced Carbon-Carbon panel assemblies.(p. 83) |
|||
| F3.8-6 | NASA’s current
tools, including the Crater model, are inadequate to evaluate Orbiter Thermal Protection System damage from debris impacts during pre-launch, on-orbit, and post-launch activity.(p.83) |
|||
| F3.8-7 | The bipod ramp
foam debris critically damaged the leading edge of Columbia’s left wing.(p.83) |
|||
| Imaging | ||||
| R3.4-1 | Upgrade the imaging system to be capable of providing a minimum of three useful views of the Space Shuttle from liftoff to at least Solid Rocket Booster separation, along any expected ascent azimuth. The operational status of these assets should be included in the Launch Commit Criteria for future launches. Consider using ships or aircraft to provide additional views of the Shuttle during ascent. [RTF] (p. 62, 226) | F3.4-1 | Photographic evidence during ascent indicates the projectile that struck the Orbiter was the left bipod ramp foam.(p. 62) | |
| Synopsis for R3.4-1 |
Images if the orbiter when assessing possible damage occurring during ascent are essential to correctly determining whether or not further maintenance action is necessary to guarantee the safe return of the shuttle and crew. Additional images provided by multiple vantage points will provide a more comprehensive picture of launch events. Clear images of the External Tank following separation are useful in determining whether or not significant damage occurred to the shuttle by debris originating in the External Tank area. | F3.4-2 | The same photographic evidence, confirmed by independent analysis, indicates the projectile struck the underside of the leading edge of the left wing in the vicinity of RCC panels 6 through 9 or the tiles directly behind, with a velocity of approximately 775 feet per second.(p. 62) | |
| R3.4-2 | Provide a capability to obtain and downlink high-resolution images of the External Tank after it separates. [RTF] (p.62, 226) | F3.4-3 | There is a requirement to obtain and downlink on-board engineering quality imaging from the Shuttle during launch and ascent.(p. 62) | |
| Synopsis for R3.4-2 |
Images if the orbiter when assessing possible damage occurring during ascent are essential to correctly determining whether or not further maintenance action is necessary to guarantee the safe return of the shuttle and crew. Additional images provided by multiple vantage points will provide a more comprehensive picture of launch events. Clear images of the External Tank following separation are useful in determining whether or not significant damage occurred to the shuttle by debris originating in the External Tank area. | F3.4-4 | The current long-range camera assets on the Kennedy Space Center and Eastern Range do not provide best possible engineering data during Space Shuttle ascents.(p. 62) | |
| R3.4-3 | Provide a capability to obtain and downlink high-resolution images of the underside of the Orbiter wing leading edge and forward section of both wings. Thermal Protection System. [RTF] (p.62, 226) | F3.4-5 | Evaluation of STS-107 debris impact was hampered by lack of high resolution, high speed cameras (temporal and spatial imagery data).(p. 62) | |
| F3.4-6 | Despite the lack of high quality visual evidence, the information available about the foam impact during the mission was adequate to determine its effect on both the thermal tiles and RCC.(p. 62) | |||
| R6.3-2 | Modify the Memorandum of Agreement with the National Imagery and Mapping Agency to make the imaging of each Shuttle flight while on orbit a standard requirement. [RTF] (p.172,226) | F6.3-1 | The foam strike was first seen by the Intercenter Photo Working Group on the morning of Flight Day Two during the standard review of launch video and high-speed photography. The strike was larger than any seen in the past, and the group was concerned about possible damage to the Orbiter. No conclusive images of the strike existed. One camera that may have provided an additional view was out of focus because of an improperly maintained lens. (p. 170) | |
| Synopsis for R6.3-2 |
The best photo imaging assets we have in space are those used by the Department of Defense. The images provided by DoD are invaluable in ascertaining the extent of damage to the orbiter while in orbit. CAIB recommended that these images be taken for every shuttle flight. | F6.3-2 | The Chair of the Intercenter Photo Working Group asked management to begin the process of getting outside imagery to help in damage assessment. This request, the first of three, began its journey through the management hierarchy on Flight Day Two. (p. 170) | |
| R6.3-1* | Implement an expanded training program in which the Mission Management Team faces potential crew and vehicle safety contingencies beyond launch and ascent. These contingencies should involve potential loss of Shuttle or crew, contain numerous uncertainties and unknowns, and require the Mission Management Team to assemble and interact with support organizations across NASA/Contractor lines and in various locations. [RTF] *(p. 172, 226) | F6.3-3 | The Intercenter Photo Working Group distributed its first report, including a digitized video clip and initial assessment of the strike, on Flight Day Two. This information was widely disseminated to NASA and contractor engineers, Shuttle Program managers, and Mission Operations Directorate personnel. (p. 170-1) | |
| Synopsis for R6.3-1 |
The Mission Management Team training program should be expanded to incorporate previously unrehearsed contingencies. | F6.3-4 | Initial estimates of debris size, speed, and origin were remarkably accurate. Initial in-formation available to managers stated that the debris originated in the left bipod area of the External Tank, was quite large, had a high velocity, and struck the underside of the left wing near its leading edge. The report stated that the debris could have hit the RCC or tile. (p. 171) | |
| *Recommendation R6.3-1 appears in the Part Two Training Section of recommendations. Its findings, however, are the same as those assosciated with the R6.3-2 recommendation. | F6.3-5 | A Debris Assessment Team began forming on Flight Day two to analyze the impact. Once the debris strike was categorized as “out of family” by United Space Alliance, contractual obligations led to the Team being Co-Chaired by the cognizant contractor sub-system manager and her NASA counterpart. The team was not designated a Tiger Team by the Mission Evaluation Room or Mission Management Team. (p. 171) | ||
| F6.3-6 | Though the Team was clearly reporting its plans (and final results) through the Mission Evaluation Room to the Mission Management Team, no Mission manager appeared to “own” the Team’s actions. The Mission Management Team, through the Mission Evaluation Room, provided no direction for team activities, and Shuttle managers did not formally consult the Team’s leaders about their progress or interim results. (p. 171) | |||
| F6.3-7 | During an organizational meeting, the Team discussed the uncertainty of the data and the value of on-orbit imagery to “bound” their analysis. In its first official meet-ing the next day, the Team gave its NASA Co-Chair the action to request imagery of Columbia on-orbit. (p. 171) | |||
| F6.3-8 | The Team routed its request for imagery through Johnson Space Center’s Engineering Directorate rather than through the Mission Evaluation Room to the Mission Management Team to the Flight Dynamics Officer, the channel used during a mission. This routing diluted the urgency of their request. Managers viewed it as a non-critical engineering desire rather than a critical operational need. (p. 171) | |||
| F6.3-9 | Team members never realized that management’s decision against seeking imagery was not intended as a direct or final response to their request.(p. 171) | |||
| F6.3-10 | The Team’s assessment of possible tile damage was performed using an impact simulation that was well outside Crater’s test database. The Boeing analyst was inexperienced in the use of Crater and the interpretation of its results. Engineers with extensive Thermal Protection System expertise at Huntington Beach were not actively involved in determining if the Crater results were properly interpreted. (p. 171) | |||
| F6.3-11 | Crater initially predicted tile damage deeper than the actual tile depth, but engineers used their judgment to conclude that damage would not penetrate the densified layer of tile. Similarly, RCC damage conclusions were based primarily on judgment and experience rather than analysis. (p. 171) | |||
| F6.3-12 | For a variety of reasons, including management failures, communication breakdowns, inadequate imagery, inappropriate use of assessment tools, and flawed engineering judgments, the damage assessments contained substantial uncertainties.(p. 171) | |||
| F6.3-13 | The assumptions (and their uncertainties) used in the analysis were never presented or discussed in full to either the Mission Evaluation Room or the Mission Management Team. (p. 171) | |||
| F6.3-14 | F6.3-14 While engineers and managers knew the foam could have struck RCC panels; the briefings on the analysis to the Mission Evaluation Room and Mission Management Team did not address RCC damage, and neither Mission Evaluation Room nor Mission Management Team managers asked about it. (p. 171) |
|||
| F6.3-15 | There were lapses in leadership and communication that made it difficult for engineers to raise concerns or understand decisions. Management failed to actively engage in the analysis of potential damage caused by the foam strike. (p. 171) | |||
| F6.3-16 | Mission Management Team meetings occurred infrequently (five times during a 16 day mission), not every day, as specified in Shuttle Program management rules. (p. 171) | |||
| F6.3-17 | Shuttle Program Managers entered the mission with the belief, recently reinforced by the STS-113 Flight Readiness Review, that a foam strike is not a safety-of-flight issue. (p.171) | |||
| F6.3-18 | After Program managers learned about the foam strike, their belief that it would not be a problem was confirmed (early, and without analysis) by a trusted expert who was readily accessible and spoke from “experience.” No one in management questioned this conclusion. (p. 172) | |||
| F6.3-19 | Managers asked “Who’s requesting the photos?” instead of assessing the merits of the request. Management seemed more concerned about the staff following proper channels (even while they were themselves taking informal advice) than they were about the analysis. (p. 172) | |||
| F6.3-20 | No one in the operational chain of command for STS-107 held a security clearance that would enable them to understand the capabilities and limitations of National imagery resources. (p.172) | |||
| F6.3-21 | Managers associated with STS-107 began investigating the implications of the foam strike on the launch schedule, and took steps to expedite post-flight analysis. (p.172) | |||
| F6.3-22 | Program managers required engineers to prove that the debris strike created a safety-of-flight issue: that is, engineers had to produce evidence that the system was unsafe rather than prove that it was safe. (p.172) | |||
| F6.3-23 | In both the Mission Evaluation Room and Mission Management Team meetings over the Debris Assessment Team’s results, the focus was on the bottom line – was there a safety-of-flight issue, or not? There was little discussion of analysis, assumptions, issues, or ramifications.(p.172) | |||
| F6.3-24 | Communication did not flow effectively up to or down from Program managers. (p.172) | |||
| F6.3-25 | Three independent requests for imagery were initiated. (p.172) | |||
| F6.3-26 | Much of Program managers’ information came through informal channels, which prevented relevant opinion and analysis from reaching decision makers.(p.172) | |||
| F6.3-27 | Program Managers did not actively communicate with the Debris Assessment Team. Partly as a result of this, the Team went through institutional, not mission-related, channels with its request for imagery, and confusion surrounded the origin of imagery requests and their subsequent denial. (p.172) | |||
| F6.3-28 | Communication was stifled by the Shuttle Program attempts to find out who had a “mandatory requirement” for imagery. (p.172) | |||
| F6.3-29 | Safety representatives from the appropriate organizations attended meetings of the Debris Assessment Team, Mission Evaluation Room, and Mission Management Team, but were passive, and therefore were not a channel through which to voice concerns or dissenting views. (p.172) | |||
| Orbiter Sensor Data | [1] | |||
| R3.6-1 | The Modular Auxiliary Data System instrumentation and sensor suite on each Orbiter should be maintained and updated to include current sensor and data acquisition technologies. (p. 73, 226) | F3.6-1 | The de-orbit burn and re-entry flight path were normal until just before Loss of Signal.(p.73) | |
| Synopsis for R3.6-1 |
CAIB determined that the instrumentation and sensor suite (Modular Auxiliary Data System) should utilize the latest technologies available, given that the sensors are able to provide necessary structural integrity data. By the time Mission Control received the data on the wing heating, the damage was unrecoverable. | F3.6-2 | Columbia re-entered the atmosphere with a preexisting breach in the left wing.(p.73) | |
| R3.6-2 | The Modular Auxiliary Data System should be redesigned to include engineering performance and vehicle health information, and have the ability to be reconfigured during flight in order to allow certain data to be recorded, telemetered, or both as needs change. (p.73, 226) | F3.6-3 | Data from the Modular Auxiliary Data System recorder indicates the location of the breach was in the RCC panels on the left wing leading edge.(p.73) | |
| Synopsis for R3.6-2 |
The Modular Auxiliary Data System should be redesigned to allow essential vehicle integrity information to be communicated. | F3.6-4 | Abnormal heating events preceded abnormal aerodynamic events by several minutes.(p.73) | |
| F3.6-5 | By the time data
indicating problems was telemetered to Mission Control Center, the Orbiter
had already suffered damage from which it could not recover.(p.73) |
|||
| Wiring | ||||
| R4.2-2 | As part of the Shuttle Service Life Extension Program and potential 40-year service life, develop a state-of-the-art means to inspect all Orbiter wiring, including that which is inaccessible. (p. 89, 226) | F4.2-5 | Based on the extensive wiring inspections, maintenance, and modifications prior to STS-107, analysis of sensor/wiring failure signatures, and the alignment of the signatures with thermal intrusion into the wing, the Board found no evidence that Kapton wiring problems caused or contributed to this accident. (p.189) | |
| Synopsis for R4.2-2 |
Although the CAIB determined that faulty wiring was not the culprit of the accident, they recommended all wiring on the Shuttle be inspected. | |||
| Bolt Catchers | ||||
| R4.2-1 | Test and qualify the flight hardware bolt catchers. [RTF] (p.88, 226) | F4.2-1 | The certification of the bolt catchers flown on STS-107 was accomplished by extrapolating analysis done on similar but not identical bolt catchers in original testing. No testing of flight hardware was performed. (p. 88) | |
| Synopsis for R4.2-1 |
The CAIB was unable to rule out the bolt catchers as potentially being the cause of the orbiter left wing damage, though should it have been the cause it is expected that the impact would have registered on sensors. The CAIB further recommended that the bolt catchers be tested prior to flight. The bolt catcher is designed to "catch" the upper half of the bolt that connects that Solid Rocket Boosters (SRB) and the External Tank (ET) that are explosively separated when the SRBs are separated from the ET. | F4.2-2 | Board-directed testing of a small sample size demonstrated that the “as-flown” bolt catchers do not have the required 1.4 margin of safety. (p. 88) | |
| F4.2-3 | Quality assurance processes for bolt catchers (a Criticality 1 subsystem) were not adequate to as-sure contract compliance or product adequacy.(p. 88) | |||
| F4.2-4 | An unknown metal object was seen separating from the stack during Solid Rocket Booster separation during six Space Shuttle missions. These objects were not identified, but were characterized as of little to no concern.(p. 88) | |||
| Closeouts | ||||
| R4.2-3 | Require that at least two employees attend all final closeouts and intertank area hand-spraying procedures. [RTF] (p. 94, 226) | F4.2-12 | The Board found no evidence that willful damage was a factor in this accident. (p. 94) | |
| Synopsis for R4.2-3 |
Though CAIB found that no damage was purposely done to the orbiter, they recommended that two people attend all final closeouts and intertank spraying procedures. Close out is when the component of the space transportation system is "sealed and flight certified". | F4.2-13 | Two close-out processes at the Michoud Assembly Facility are currently able to be performed by a single person. (p. 94) | |
| F4.2-14 | Photographs of every close out activity are not routinely taken.(p. 94) | |||
| Micrometeoroid and Orbital Debris | ||||
| R4.2-4 | Require the Space Shuttle to be operated with the same degree of safety for micrometeoroid and orbital debris as the degree of safety calculated for the International Space Station. Change the micrometeoroid and orbital debris safety criteria from guidelines to requirements. (p. 95, 226) | F4.2-15 | There is little evidence that Columbia encountered either micrometeoroids or orbital debris on this flight.(p. 94) | |
| Synopsis for R4.2-4 |
CAIB could not dismiss micrometeoroids/space debris as a potential factor in the Columbia accident, though shuttle data "rules out major impact". CAIB considers the roughly 1/200 mission impact odds to be unacceptable and recommends that the shuttle be operated with a greater degree of safety. | F4.2-16 | The Board found markedly different criteria for margins of micrometeoroid and orbital debris safety between the International Space Station and the Shuttle.(p. 95) | |
| Foreign Object Debris | ||||
| R4.2-5 | Kennedy Space Center Quality Assurance and United Space Alliance must return to the straightforward, industry-standard definition of “Foreign Object Debris” and eliminate any al-ternate or statistically deceptive definitions like “processing debris.” [RTF] (p.95, 226) | F4.2-18 | Since 2001, Kennedy Space Center has used a non-standard approach to define foreign object debris. The industry standard term “Foreign Object Damage” has been divided into two categories, one of which is much more permissive. (p. 95) | |
| Synopsis for R4.2-5 |
The definition that Kennedy Space Center (KSC) and the United Space Alliance (USA) uses for debris differs from the industry standard and thus can be deceptive. CAIB recommends that KSC and USA return to the original definition. | |||
| Part Two-Why the Accident Occurred | ||||
| Scheduling | ||||
| R6.2-1 | Adopt and maintain a Shuttle flight schedule that is consistent with available resources. Although schedule deadlines are an important management tool, those deadlines must be regularly evaluated to ensure that any additional risk incurred to meet the schedule is recognized, understood, and acceptable. [RTF] (p. 139, 226) | F6.2-1 | NASA Headquarters’ focus was on the Node 2 launch date, February 19, 2004. (p.139) | |
| Synopsis for R6.2-1 |
The schedule used for shuttle flights should not be set in stone and should be realistic. The schedule should be revised periodically in order to mitigate potential risk created by deadline pressures. | F6.2-2 | The intertwined nature of the Space Shuttle and the Space Station programs significantly increased the complexity of the schedule and made meeting the schedule far more challenging.(p. 139) | |
| F6.2-3 | The capabilities of the system were being stretched to the limit to support the schedule. Projections into 2003 showed stress on vehicle processing at the Kennedy Space Center, on flight controller training at Johnson Space Center, and on Space Station crew rotation schedules. Effects of this stress included neglecting flight controller recertification requirements, extending crew rotation schedules, and adding incremental risk by scheduling additional Orbiter movements at Kennedy. (p.139) | |||
| F6.2-4 | The four flights scheduled in the five months from October 2003, to February 2004, would have required a processing effort comparable to the effort immediately before the Challenger accident. (p.139) | |||
| F6.2-5 | There was no schedule margin to accommodate unforeseen problems. When flights come in rapid succession, there is no assurance that anomalies on one flight will be identified and appropriately addressed before the next flight. (p.139) | |||
| F6.2-6 | The environment of the countdown to Node 2 and the importance of maintaining the schedule may have begun to influence managers. decisions, including those made about the STS-112 foam strike. (p.139) | |||
| F6.2-7 | During STS-107, Shuttle Program managers were concerned with the foam strike’s possible effect on the launch schedule. (p.139) | |||
| Organization | ||||
| R7.5-1 | Establish an independent
Technical Engineering Authority that is responsible for technical
requirements and all waivers to them, and will build a disciplined,
systematic approach to identifying, analyzing, and controlling hazards
throughout the life cycle of the Shuttle System. The independent technical
authority does the following as a minimum •Develop and maintain technical standards for all Space Shuttle Program projects and elements • Be the sole waiver-granting authority for all technical standards • Conduct trend and risk analysis at the sub-system, system, and enterprise levels • Own the failure mode, effects analysis and hazard reporting systems • Conduct integrated hazard analysis • Decide what is and is not an anomalous event • Independently verify launch readiness • Approve the provisions of the recertification program called for in Recommendation R9.1-1. The Technical Engineering Authority should be funded directly from NASA Headquarters, and should have no connection to or responsibility for schedule or program cost. (p. 193, 227) |
F7. 1-1 | Throughout its history, NASA has consistently struggled to achieve viable safety programs and adjust them to the constraints and vagaries of changing budgets. Yet, according to multiple high level independent reviews, NASA’s safety system has fallen short of the mark. (p. 192) | |
| Synopsis for R7.5-1 |
CAIB recommends an independent technical engineering authority be created to monitor hazards to the shuttle system. | F7.4-1 | The Associate Administrator for Safety and Mission Assurance is not responsible for safety and mission assurance execution, as intended by the Rogers Commission, but is responsible for Safety and Mission Assurance policy, advice, coordination, and budgets. This view is consistent with NASA’s recent philosophy of management at a strategic level at NASA Headquarters but contrary to the Rogers. Commission recommendation. (p. 193) | |
| R7.5-2 | NASA Headquarters Office of Safety and Mission Assurance should have direct line authority over the entire Space Shuttle Program safety organization and should be independently resourced. (p. 193, 227) | F7.4-2 | Safety and Mission Assurance organizations sup-porting the Shuttle Program are largely dependent upon the Program for funding, which hampers their status as independent advisors. (p. 193) | |
| Synopsis for R7.5-2 |
The Headquarters Office of Mission and Safety Assurance shall be the authority on shuttle program safety. | F7.4-3 | Over the last two decades, little to no progress has been made toward attaining integrated, independent, and detailed analyses of risk to the Space Shuttle system. (p. 193) | |
| F7.4-4 | System safety engineering and management is separated from mainstream engineering, is not vigorous enough to have an impact on system de-sign, and is hidden in the other safety disciplines at NASA Headquarters. (p. 193) | |||
| R7.5-3 | Reorganize the Space Shuttle Integration Office to make it capable of integrating all elements of the Space Shuttle Program, including the Orbiter. (p. 193, 227) | F7.4-5 | Risk information and data from hazard analyses are not communicated effectively to the risk assessment and mission assurance processes. The Board could not find adequate application of a process, database, or metric analysis tool that took an integrated, systemic view of the entire Space Shuttle system. (p. 193) | |
| Synopsis for R7.5-3 |
This will also integrate all safety aspects of the shuttle program. | F7.4-6 | The Space Shuttle Systems Integration Office handles all Shuttle systems except the Orbiter. Therefore, it is not a true integration office. (p. 193) | |
| F7.4-7 | When the Integration Office convenes the Integration Control Board, the Orbiter Office usually does not send a representative, and its staff makes verbal inputs only when requested. (p. 193) | |||
| F7.4-8 | The Integration office did not have continuous responsibility to integrate responses to bipod foam shedding from various offices. Sometimes the Orbiter Office had responsibility, sometimes the External Tank Office at Marshall Space Flight Center had responsibility, and sometime the bi-pod shedding did not result in any designation of an In-Flight Anomaly. Integration did not occur. (p. 193) | |||
| F7.4-9 | NASA information databases such as The Problem Reporting and Corrective Action and the Web Program Compliance Assurance and Status System are marginally effective decision tools. (p. 193) | |||
| F7.4-10 | Senior Safety, Reliability & Quality Assurance and element managers do not use the Lessons Learned Information System when making decisions. NASA subsequently does not have a constructive program to use past lessons to educate engineers, managers, astronauts, or safety personnel. (p. 193) | |||
| F7.4-11 | The Space Shuttle Program has a wealth of data tucked away in multiple databases without a convenient way to integrate and use the data for management, engineering, or safety decisions. (p. 193) | |||
| F7.4-12 | The dependence of Safety, Reliability & Quality Assurance personnel on Shuttle Program support limits their ability to oversee operations and communicate potential problems throughout the organization. (p. 193) | |||
| F7.4-13 | There are conflicting roles, responsibilities, and guidance in the Space Shuttle safety programs. The Safety & Mission Assurance Pre-Launch Assessment Review process is not recognized by the Space Shuttle Program as a requirement that must be followed (NSTS 22778). Failure to consistently apply the Pre-Launch Assessment Review as a requirements document creates confusion about roles and responsibilities in the NASA safety organization. (p. 193) | |||
| Part Three-A Look Ahead | ||||
| Organization | ||||
| R9.1-1 | Prepare a detailed plan for defining, establishing, transitioning, and implementing an independent Technical Engineering Authority, independent safety program, and a reorganized Space Shuttle Integration Office as described in R7.5-1, R7.5-2, and R7.5-3. In addition, NASA should submit annual reports to Congress, as part of the budget review process, on its implementation activities. [RTF] (p. 208, 227) | There are no findings associated with this recommendation. | ||
| Recertification | ||||
| R9.2-1 | Prior to operating the Shuttle beyond 2010, develop and conduct a vehicle recertification at the material, component, subsystem, and system levels. Recertification requirements should be included in the Service Life Extension Program. (p. 209, 227) | There are no findings associated with this recommendation. | ||
| Closeout Photos/Drawing System | ||||
| R10.3-1 | Develop an interim program of closeout photographs for all critical sub-systems that differ from engineering drawings. Digitize the close-out photograph system so that images are immediately available for on-orbit troubleshooting. [RTF] (p. 217, 227) | F10.3-1 | The engineering drawing system contains outdated information and is paper-based rather than computer-aided. (p. 217) | |
| Synopsis for R10.3-1 |
Photos of the current sealed and certified shuttle components should be organized and made easily accessible to utilize on orbit. | F10.3-2 | The current drawing system cannot quickly portray Shuttle sub-systems for on-orbit trouble-shooting. (p. 217) | |
| R10.3-2 | Provide adequate resources for a
long-term program to upgrade the Shuttle engineering drawing system
including: • Reviewing drawings for accuracy • Converting all drawings to a computer-aided drafting system • Incorporating engineering changes (p. 217, 227) |
F10.3-3 | NASA normally uses closeout photographs but lacks a clear system to define which critical sub-systems should have such photographs. The current system does not allow the immediate retrieval of closeout photos. (p. 217) | |
| Synopsis for R10.3-2 |
The Shuttle engineering drawing system should be revised and updated. | |||
| By: Jennifer Troxell, NASA History Office | ||||