Mark ở vũ trụ khácVIMark học AI
Mark ở vũ trụ khác · Another Universe Anatomy of a Disaster · Spaceflight · Organisations

Space Shuttle Columbia

81.7 s 16 days

STS-107 · 16 January to 1 February 2003 · The sky over Texas

Whatbroke apart on re-entry, 16 minutes before landing
Loss7 astronauts
Root causea piece of foam holed the left wing's leading edge at launch
Main sourceCAIB report, Vol. I, August 2003

Sources: NASA, STS-107 mission page; CAIB report, Board Statement.

One-minute recap

Essence

One piece of foamInsulating foam fell off the External Tank at 81.7 seconds and hit the left wing's leading edge.
Falling foam was routineFoam shedding shows on 65 of 79 imaged flights. The original design banned it outright.
Three requests for picturesEngineers tried three times to get the left wing photographed in orbit. All three were stopped.
The key line was at the bottomThe foam was up to 640 times bigger than the test pieces, stated on the last line under a title saying "conservatism".
Challenger, againThe Board: the organisational causes of Challenger "have not been fixed".

Sources: CAIB report Vol. I (2003): Board Statement and chapter 3 (81.7 s); section 6.1 (65/79 flights, design requirement); section 6.3 (three imagery requests); chapter 7, p. 191 (the slide, 640 times); chapter 8, p. 195.

Part 1

The question

Seventeen years after Challenger, the same organisation had a new safety office and a whole book of lessons. Why did it lose a shuttle to the same old mistake: a repeated defect treated as normal, and engineers once again asked to prove there was danger?

1983–2002Falling foam becomes normalSeven foam losses from the same spot. The labels soften: "anomaly", then "accepted risk".
→
16–24 Jan 2003Sixteen days in orbitThe strike is seen on film. Three imagery requests are stopped. One slide concludes "no safety-of-flight issue".
→
1 Feb 2003Re-entryHot gas enters the left wing through the hole. The orbiter breaks apart over Texas.

Source: CAIB report, section 6.1 (seven foam losses, how they were classified) and 6.3 (imagery requests, the 24 January conclusion).

Part 2

What happened

Timeline from chapter 3 and section 6.3 of the CAIB report. Times are US Eastern.

A 16-day timeline. 16 Jan: launch; at 81.7 seconds foam strikes the left wing. 17 Jan: the photo team sees the strike on film. 21 Jan: two more requests for images of the wing. 22 Jan: the request to the Department of Defense is cancelled after 90 minutes. 23 Jan: e-mail to the commander and pilot saying there is no concern for entry. 24 Jan: the management team concludes no safety-of-flight issue. 1 Feb: the orbiter breaks apart over Texas. 16 Jan · launch81.7 s: foam hits wing 17 Jan · seenon film 21 Jan · requests 2, 3 22 Jan · cancelledafter 90 minutes 23 Jan · e-mail to the crew"absolutely no concern" 24 Jan · management team"no safety of flight" 1 Feb · re-entry~9:00 breakup over Texas 8 quiet days in orbit time scale: days, from launch on 16 Jan to re-entry on 1 Feb 2003
The deciding week was the first one. Every imagery request and every conclusion fell in the first eight days. For the rest of the flight, nobody looked at the left wing again.Sources: CAIB report, section 6.3 (17 to 24 Jan, request cancelled after 90 minutes, 23 Jan e-mail); NASA, STS-107 page (about 9:00, 16 minutes before scheduled landing).
16 Jan 2003, 10:39 · LaunchAt 81.7 s a piece of foam separates from the left bipod ramp of the External Tank. At 81.9 s it strikes the left wing's leading edge near panel 8, at a relative speed of about 545 mph (877 km/h).
17 Jan · Flight Day 2The photo team spots the strike on launch film. The log says the vehicle "may have sustained damage from a debris strike".
18–19 Jan · Boeing's estimateDebris about 20 × 20 × 2 inches at about 750 feet per second. The Board later called the estimates "remarkably accurate".
21–22 Jan · Three imagery requests, then cancellationEngineer Rodney Rocha writes: "Can we petition (beg) for outside agency assistance?" On the morning of 22 Jan the request to the military is cancelled at 8:30.
23 Jan · E-mail to commander and pilot"There is absolutely no concern for entry." The crew is sent a video clip so they can answer press questions.
1 Feb, 8:44 · Entry interface270 seconds later the on-board recorder logs the first anomaly. At 8:54 Mission Control notices. Around 9:00 the orbiter breaks apart over Texas.

Sources: CAIB report, chapter 3, pp. 49, 54, 60, 65 (launch time, 81.7 and 81.9 s, panel 8, 545 mph, re-entry times); section 6.3 (17 Jan log, Boeing's estimate, Rocha's e-mail, cancellation at 8:30, 23 Jan e-mail). Chapter 3 also gives a 625–840 ft/s range from image analysis.

Part 1 post

What happened

81.7 s16 days3 imagery requestsre-entry
Part 2 post

Why

foam becomes normalmodel out of rangethe buried lineChallenger again
Part 3 post

Work lessons

don't rename riskthe title is the conclusionlessons into structure
Part 3

Why: five layers of cause

The technical layer: light foam, high speed

foam strike · RCC leading edgeCAIB, chapter 3
A piece of insulating foam 53 to 69 cm long hits the left wing's leading edge at a relative speed of about 877 km/h. A test on 7 July 2003 fired a 0.76 kg foam block at leading-edge panel 8 and made a hole about 40 cm across. On re-entry, hot gas entered the wing through that hole. foam · 21–27 × 12–18 in ~545 mph relative left wing, panel 8 1 · 81.9 s: foam hits the leading edge 2 · test, 7 Jul 2003: 1.67 lb of foam makes a ~16-inch hole in panel 8 3 · re-entry: hot gas enters the wing
Light foam, but hitting at nearly 900 km/h. The hole was in the reinforced carbon-carbon (RCC) leading edge, not in the heat tiles under the wing as many people think.Sources: CAIB report, chapter 3, pp. 49, 59, 60, 62, 66 (21–27 × 12–18 inches, 545 mph, 1.67 lb test projectile); CAIB photo caption on the 7 July 2003 test ("A 16 inch hole" in panel 8).

The history layer: falling foam becomes normal

normalization of deviance, the sequelCAIB, section 6.1
Seven foam losses from the left bipod ramp, 1983 to 2003: STS-7 in 1983, STS-32R in 1990, STS-50 and STS-52 in 1992, STS-62 in 1994, STS-112 in October 2002 and STS-107 in 2003. Five of the seven happened on Columbia itself. 1982198819942000 STS-7 32R 50, 52 62 STS-107 STS-112 · Oct 20024 × 5 × 12-inch piece,not classed an "anomaly" on Columbia (5 of 7) other orbiters foam shedding seen on 65 of 79 imaged flights · on average 143 divots per flight
The original design said: "No debris shall emanate" from the critical zone of the tank. Twenty years later, foam came off that same spot on about 1 in 10 imaged flights. The Board: "NASA has not followed its own rules and requirements on foam-shedding."Source: CAIB report, section 6.1, pp. 122–131 (requirement 3.2.1.1.17, 65/79 flights, 143 divots, the list of 7 events, 7 of 72 imaged flights, findings F6.1-1 and F6.1-3). Year and orbiter of each flight: NASA mission records.
A staircase of labels. Original design: no debris. 1980s and 1990s: foam loss is an in-flight anomaly. October 2002, STS-112: no longer an anomaly, just an action due after the next flight. November 2002, STS-113: an accepted risk. January 2003: in-family, no safety-of-flight issue. original design"no debris" 1983–1994"in-flight anomaly" Oct 2002just an "action" Nov 2002"accepted risk" Jan 2003"in-family", fine
Nobody decided "falling foam is fine". Each classification was only a little softer than the last. The Board: foam-shedding, which had initially raised serious safety concerns, "evolved into 'in-family' or 'no safety-of-flight' events".Source: CAIB report, section 6.1 (STS-113 Flight Readiness Review, findings F6.1-2, F6.1-6, F6.1-7).

The data layer: a model out of range, a slide that buried the key line

Crater model · the Boeing slideCAIB 6.3 and chapter 7, p. 191
Left: the test pieces used to calibrate the Crater model were about 3 cubic inches; the estimated foam was 1,920 cubic inches, up to 640 times larger. Right: a sketch of the Boeing slide. Title: Review Of Test Data Indicates Conservatism for Tile Penetration. The most important line is at the bottom: Volume of ramp is 1920cu in vs 3 cu in for test. volume, cubic inches test: ~3 STS-107 foam ~1,920 up to 640 times larger Review Of Test Data Indicates Conservatism for Tile Penetration • ... overpredicted penetration of tile coating significantly – Flight condition is significantly outside of test database – Volume of ramp is 1920cu in vs 3 cu in for test
The right answer was on the slide, on its last line. The Crater model had been calibrated with pieces of about 3 cubic inches and had never been used in orbit. Edward Tufte counted "significant(ly)" five times, with meanings ranging from "detectable in largely irrelevant calibration case study" to "a difference of 640-fold", and proposed a more honest title: "Review of Test Data Indicates Irrelevance of Two Models". The Board criticised "the endemic use of PowerPoint briefing slides instead of technical papers".Sources: CAIB report, chapter 7, pp. 190–192 (title, the last two lines and the "overpredicted" line quoted verbatim; Tufte's remarks); section 6.3 (Crater, 3-cubic-inch test pieces, up to 640 times larger, best estimate about 400 times). Grey bars are omitted lines, not original content.

The decision layer: three requests, one question, "is there a requirement?"

burden of proofCAIB, section 6.3
Three imagery requests: Bob Page to Wayne Hale on Flight Day 2; Bob White to Lambert Austin on Flight Day 6; Rodney Rocha to Paul Shack on Flight Day 6. All lead to the management team chair, Linda Ham, asking whether anyone had a requirement for imagery. On 22 Jan at 8:30 the request is cancelled. Result: the analysts had to prove unequivocally that a safety-of-flight issue existed. 1 · Flight Day 2Page → Hale 2 · Flight Day 6White → Austin 3 · Flight Day 6Rocha → Shack: "beg" the team chair asks: does anyone have a "requirement" for imagery? 22 Jan · cancelled 8:30, made and rescinded within 90 minutes CAIB: the team "had to prove unequivocally that a safety-of-flight issue existed". Challenger 1986: "it was up to us to prove ... that it was not safe".
None of the requests went through the formal channel, which made all three easy to stop. Rocha drafted an e-mail calling the programme's answer "wrong (and bordering on irresponsible)", but did not send it because he did not want to jump the chain of command. The Board counted "at least eight 'missed opportunities'".Sources: CAIB report, section 6.3 (three requests, the "requirement" question, cancellation at 8:30 within 90 minutes, Rocha's unsent e-mail, eight missed opportunities); Challenger line: Boisjoly's testimony, Rogers Commission report, chapter 5.

The organisational layer: Challenger, the sequel

history as causeCAIB, chapters 5, 7, 8

"NASA's organizational culture and structure had as much to do with this accident as the External Tank foam."

Source: CAIB report, chapter 7, p. 177.

Challenger 1986Columbia 2003
Repeated damageO-ring distress on 7/23 flightsfoam shedding on 65/79 imaged flights
Softer labels"not desirable but acceptable""in-family", "accepted risk"
Burden of proofprove it is NOT safeprove unequivocally there is a problem
Schedule pressuretarget of 24 flights a yearNode 2 on 19 February 2004
Safety officenot invited to the calllacked "the independence and authority"
Presentationa chart without the zerosa slide that buried the key line

Sources: Challenger column: Rogers Commission report (1986), chapters 5–8, and Dalal, Fowlkes and Hoadley (1989); see piece #01. Columbia column: CAIB report, sections 6.1, 6.2, 6.3, chapter 7 (pp. 191, 192). The row-by-row pairing is Mark's; CAIB chapter 8 says the decisions on foam and on O-rings "had identical trajectories".

Schedule

The 19 February 2004 date for the station's Node 2 "influenced many of decisions". During the flight, managers worried about the strike's effect on the launch schedule (CAIB, section 6.2, F6.2-7).

A shrinking budget

The Shuttle programme lost about 40 percent of its budget's purchasing power. "Faster, better, cheaper" was the 1990s slogan (CAIB, chapter 5, pp. 103–104).

Safety without independence

Section 7.4 is titled "A Broken Safety Culture". The safety office "does not have the independence and authority" (CAIB, chapter 7, pp. 184, 192).
Part 4

Fact check: what's true, what's myth

13 things often said about Columbia, checked against the original record. Tap a row for the reasoning.

The rescue option NASA studied for the Board after the accident. The damage had to be recognised before Flight Day 7, around 22 January. Atlantis could be ready by 10 February. Columbia's crew, by cutting activity, could keep carbon dioxide in check until the morning of 15 February. The rescue window ran from 10 to 15 February. In reality the orbiter re-entered on 1 February. 16 Jan 22 Jan · Flight Day 7damage had to be known by now 1 Feb · actual re-entry 10 Feb · Atlantis could be ready 15 Feb · CO₂ limit reached rescue window a study done after the accident, at the Board's request: "challenging but feasible"
Rescue was possible, if known early. An in-orbit repair was rated "high risk". Sending Atlantis up and moving the crew across by spacewalk "had a considerably higher chance of bringing Columbia's crew back alive".Source: CAIB report, section 6.4 (details in Vol. II, Appendix D.13): CO₂ until the morning of 15 Feb, Atlantis by 10 Feb, damage known before Flight Day 7, "challenging but feasible".
SOLIDFoam from the left bipod ramp holed the left wing's leading edge

The Board's finding on the physical cause (Board Statement, chapter 3), backed by launch film, sensor data inside the wing and the foam-impact test.

SOLIDNASA had known about falling foam for years

Foam shedding on 65 of 79 imaged flights; seven losses from the left bipod ramp; a design requirement banning debris (CAIB, section 6.1).

SOLIDEngineers asked for pictures of the wing and were stopped

Three separate requests, none through the formal channel. The request to the military was cancelled on the morning of 22 Jan, 90 minutes after it was made (CAIB, section 6.3).

SOLIDThere was schedule pressure

The Node 2 date of 19 Feb 2004 "influenced many of decisions", and during the flight managers worried about the strike's effect on the launch schedule (CAIB, section 6.2, F6.2-7).

SOLIDColumbia repeated Challenger's organisational causes

Chapter 8: the causes of the institutional failure behind Challenger "have not been fixed"; dangerous aspects of NASA's 1986 culture "remained unchanged".

CAUTIONIf they had known, the crew would certainly have been saved

The study for the Board called the rescue "challenging but feasible", provided the damage was recognised before Flight Day 7. It was done after the accident, and rushing Atlantis to launch carried its own risk. "Possible" is right; "certain" is not.

CAUTIONA PowerPoint slide killed seven people

The slide is the most memorable symptom. The Board gave it a sidebar in chapter 7, but concluded that culture and structure "had as much to do with this accident" as the foam. Remove the slide but keep the question "is there a requirement?" and the outcome might well have been the same.

CAUTIONBudget cuts caused the accident

A loss of about 40 percent in purchasing power is real context. But the Board says the roots "can also be traced, in part," to the post-Cold War policy environment, and does not call it a direct cause (CAIB, chapter 5, pp. 99, 104).

CAUTIONThe heat tiles broke

The hole was in the reinforced carbon-carbon (RCC) leading edge, panel 8, not in the tiles on the orbiter's belly. Both are part of the thermal protection system, so this is only half right (CAIB, chapter 3).

CAUTIONThe crew died instantly, knowing nothing

The crew survival report (NASA, 2008): about 40 seconds passed between loss of control and cabin depressurisation, and "part of this short timeframe was undoubtedly employed in recognizing that a problem existed". After depressurisation the crew were incapacitated "within seconds". The accident "was not survivable".

FALSENASA could not have done anything to save the crew

The most repeated line. The Board wrote that had managers understood the threat, repair and rescue plans "would most likely have been developed, and a rescue would have been conceivable" (CAIB, section 6.4). The truer line: you cannot save what you refuse to look at.

FALSELight foam can't break a wing

That was also many engineers' feeling in 2003: a 17 Jan e-mail said the debris "didn't look like a big enough piece to pose any serious threat". The 7 July 2003 test fired 1.67 lb of foam at panel 8 and made a hole about 16 inches across (CAIB, section 6.3; CAIB test photo).

FALSENASA knew the orbiter was doomed and hid it from the crew

Managers believed there was no dangerous damage, so the e-mail to the crew said "absolutely no concern for entry" (CAIB, section 6.3). In 2013 Wayne Hale recalled a colleague saying "if it has been damaged, it's probably better not to know", but said "There was never any debate about what to tell the crew" (AP, 2013, secondary). The real failure was refusing to look, not hiding.

Part 5

Assessment

Scores are Mark's assessment based on the sources in Part 8, not figures from a study.

Avoidable
4/5
Warnings in advance
5/5
Transparent inquiry
5/5
Lessons retained
3/5
Done right afterwards
  • A report that named culture as a cause, on a par with foam
  • Inspection and repair of the heat shield in orbit
  • A proposed technical authority independent of the schedule
Not done right
  • The return-to-flight mission in 2005 still shed foam
  • The 1986 lessons had faded before 2003
  • People with concerns still had to find their own channel

Sources: CAIB report, chapter 7 (culture, independent technical authority) and chapter 8; CRS RS21606 (29 recommendations, 15 before return to flight); NASA, STS-114 page (26 July 2005, foam shed from the tank).

The disaster of an organisation that already had the answer in 1986, but kept it in a report instead of turning it into structure.

More: after Columbia

The Board made 29 recommendations, 15 of them required before flights resumed, including the ability to inspect and repair the thermal protection system in orbit and an independent technical authority. The return-to-flight mission, STS-114, launched on 26 July 2005. Launch imagery again showed a piece of foam coming off the External Tank, and an astronaut went outside to pull two protruding gap fillers from between the tiles.

This time, NASA looked. The Shuttle programme ended in 2011 after 135 flights and two losses: Challenger and Columbia.

Sources: CRS RS21606 (2003); NASA, STS-114 page; NASA (135 flights, 1981–2011).

Part 6

Work lesson: why organisations repeat their mistakes

For every risk report, every slide for the boss, every "known issue" on the backlog.

Four steps: keep the original name for an anomaly, make asking for data the default, put the conclusion and its limits on the first line, and turn the lesson into structure. 1 · keep the namean anomaly stays onecount it vs the spec 2 · ask for datasaying no needs a reasonnot "is it required?" 3 · conclusion first"how far out of range"send a written paper 4 · into structuresomeone independentcan stop the line A lessons-learned report is not a lesson learned. Structure is.
Each step fixes one failure from those sixteen days. Foam renamed "in-family", the imagery request met with "is there a requirement?", the 640-fold line at the bottom of a slide, and a safety office without independent authority.Source: CAIB report, sections 6.1, 6.3 and chapter 7.
Count "familiar" defects as a trendThe Board found NASA "failed to adequately perform trend analysis on foam losses", almost the sentence written about O-rings in 1986.
Ask: how far outside our data are we?A model calibrated on 3-cubic-inch pieces says nothing about a 1,920-cubic-inch one.
Give worried people a channel around the hierarchyRocha's e-mail went unsent for fear of jumping the chain of command. A good channel doesn't require courage.
Ask regularly: is the old lesson still alive?Pick your team's last big incident. What changed in the structure, not just in the documents?

Sources: CAIB report, F6.1-10 (trend analysis), section 6.3 (Crater, Rocha's e-mail). The 1986 line: "little or no trend analysis", Rogers Commission report, chapter 7.

If these persistent, systemic flaws are not resolved, the scene is set for another accident.Columbia Accident Investigation Board report, chapter 8, p. 195 (2003).
Part 7

Further reading

Columbia Accident Investigation Board, Report, Vol. I (2003)Free from NASA. Chapter 6 reads like a detective story; chapter 8 is the best Challenger comparison ever written.
Edward Tufte, The Cognitive Style of PowerPoint (2003)27 pages on how bullet points swallow an argument, with the Columbia slide as the main example.
Starbuck and Farjoun (eds.), Organization at the Limit: Lessons from the Columbia Disaster (2005)Organisation researchers, Diane Vaughan among them, on why the Challenger lessons did not hold.
Anatomy of a Disaster #01: Space Shuttle Challenger (1986)Reread the first piece after this one. Almost every line repeats.

This is the last piece in the Anatomy of a Disaster series. All ten cases are in the Vũ Trụ Khác corner of the Mark học AI site.

Part 8

Sources

Primary documents first. Anything resting only on secondary sources is flagged in the Fact check.

  1. Columbia Accident Investigation Board, Report, Vol. I, August 2003: Board Statement, chapters 3, 5, 6, 7, 8. govinfo.library.unt.edu/caib · full volume at NASA
  2. CAIB, sections 6.3 and 6.4 (in-flight decisions; rescue and repair, detailed in Vol. II, Appendix D.13), verbatim copies at Spaceflight Now. 6.3 · 6.4
  3. NASA, Columbia Crew Survival Investigation Report, SP-2008-565, December 2008. nasa.gov
  4. NASA, STS-107 and STS-114 mission pages. STS-107 · STS-114
  5. E. Tufte, The Cognitive Style of PowerPoint, Graphics Press, 2003 (quoted in CAIB chapter 7); S. Harris, "Missing the Point", GovExec, September 2004. edwardtufte.com
  6. Congressional Research Service, RS21606, synopsis of the CAIB report, September 2003. everycrsreport.com
  7. S. Borenstein (AP), "If space shuttle is doomed, do you tell the crew?", 1 February 2013 (secondary). mprnews.org
  8. Rogers Commission, Challenger report, 1986, chapters 5 and 7 (for the comparison). nasa.gov/history/rogersrep