---

---









[40] The consensus of the
Commission and participating investigative agencies is that the loss
of the Space Shuttle Challenger was caused by a failure in the joint
between the two lower segments of the right Solid Rocket Motor. The
specific failure was the destruction of the seals that are intended
to prevent hot gases from leaking through the joint during the
propellant burn of the rocket motor. The evidence assembled by the
Commission indicates that no other element of the Space Shuttle
system contributed to this failure.

In arriving at this conclusion, the Commission
reviewed in detail all available data, reports and records; directed
and supervised numerous tests, analyses, and experiments by NASA,
civilian contractors and various government agencies; and then
developed specific failure scenarios and the range of most probable
causative factors. The sections that follow discuss the results of
the investigation .



Analysis of the Accident

The results of the accident investigation and
analysis will be presented in this and the following sections.
Throughout the investigation three critical questions were central to
the inquiry, namely:

- What were the circumstances surrounding
   mission 51-L that contributed to the catastrophic termination of
   that flight in contrast to 24 successful flights preceding
   it?
- What evidence pointed to the right Solid
   Rocket Booster as the source of the accident as opposed to other
   elements of the Space Shuttle?
- Finally, what was the mechanism of
   failure?

Using mission data, subsequently completed
tests and analyses, and recovered wreckage, the Commission identified
all possible faults that could originate in the respective flight
elements of the Space Shuttle which might have the potential to lead
to loss of the Challenger. Potential contributors to the accident
examined by the Commission were the launch pad (exonerated in Chapter
IX of this report), the External Tank, the Space Shuttle Main
Engines, the Orbiter and related equipment, payload/Orbiter
interfaces, the payload, Solid Rocket Boosters and Solid Rocket
Motors.

In a parallel effort, the question of sabotage
was examined in detail and reviewed by the Commission in executive
session.There is no evidence of
sabotage, either at the launch pad or during other processes prior to
or during launch.



[41]External Tank

The External Tank contains propellants used by
the Orbiter's three main engines during Shuttle launch and ascent to
orbit. Structurally the tank is attached to and serves as the
backbone of the Orbiter and the two Solid Rocket Boosters. Three
primary structures-the liquid oxygen tank, the intertank and the
liquid hydrogen tank-comprise the configuration. (Figure 1)

The External Tank delivers oxidizer and fuel
from the propellant tanks to the Orbiter. The electrical subsystem
includes instrumentation sensors, heaters, range safety electronics
and explosives, and lightning protection and associated cabling. All
flight instrumentation and electrical power are wired directly to the
Orbiter. The thermal protection subsystem is the insulation applied
to the tank's exterior. Its function is to prevent heat leakage into
the propellants, to protect the External Tank from overheating during
flight and to minimize ice formation while the Shuttle is on the
pad.

Approximately 20 percent of the External Tank
structure was recovered after the accident and the majority of the
pieces were from the intertank and liquid hydrogen
tank.1The Commission initially considered all External Tank
systems and subsystems in identifying possible faults or failures
potentially contributing to the Challenger accident. Those potential
contributors were:

- Premature detonation of the External Tank
   range safety system
- Structural flaw
- Damage at lift-off
- Load exceedance
- Overheating

The Commission examined the possibility that
the STS 51-L accident could have been triggered by accidental
detonation of the range safety system explosives. This potential
fault was assessed using flight data, observed events, and recovered
hardware. Most of the explosive charges for the External Tank
emergency destruction system were recovered.2Examination of this material established that none of
it had exploded and thus could not have contributed to the accident
(PhotoC&D).
Flight data verified that the External Tank range safety system was
not activated .

The possibility of an imperfection existing in
either the pressurized or nonpressurized External Tank structural
elements that could grow to a sufficient size to cause structural
failure was examined in detail. All construction history, structural
qualification test data, proof test inspection records and x-rays
were reviewed. One previously....





---





---



[42] ....undetected
imperfection that was discovered during a reexamination of the x-rays
was found in recovered hardware with no propagation
indicated.3Other data from the pre-launch ice and frost team
inspections, film and video coverage, pressurization records and
flight data revealed no evidence of leakage. The Commission concluded
that no structural imperfections existed that could have grown to a
size to create a leak or cause catastrophic failure of the External
Tank.

Possible damage to the liquid hydrogen tank at
lift off was considered. The ice and frost team observed no vapor or
frost that would indicate a leak. The liquid hydrogen vent arm
retracted as expected during launch and did not recontact the tank or
solid booster.4Photo analysis and television monitoring did not
indicate that any debris contacted the tank. Therefore, damage to the
liquid hydrogen tank at lift off was determined to be highly
improbable.

The possibility that abnormally high
structural loads caused an External Tank failure was examined.
Analysis indicated that there were no excessive loading conditions
based on lift off and flight data prior to the explosion. The maximum
structural load produced was less than 80 percent of the allowable
design load.5The structural implications of vent and flow control
valve operation was examined and found not to be a factor.

The possibility of a structural failure due to
overheating was assessed with several causes postulated: high heating
due to abnormal trajectory, loss of the thermal protection system, a
hot gas leak from the Solid Rocket Motor and a liquid hydrogen leak
from the External Tank. The trajectory was normal until well after
the Solid Rocket Motor leak was observed at 58 seconds. Maximum
aerodynamic heating would not have occurred until approximately 90
seconds.6At 73 seconds, heating was well within tank component
structural capability. Based on careful review of pre-launch and
flight films and data, the Commission found no evidence that any
thermal protection foam was lost during the launch and ascent.

The possibility of a leak from the hydrogen
tank resulting in overheating was addressed. Tests indicated that
small leaks (0.037 lbs/second) would have been visible. In addition,
if there was a liquid hydrogen leak at lift off, it would have been
ignited by either the Solid Rocket Booster ignition or Space Shuttle
Main Engine ignition.7

The resultant flame would have ignited the
Solid Rocket Booster attach ring foam insulation almost immediately.
Copious quantities of dense black smoke and open flames would be
evident in such a case and would have continued for as long as the
leak burned. Smoke and flames in these quantities were not observed
at lift off nor anytime throughout the flight. It is therefore
concluded that an initial liquid hydrogen tank leak was improbable,
and that the only possible cause for overheating the tank was the
impingement of leaking Solid Rocket Motor gases. This resulted in the
ultimate breakup of the External Tank.

The recovered external foam insulation on the
External Tank was scorched and discolored in various
locations.8Burn patterns across the pieces of insulation on the
External Tank indicate that various areas were subjected to fire both
before and after the External Tank broke up in flight.

The Commission reviewed the External Tank's
construction records, acceptance testing, pre-launch and flight data,
and recovered hardware and found nothing relating to the External
Tank that caused or contributed to the cause of the
accident.



Space Shuttle Main Engines

A cluster of three Space Shuttle Main Engines
operates simultaneously with the Solid Rocket Boosters during the
initial ascent phase of flight and provides primary propulsion until
the Shuttle has attained orbital velocity. These engines use liquid
hydrogen as the fuel and liquid oxygen as the oxidizer. Both the
liquid hydrogen and oxygen are stored in the External Tank and are
transferred to the engines under pressure. During the mission the
engines operate for about 8.5 minutes.

Engine thrust is controlled by throttling and
has ranged from 65 to 104 percent of a specified thrust level. At sea
level, 100 percent equals 375,000 pounds of thrust per engine.

Pitch, yaw and roll control of the Orbiter is
provided by gimbals on each engine. Gimbaling is operated by two
hydraulic servo-actuators, one for pitch motion and the other for yaw
motion, with roll controlled by a combination of both pitch and yaw.
These servo-actuators are commanded by the Orbiter's computer.

An electronic controller is attached to the
forward end of each engine. Each controller is a self....





---





---



....contained system that monitors engine
checkout, control and status, and sends the data to the Orbiter. Each
of the three engine interface units in turn sends its data to the
Orbiter computers and relays commands from the computers to the
engines.

A propellant management subsystem of
manifolds, distribution lines and valves controls the flow of liquids
from the External Tank to the engines, and the flow of gaseous
hydrogen and oxygen from the engines into the External Tank to
maintain pressurization.

All three main engines from the Challenger,
No. 2020 in position 2, No. 2021 in position 3, and No. 2023 in
position 1, were recovered in large part on February 23, 1986, off
the Florida coast in about 85 feet of water. All parts were recovered
close to one another, and the engines were still attached to the
thrust structure.9All engine gimbal bearings had failed, apparently
because of overload on water impact.

All metallic surfaces were damaged by marine
life, except titanium surfaces or those parts that were buried under
the ocean bottom. The metal fractures, examined at 3x magnification,
showed rough texture and shear lips, which appeared to be caused by
overloads due to water impact.10No pre-accident material defects were noted.

The engine nozzles were sheared at the
manifolds. The main combustion chambers, main injectors and
preburners of each engine were attached to one another. The six
hydraulic servo-actuators used to control engine gimbaling were
attached to segments of the Orbiter thrust
structure.11

Sections of the main propulsion system fuel
and liquid oxygen feedlines and feedline manifolds were recovered, as
well as the External Tank/Orbiter disconnect assembly in the mated
configuration. A portion of the oxidizer inlet duct was attached to
the interface of engine 2020. All preburner valves were
recovered.12

The main engine controllers for both engines
2020 and 2021 were recovered. One controller was broken open on one
side, and both were severely corroded and damaged by marine life.
Both units were disassembled and the memory units flushed with
deionized water. After they were dried and vacuum baked, data from
these units were retrieved.13

All engines had burn damage caused by internal
overtemperature typical of oxygen-rich shutdown. Thus, the loss of
hydrogen fuel appears to have initiated the shutdown. The Commission
reviewed engine and ground measurements made while the three engines
were prepared for launch. Ambient temperature during pre-launch was
the coldest to date, but preflight engine data were
normal.14These data were also compared with Challenger engine
data during the flight 61-A pre-flight period. All differences seen
between the two missions were due either to planned variations in the
pre-launch sequence or the cold ambient conditions during the
preflight period for flight 51-L. These differences did not affect
engine [44] performance during the powered flight phase of the
mission.

Preflight data gave no evidence of any
propellant leaks (fuel or oxidizer) in the aft compartment. For the
powered flight phase all the parameters of the engine aft compartment
that could give an indication of a leak were selected from the
overall flight 51-L measurement list. The majority of those
parameters were either ground measurements or those recorded during
the flight but not telemetered to the ground.15Among parameters that were telemetered during the
flight were skin temperature measurements that gave no indication of
a hot gas or other leak in the engine compartment.

Analysis of the engine start data showed all
three engine starts were normal and no anomalies were found.

An assessment of the engine performance in the
final seconds of the mission before the accident was compared with
similar periods on all flights of the Challenger engines. The
assessment showed the engine performance on flight 51-L was
consistent with previous flights.16

The first abnormal engine indication was a
drop in engine fuel tank pressure at 72.564 seconds. As fuel pressure
dropped, the control system automatically responded by opening the
fuel flowrate valve. The turbine temperatures then increased because
of the leaner fuel mixture.





---





---



[45] The increased
temperature caused an increase in pump speed. This could not,
however, increase the fuel pressure because of a decrease in fuel
tank top (ullage) pressure resulting from the burned through hydrogen
tank leakage. When the fuel pump pressures dropped below 140 pounds
per square inch, the programed control system disqualified the
measured data because it was past reasonable limits. This caused the
fuel flowrate and high-pressure fuel pump discharge pressure to
decrease, while the lack of load allowed the pump's speed to
increase. The decreased fuel flow caused a drop in fuel preburner
chamber pressure, though the fuel preburner oxygen valve was then
advancing toward a more open position. The mixture ratio in the fuel
preburner became leaner, which raised high-pressure fuel turbine
discharge temperatures above the redline limits. This caused the
engine control system to start automatic shutdown of the
engine.

The engine flight history showed that engine
2023 flew four previous times while engines 2020 and 2021 had flown
five previous missions.17The flight data from flight 51-L compared well with
flight data from all previous flights.

The analysis of flight data confirmed that the
Space Shuttle Main Engines operated properly while reacting to
changing external conditions. Previous engine tests suggest that the
highpressure pumps are the most likely components to fail, because of
either bearing or turbine blade failure. There was no evidence of
either in flight 51-L. Engine operation was normal until the fuel
inlet pressure dropped. As the pressure decreased, the engine
responded in a predictable manner. Automatic shutdown of engine 2023
was verified by telemetry data. Data recovered from the salvaged
engine 2021 control computer verify that this engine also had begun
shutdown. Salvaged control computer data from engine 2020 showed that
this engine was within 20 milliseconds of shutdown when the computer
stopped.18Inspection of recovered engine hardware verified that
all engines were shut down in a fuel-lean or oxygen-rich condition
which resulted in burn through and erosion of the engine hot gas
circuits.

The Commission concluded that the Space
Shuttle Main Engines did not cause or contribute to the cause of the
Challenger accident.



Orbiter and Related Equipment

The Orbiter subsystems include propulsion and
power, avionics, structures, thermal and environmental control and
life support, mechanical and interface, and other government
furnished essential equipment. Onboard government furnished equipment
for STS 51 -L included the remote manipulator arm system,
extravehicular mobility units, extravehicular activity hardware,
television, equipment worn by the crew, storage provisions and
communication equipment.

The significant pieces of Orbiter structure
recovered included all three Space Shuttle Main Engines, the forward
fuselage including the crew module, the right inboard and outboard
elevons, a large portion of the right wing, a lower portion of the
vertical stabilizer, three rudder speed brake panels and portions of
mid-fuselage side walls from both the left and right
sides.19This represents about 30 percent of the Orbiter but
does not provide sufficient evidence to establish conclusively the
complete failure sequence of the entire Orbiter spacecraft. However,
there was sufficient evidence to establish some of the structural
failure modes that resulted in the Orbiter's destruction.

All fractures and material failures examined
on the Orbiter, with the exception of the main engines, were the
result of overload forces, and they exhibited no evidence of internal
burn damage or exposure to explosive forces. This indicated that the
destruction of the Orbiter occurred predominantly from aerodynamic
and inertial forces that exceeded design limits. There was evidence
that during the breakup sequence, the right Solid Rocket Booster
struck the outboard end of the Orbiter's right wing and right
outboard elevon. Additionally, chemical analysis indicated that the
right side of the Orbiter was sprayed by hot propellant gases
exhausting from the hole in the inboard circumference of the right
Solid Rocket Booster. Evaluation of the Orbiter main engines showed
extensive internal thermal damage to the engines as a consequence of
oxygen-rich shutdown that resulted from a depletion of the hydrogen
fuel supply. The supply of hydrogen fuel to the main engines would
have been abruptly discontinued when the liquid hydrogen tank in the
External Tank disintegrated.

The crew module wreckage was found submerged
in about 90 feet of ocean water concentrated in an area of about 20
feet by 80 feet. Portions of the forward fuselage outer shell
structure were found among the pieces of crew module
recovered.20There was no evidence of an internal explosion, heat
or fire damage on the forward....





---







---



....fuselage/crew module pieces. The crew
module was disintegrated, with the heaviest fragmentation and crash
damage on the left side. The fractures examined were typical of
overload breaks and appeared to be the result of high forces
generated by impact with the surface of the water. The sections of
lower forward fuselage outer shell found floating on the ocean
surface were recovered shortly after the accident. They also
contained crush damage indicative of an impact on the left side. The
consistency of damage to the left side of the outer fuselage shell
and crew module indicates that these structures remained attached to
each other until impact with the water.

The Orbiter investigation consisted of a
review of all Orbiter data and vehicle parts retrieved. Also reviewed
were vehicle and equipment processing records and pre-mission
analyses.

All orbital maneuvering system measurements
such as temperatures, pressures, events, commands, stimuli, and
switch positions were reviewed with all related computer data. There
were no indications of abnormal behavior. All temperature and
pressure transducers active during ascent for the reaction control
system were reviewed, including thruster chamber pressure, leak
temperature, line temperature, propellant tank, helium tank and
propellant line transducers. Nothing was found that could have
contributed to the accident.

Auxiliary power unit pressures and
temperatures were reviewed, and no abnormal conditions were observed
during ascent. Selected hydraulic measurements, including system
pressures, fluid quantities and most temperatures in the aft
compartment and in the wing cavity containing the elevon actuator
supply lines, were reviewed by the Commission, and no abnormality was
found. All fuel cells and power reactant storage and distribution
subsystem measurements were reviewed and found to be normal during
all phases of ground and flight operation prior to the accident. All
available pyrotechnic firing control circuit measurements were
reviewed, along with radiography, shear bolt review and debris
reports, ....





---





---



....and there were no unintentional firing
command indications.21All available data regarding range safety and recovery
system batteries were reviewed, and no indications were found that
the batteries were involved in initiating the accident.

Guidance, navigation and control subsystems
data were reviewed, and it appears that the subsystems performed
properly. All subsystem sensors and software apparently performed as
designed until data loss. Inertial measurement unit data from the
preflight calibration through signal loss were found to be normal.
All data processing system related data were reviewed, and nothing
significant was found. Data review of the electrical power
distribution and control subsystem indicated that its performance was
normal until the time of the accident.22All communication and tracking system parameters
active during launch were evaluated and found to be normal. No
instrumentation abnormalities were observed during the pre-launch and
launch period before signal loss.

Structures evaluation included analysis of
ground and flight data (loads, temperatures, pressures and purge
flows), hardware changes and discrepancy reports since the last
Challenger flight, and wreckage. The Commission found that no Orbiter
structural elements contributed to the accident.

Orbiter structural pre-launch temperature
measurements were evaluated and found to be within specified
limits.

Data related to the atmospheric revitalization
system, which maintains cabin atmosphere, were
evaluated.23During pre-launch, launch and until signal loss, data
indicated that both of the water coolant loops were normal, the
pressure control system functioned normally, all fans functioned
normally, and all switches and valve positions were proper.

Active thermal control subsystem data
indicated that both of the freon coolant loops functioned normally,
the ammonia boiler system was normal, and all switch and valve
positions were proper.24

The water management subsystem functioned
[48]
normally during the flight. The smoke detection and fire suppression
subsystem and airlock support subsystem both functioned normally. The
waste collection subsystem is inoperative during the launch phase,
and no data were available.25

No mechanical system abnormalities were
identified. The vent doors remained open throughout the launch. The
payload bay doors remained latched. All landing gear were up and
locked, all doors remained closed and locked, and the remote
manipulator system and payload retention system remained latched.
Film and Orbiter interface data showed that there was no premature
Orbiter/External Tank separation.

Video tapes and photographs indicated the crew
egress hatch, which caused the launch delay on the preceding day,
operated properly.

The onboard government furnished equipment
configuration and pre-launch processing were reviewed and determined
to have been flightready with no unusual or abnormal
conditions.

Based on this review and assessment, the
Commission concluded that neither the Orbiter nor related equipment
caused or contributed to the cause of the accident.



Payload/Orbiter Interfaces

Interfaces between the Orbiter and the payload
serve to attach the cargo to the Orbiter or provide services from the
Orbiter to cargo items. These interfaces are mechanical, thermal,
avionics, power and fluid systems.

The Spartan-Halley payload was located in the
front of the payload bay, attached to the equipment support structure
carrier. The Tracking and Data Relay Satellite (TDRS) was attached to
the Inertial Upper Stage (IUS) booster rocket used to move the TDRS
into geosynchronous orbit. In the aft flight deck, payload interfaces
consisted of a standard switch panel, a payload deployment and
retention system, and display and control panels for use with the
payload. Payloads in the middeck area were in the stowage lockers.
These were radiation monitoring, phase partitioning, fluid dynamics
experiments, three student experiments, the Teacher in Space Project
and the Comet Halley monitoring program.

Thermal interfaces between the Orbiter and the
payload in the aft flight deck and middeck consisted of the Orbiter's
purge, vent and fluid heat exchanger systems. Thermal interface for
TDRS/IUS, Spartan-Halley, and the experiments and projects were
provided by the Orbiter environment control and life support
system.

Electrical power and avionics were provided to
the payload through standard interface panels along both side of the
cargo bay. In the aft flight deck, the control and display panels
supplied by the Orbiter provided the avionics and power interfaces
for TDRS/IUS. The experiments and projects constituting the middeck
payload had no interfaces with avionics and power systems.

The only direct payload loads data from STS
51-L were accelerometer data recorded through the Orbiter umbilical
prior to lift off. Accelerometer data from the payload bay and the
crew cabin compared favorably with previous flights. Results indicate
that payload loads on STS 51-L were similar to those of STS-6 and
were within design levels and pre-launch predictions.

The Commission found that all payload elements
had been certified safe for flight, and records for integration of
hardware met engineering requirements. Temperatures during prelaunch
and ascent were normal. Reconstructed lift off loads were below those
used in the flight readiness certification. The relay satellite's
rate gyro data correlated with those for the Orbiter and boosters
during ascent. Fittings attaching the payloads to the Orbiter
remained in operation, as shown by telemetered data from monitoring
microswitches.

The Commission found no discrepancies in
the Orbiter/payload interface performance that might have contributed
to the Challenger accident.



Payloads, Inertial Upper Stage, and Support
Equipment

The payload bay of the Orbiter Challenger
contained a Tracking and Data Relay Satellite (TDRS) attached to an
Inertial Upper Stage (IUS) booster rocket, and associated airborne
support equipment. The IUS contained two solid rocket motors (SRMs):
SRM-1 and SRM-2. The combined weight of these components was about
40,000 pounds. About five percent of the payload, IUS, and support
equipment package was recovered from the ocean. Components recovered
included segments of the cases of both IUS SRMs, the ignition
safe/arm device for each SRM, the igniter for SRM-2, fragments of
unburned propellant from each SRM, five explosive....





---







---



.....separation bolts that secure the two SRMs
together, the forward support equipment trunnions, the aft trunnions
with spreader beams, and an undetonated section of explosive
fasteners.

There was no evidence of scorching, burning,
or melting on any of the components and structure recovered, and all
fractures were typical overload fractures. The safe arm device for
each IUS SRM was in the safe position, the five explosive SRM-1/SRM-2
separation bolts were intact, and pieces of propellant were not
burned, indicating that the SRMs had not ignited. The two aft
trunnion spreader beams were intact but were bent in the downward
direction relative to the Orbiter. The right spreader beam was
cracked and deformed about 7.5 inches, and the left spreader beam was
cracked and deformed about 1.5 inches.26These deformations indicate that the payload and upper
stage package was intact and secure in the cargo bay while being
subjected to significant inertial flight loads.

The inertial upper stage is a two-stage,
solidrocket-propelled, three-axis controlled, inertially navigated
upper stage rocket used to deliver spacecraft weighing up to
approximately 5,000 pounds from the Shuttle parking orbit to
geosynchronous orbit. It includes the stage structure; solid rocket
motors; a reaction control subsystem; avionics for telemetry,
tracking and command; guidance, navigation and control; data
management; thrust vector control; electrical power sources and
electrical cabling; and airborne software.

Assessment of possible upper stage
contribution to the accident centered on the elimination of three
possible scenarios: Premature upper stage rocket ignition,
explosion/fire in the payload bay, and payload shift in the payload
bay.

Premature ignition of either the upper stage
stage 1 and/or stage 2 motor while still in the Orbiter bay would
have resulted in catastrophic failure of the Orbiter. Potential
causes for premature ignition were electrostatic discharge,
inadvertent ignition command and auto-ignition. Each would have
caused a rapid increase in the Orbiter payload bay temperature and
pressure, and would have been immediately followed by structural
damage to the payload bay doors. The payload bay temperatures
remained essentially constant, and the Orbiter photographic and
telemetry data indicated the payload doors remained closed and
latched from lift off until signal loss.27Both indications verified that there was no ignition
of the IUS solid rocket motors.

An IUS component explosion or fire could have
damaged critical systems in the Orbiter by overheating or impact.
Five sources other than an upper stage motor pre-ignition were
identified as potential origins of a fire or explosion in the payload
bay: (1) release and ignition of IUS hydrazine from the reaction
control system tanks, (2) fire or explosion from an IUS battery, (3)
[50]
impact or rupture of a motor case and subsequent ignition of exposed
propellant, (4) fire of electrical origin due to a short, and (5)
fire or inadvertent ignition of pyrotechnic devices due to radio
frequency radiation. Thermal measurements in the propellant tank and
in components adjacent to the propellant tanks indicated no
abnormalities. Pre-launch and thermal measurements in the Orbiter
payload bay and in TDRS near the reaction control system were stable
throughout the ascent period. A fire and/or explosion resulting in
shrapnel from an IUS battery was eliminated based on pre-launch
monitoring of open circuit voltages on all batteries, except the
support equipment batteries. Location of these batteries made the
potential for damage to critical systems very small if they burned or
exploded. Motor case impact or rupture and resulting exposure and
propellant ignition was determined improbable because batteries and
reaction control system burning or explosion were eliminated by
flight data analysis. They were the only potential sources for IUS
heating and high velocity shrapnel. Propellant burning was not
indicated by payload bay thermal measurements. Electrical shorting
was eliminated as a fire source in the payload bay because IUS
electrical and Orbiter voltage monitors were normal at launch and
during STS 51-L ascent. Fires initiated by radio frequency radiation
due to inadvertent IUS, TDRS, or ground emittance were eliminated
because data showed worst case radio frequency radiation during
ascent was less than ground-emitted radiation to the payload bay
during pre-launch checkout. The ground-emitted radiation was within
specified limits.

IUS/TDRS payload shifting or breaking free
within the Orbiter due to structural failure or premature separation
was investigated. Such a shift could have resulted in severe Orbiter
damage from a direct impact, or could have induced a significant
shift in the Challenger vehicle center of gravity and possibly
affected flight control.28Four possible faults that could have led to Orbiter
damage or substantial payload shift were considered: IUS stage 2/TDRS
separation, IUS stage 1/stage 2 separation, IUS/TDRS separation from
the airborne support equipment and IUS/airborne support equipment
separation from Orbiter. All were eliminated because dynamic response
data conclusively showed that IUS/TDRS responded normally until the
final loss of data. Further, TDRS data, which pass through the IUS
stage 1/stage 2 and support equipment, were continuous until data
loss, verifying that these elements did not separate.

The TDRS spacecraft weighs approximately 4,905
pounds and is 9.5 feet in diameter and 19.5 feet long. The forward 11
feet contain six deployable appendages, two solar arrays, one
space-ground link antenna, and two single access antennas. The
spacecraft body structure consists of a payload structure and a
spacecraft structure. These structures house the tracking and
telemetry and command subsystem, power subsystem, thermal control
subsystem, ordnance subsystem, reaction control subsystem and
attitude control subsystem.

Telemetry data were transmitted from TDRS from
approximately 48 hours prior to launch through signal loss. The
telemetry system was functioning properly, and the data indicated
that the telemetry processor was in its normal operational mode and
all power supply voltages and calibration voltages were normal. There
were no changes through the countdown to the time of structural
breakup, when all telemetry abruptly halted. The telemetry tracking
and control subsystems command and tracking elements were inactive
during the countdown through ascent, and no changes were noted,
indicating that the TDRS was not commanded to alter its launch
configuration.

The TDRS power subsystem had a total of 138
telemetry indications. These were the main data source used to
determine the power subsystem activity. Analyzing this telemetry
showed all subsystem elements performed normally.

The TDRS thermal control subsystem was
designed to maintain proper temperatures primarily by passive means.
Also, there is a thermostatically controlled heater system to ensure
minimum required temperatures are maintained. The thermal subsystem
was monitored by 82 configuration status indicators and 137 analog
temperature channels. This telemetry showed that the TDRS remained in
its normal thermal configuration and experienced normal temperatures
until signal loss.

No data indicated that the IUS separated from
TDRS, that any deployable appendage ordnance had been fired or that
any appendage motion had begun.

The TDRS reaction control system was inactive
at launch and required an IUS command and two ground commands to
activate any propellant.

[51] Telemetry indicated
no valve actuation, changes in tank pressures or temperatures, or
propellant line temperature violations. Further, there was no
telemetry that would suggest a hydrazine leakage or abnormality and
no indications that the TDRS reaction control system contributed to
the accident.

During the launch phase, the attitude control
subsystem was disabled except for the gyros and associated
electronics necessary to provide the telemetry. All telemetry
parameters reflecting attitude control subsystem configuration
remained normal and unchanged during the STS 51-L pre-launch and
post-launch periods.

The TDRS was mounted in a cantilevered fashion
to the IUS by an adapter ring that provided structural,
communications and power interfaces. Structural integrity loss
indications would have been observed by interruptions in telemetry or
electrical power. TDRS telemetry during the launch phase was
transmitted by electrical cable to the IUS and interleaved with upper
stage data. If separation had occurred at either the TDRS/IUS
interface or the IUS/support equipment interface, TDRS data would
have stopped. There was no abnormal telemetry until signal loss of
all vehicle telemetry. TDRS also received power from the Shuttle via
the IUS through the same interfaces. There were no indications of
TDRS batteries coming on line. This indicates that structural
integrity at the TDRS and IUS interfaces was maintained until the
structural breakup. Additionally, an inspection of the recovered
debris gives the following indications that the TDRS/IUS remained
intact until the structural breakup. First, the separation bank
lanyards frayed at the end where they attached to the band,
indicating that the spacecraft was pulled forcefully from the
adapter. Second, the V-groove ring structure at the top of the
adapter was torn from its riveted connection to the adapter,
indicating that a strong shear existed between the spacecraft and IUS
which would only be generated if the two were still attached.
Finally, the adapter base was torn where it attached to the IUS,
again indicating high tension and shear forces. There were no
indications from telemetry or recovered debris that showed that the
structural integrity of the satellite or the satellite/stage
interface had been compromised.

The TDRS records at Kennedy were reviewed for
technical correctness and to verify that no open safety related
issues existed. There were no findings that revealed unsafe
conditions or that any safety requirements had been violated or
compromised.

A review and assessment of Spartan Halley
performance was conducted to establish any possible contributions to
the STS 51-L accident. The Spartan Halley was unpowered except for
the release/engage mechanism latch monitor. Its electrical current
was in the order of milliamps and the telemetry records obtained from
the Orbiter indicated that the latches were in the proper
configuration and thus Spartan Halley remained firmly attached during
flight. In addition, the TDRS spacecraft data indicated there was no
interaction from Spartan. Therefore, the Spartan Halley and its
support structure remained intact. The payload bay temperature in the
vicinity of Spartan was 55 degrees Fahrenheit indicating no abnormal
thermal conditions.

As a result of detailed analyses of the STS
51-L Orbiter, the payload flight data, payload recovered hardware,
flight film, available payload pre-launch data and applicable
hardware processing documentation,the
Commission concluded that the payload did not cause or contribute to
the cause of the accident.



Solid Rocket Booster

The Solid Rocket Booster comprises seven
subsystems: structures, thrust vector control, range safety,
separation, electrical and instrumentation, recovery, and the Solid
Rocket Motor.

All recovered Solid Rocket Booster pieces were
visually examined, and selected areas were extracted for chemical and
metallurgical analysis.

The exterior surfaces of the Solid Rocket
Boosters are normally protected from corrosion by an epoxy resin
compound. There were several small areas where this protective
coating was gouged or missing on the pieces recovered and, as a
result, the exposed metallic surfaces in the areas were corroded. The
damage to the protective coating was most likely the result of
detonation of the linear shaped charges and water impact. There was
no obvious evidence of major external flame impingement or molten
metal found on any of the pieces recovered. All fracture surfaces
exhibited either the characteristic markings of rapid tensile
overload, a complete bending failure due to overload, or a separation
fracture due to the detonation of the linear shaped charges.

[52] Other pieces of the
right Solid Rocket Motor aft field joint showed extensive burn
damage, centered at the 307 degree position.

Most of the Solid Rocket Motor case material
recovered contained pieces of residual unburned propellant still
attached to the inner lining of the case
structure.29The severed propellant edges were sharp, with no
unusual burn patterns. Propellant recovered with a forward segment of
the booster exhibited the star pattern associated with the receding
shape of the propellant at the front end of the Solid Rocket Motor.
There was no evidence found of propellant grain cracking or debonding
on the pieces recovered. Casting flow lines could be distinguished on
the propellant surfaces in several areas. This is a normal occurrence
due to minor differences in the propellant cast during the
installation of the propellant in the motor case structure.

Hardness tests of each piece of the steel
casing material were taken before the propellant was burned from the
piece. All of the tests showed normal hardness values.

One of the pieces of casing showed evidence of
O-ring seal tracks on the tang of the field joint. The tracks were
cleaned with hexane to remove the grease preservative that had been
applied after recovery of the piece, and samples of the track
material were removed for analysis. Chemical analysis of the track
material showed that the tracks were not composed of degraded O-ring
seal material.

The possible Solid Rocket Booster faults or
failures assessed were: structural overload, Solid Rocket Motor
pressure integrity violation, and premature linear shaped charge
detonation.

Reconstructed lift off and flight loads were
compared with design loads to determine if a structural failure may
have caused the accident. The STS 51-L loads were within the bounds
of design and capability and were not a factor. Photographic and
video imagery confirmed that both Solid Rocket Boosters remained
structurally intact until the time of the explosion except for the
leak observed on right Solid Rocket Motor.

The possibility that the range safety system
prematurely operated, detonating the linear shaped charges was
investigated. The linear....





---







---







|Aft ET/SRB Struts                                           | Measured Net Load                                           | Reconstructed                                               | Design Loads                                               
|----------------------------------------------------------- | ----------------------------------------------------------- | ----------------------------------------------------------- | -----------------------------------------------------------
|.                                                          
|STS 1
            
            (LBfx
            103) | STS 2
            
            (LBfx
            103) | STS 3
            
            (LBfx
            103) | STS 5
            
            (LBfx
            103)
|.                                                          
|P8                                                          | -86                                                         | -93                                                         | -78                                                        
|P9                                                          | 142                                                         | 126                                                         | 141                                                        
|P10                                                         | -150                                                        | -128                                                        | -105                                                       
|P11                                                         | -93                                                         | -75                                                         | -71                                                        
|P12*                                                        | 137                                                         | 138                                                         | 124                                                        
|P13                                                         | -172                                                        | -108                                                        | -111                                                       



.....shaped charges were photographically
observed to destroy both Solid Rocket Boosters at 110 seconds after
launch when commanded to do so by the Range Safety Officer and
therefore could not have discharged at 73 seconds after launch
causing the accident. The possibilities of the Solid Rocket Boosters
separating prematurely from the External Tank, the nozzle exit cone
prematurely separating or early deployment of the recovery system
were examined. Premature activation of the separation system was
eliminated as a cause of failure based on telemetry that showed no
separation commands. There were no indications that the nozzle exit
cone separated. The recovery system was observed photographically to
activate only after the Solid Rocket Boosters had exited the
explosion.

In addition to the possible faults or
failures, STS 51-L Solid Rocket Booster hardware manufacturing
records were examined in detail to identify and evaluate any
deviations from the design, any handling abnormalities or incidents,
any material usage issues, and/or other indication of problems that
might have importance in the investigation.Based on these observations, the Commission concluded
that the left Solid Rocket Booster, and all components of the right
Solid Rocket Booster, except the right Solid Rocket Motor, did not
contribute to or cause the accident.



The Right Solid Rocket Motor

As the investigation progressed, elements
assessed as being improbable contributors to the accident were
eliminated from further consideration. This process of elimination
brought focus to the right Solid Rocket Motor. As a result, four
areas related to the functioning of that motor received detailed
analysis to determine their part in the accident:

- Structural Loads Evaluation
- Failure of the Case Wall (Case
   Membrane)
- Propellant Anomalies
- Loss of the Pressure Seal at the Case
   Joint

Where appropriate, the investigation
considered the potential for interaction between the areas.



Structural Loads Evaluation

Structural loads for all STS 51-L launch and
flight phases were reconstructed using testverified models to
determine if any loading condition exceeded design limits.

Seconds prior to lift off, the Space Shuttle
Main Engines start while the Solid Rocket Boosters are still bolted
to the launch pad. The resultant thrust loads on the Solid Rocket
Boosters prior to lift off were derived in two ways: (1) through
strain gauges on the hold-down posts, and (2) from photographic
coverage of Solid Rocket Booster and External Tank tip deflections.
These showed that the hold-down post strain data were within design
limits. The Solid Rocket Booster tip deflection ("twang") was about
four inches less than seen on a previous flight, STS-6, which carried
the same general payload weight and distribution as STS 51-L. The
period of oscillation was normal. These data indicate that the Space
Shuttle Main....





---







---



...Engine thrust buildup, the resulting forces
and moments, vehicle and pad stiffness, and clearances were as
expected. The resultant total bending moment experienced by STS 51-L
was 291 x 106inch-pounds, which is within the design allowable
limit of 347 x 106inch-pounds.

The STS 51-L lift off loads were compared to
design loads and flight measured loads for STS-1 through STS-7
(Figure 9). The Shuttle strut identification is shown inFigure 10. The loads measured on the struts are good indicators
of stress since all loads between Shuttle elements are carried
through the struts. The STS 51-L lift off loads were within the
design limit.

Because the Solid Rocket Motor field joints
were the major concern, the reconstructed joint loads were compared
to design loads. Most of the joint load is due to the booster's
internal pressure, but external loads and the effects of inertia
(dynamics) also contribute. The Solid Rocket Motor field joint axial
tension loads at lift off were within the design load limit (17.2 x
106pounds). The highest load occurred at the forward field joint, 15.2 x
106pounds. The midjoint load was 13.9 x 106pounds, while the
aft joint showed 13.8 x 106pounds load.

Loads were constructed for all in-flight
events, including the roll maneuver and the region of maximum dynamic
pressure. A representative measure of these loads is the product of
dynamic pressure (q) and the angle of attack (a) [Greek letter
alpha]. Since the Shuttle is designed to climb out at a negative
angle of attack, the product is a negative number. The loads in the q
x a pitch plane are shown inFigure 11. Although the q x a variations in loads due to wind
shear were larger than expected, they were well within the design
limit loads.

The Solid Rocket Motor field joint axial
tension loads were substantially lower at maximum dynamic pressure
than at lift off: 11.6 x 106pounds for the
forward field joint and 10.6 x 106pounds for the aft
field joint. Compared to the internal pressure loads, the dynamic
variations due to wind shear were small-about 1/15 those of the
pressure loads. These loads were well below the design limit loads
and were not considered the cause of the accident.





---







---



Case Membrane Failure

The case membrane is the half-inch thick steel
wall of the rocket between the joints. The possibility that the
failure was initiated by anomalies associated with the case membrane
was evaluated by analysis of design and test criteria. Potential
failure modes were constrained by the following flight data and
photographic observations:

> (1) A burn through the membrane
> would have to occur at or near the aft field joint.
> 
> (2) The failure could have little or no
> influence on motor internal pressure since no deviation in pressure
> occurred prior to 60 seconds.
> 
> (3) The failure must cause a burn through the
> membrane in 58 seconds.

The hypothesis of a membrane failure requires
that the initial smoke observed at 0.678 seconds was an independent
occurrence. It is an unlikely hypothesis for initiation of the
accident. Fracture mechanics analysis indicates that a hole in
the....





---







---



---







---



.....case larger than one inch would cause the
entire case to rupture in a few milliseconds. This would give rise to
the appearance of a large longitudinal flame, an event that is
contrary to the flight films.

Evaluation of potential insulation or
inhibitor (seeFigure
12) flaws against the three criteria
above resulted in elimination of all candidates except a defect in
the forward-facing inhibitor. This potential failure mode was
evaluated by assuming a 1-inch-diameter hole in the inhibitor.
Analysis indicated that the change in motor internal pressure
resulting from this failure would probably not be detected. However,
an erosion rate substantially higher than the observed values would
be required to burn through the membrane by 58 seconds. In addition,
the assumed flaw is unlikely since the inhibitor is constructed by
vulcanizing eight individual plies of the material. Subsequent damage
of the magnitude required is improbable and would be easily
detected.

A review of the segment inspection and of
proof tests was conducted. Prior to vehicle assembly, each segment
was pressurized to 112 percent of the maximum design operational
pressure. A magnetic particle inspection of each membrane was then
conducted. These procedures are designed to screen critical flaws,
and are capable of detecting cracks greater than 0.1 inches. Fracture
mechanics analysis indicates that a flaw 0.1 inch long and 0.050 inch
deep would grow to only 0.122 inches long and 0.061 inches deep in 80
uses of the segment. This flaw would be less than the critical size
required to cause case rupture. Furthermore, as noted previously, a
failure resulting in a case rupture is not consistent with
photographic observations.

Subsequent to these evaluations, sections of
the right Solid Rocket Motor case containing holes burned through in
the area of the aft field joint were recovered.Assessments of the sections do not support a failure
that started in the membrane and progressed slowly to the joint, or
one that started in the membrane and grew rapidly the length of the
Solid Rocket Motor segment.



Propellant

An examination of propellant characteristics
and flight data was accomplished to determine if any anomalous
conditions were present in the STS 51-L right Solid Rocket Motor.
Propellant cracking and propellant mean bulk temperatures were
evaluated.

Historically, the propellant family used in
the Solid Rocket Motor (TP-H1148) has exhibited good mechanical
properties and an absence of grain structural problems. Should a
crack occur, [57] however, the effects would be evident by changes in
chamber pressure. Shortly after lift off, the STS 51-L right Solid
Rocket Motor chamber pressure was 22 pounds per square inch higher
than that of the left solid. This would correlate to a postulated
radial crack through the grain spanning a 90-degree, pie-shaped wedge
of the solid. However, with a crack of this nature, the chamber
pressure would have remained high for approximately 60 seconds.
Telemetry shows that the right Solid Rocket Motor chamber pressure
did not remain high past 20-24 seconds and, therefore, the existence
of a propellant crack was ruled out.

Propellant mean bulk temperature calculations
were made using the ambient temperature over the two-week period
prior to launch. The lowest bulk temperature experienced was 57
degrees Fahrenheit on the day of the launch. This was 17 degrees
Fahrenheit above the minimum specified.

Based on this assessment and subscale
lot-acceptance motor-firing evaluations,it is improbable that propellant anomalies contributed
to the STS 51-L accident.



Joint Seal Failure

Enhanced photographic and computer-graphic
positioning determined that the flame from the right Solid Rocket
Booster near the aft field joint emanated at about the 305-degree
circumferential position. The smoke at lift off appeared in the same
general location. Thus, early in the investigation the right Solid
Rocket Booster aft field joint seal became the prime failure suspect.
This supposition was confirmed when the Salvage Team recovered
portions of both sides of the aft joint containing large holes
extending from 291 degrees to 318 degrees. Several possible causes
could have resulted in this failure. These possible causes are
treated in the following paragraphs of this report.

During stacking operations at the launch site,
four segments are assembled to form the Solid Rocket Motor. The
resulting joints are referred to as field joints, located as depicted
in Figures8and13. Joint sealing is provided by two rubber O-rings with
diameters of 0.280 inches (+0.005, -0.003), which are installed, as
received from Morton Thiokol, during motor assembly. O-ring static
compression during and after assembly is dictated by the width of the
gap between the tang and the inside leg of the clevis. This gap
between the tang and clevis at any location after assembly is
influenced by the size and shape (concentricity) of the segments as
well as the loads on the segments. Zinc chromate putty is applied to
the composition rubber (NBR) insulation face prior to assembly. In
the assembled configuration the putty was intended to act as a
thermal barrier to prevent direct contact of combustion gas with the
O-rings. It was also intended that the O-rings be actuated and sealed
by combustion gas pressure displacing the putty in the space between
the motor segments (Figure
14). The displacement of the putty
would act like a piston and compress the air ahead of the primary
O-ring, and force it into the gap between the tang and clevis. This
process is known as pressure actuation of the O-ring seal. This
pressure actuated sealing is required to occur very early during the
Solid Rocket Motor ignition transient. because the gap between the
tang and clevis increases as.....





---







---



[58] ....pressure loads
are applied to the joint during ignition. Should pressure actuation
be delayed to the extent that the gap has opened considerably, the
possibility exists that the rocket's combustion gases will blow by
the O-ring and damage or destroy the seals. The principal factor
influencing the size of the gap opening is motor pressure; but, gap
opening is also influenced by external loads and other joint
dynamics. The investigation has shown that the joint sealing
performance is sensitive to the following factors, either
independently or in combination:

> (a) Damage to the joints/seals or
> generation of contaminants as joints are assembled as influenced
> by:
> 
> (1) Manufacturing tolerances.
>    
>    (2) Out of round due to handling.
>    
>    (3) Effects of reuse.
> 
> (b) Tang/clevis gap opening due to motor
> pressure and other loads.
> 
> (c) Static O-ring compression.
> 
> (d) Joint temperature as it affects O-ring
> response under dynamic conditions (resiliency) and hardness.
> 
> (e) Joint temperature as it relates to forming
> ice from water intrusion in the joint.
> 
> (f) Putty performance effects on:
> 
> (1) O-ring pressure actuation
>    timing.
>    
>    (2) O-ring erosion.

The sensitivity of the O-ring sealing
performance to these factors has been investigated in extensive tests
and analyses. The sensitivity to each factor was evaluated
independently and in appropriate combinations to assess the potential
to cause or contribute to the 51-L aft field joint failure. Most of
the testing was done on either laboratory or subscale equipment. In
many cases, the data from these tests are considered to be directly
applicable to the seal performance in full scale. However, in some
cases there is considerable uncertainty in extrapolating the data to
full-scale seal performance. Where such is the case, it is noted in
the following discussions.



Assembly
Damage/Contamination

It is possible that the assembly operation
could influence joint sealing performance by damaging the O-rings or
by generating contamination. The shapes of the solid rocket segments
which include the tang and clevis, are not perfect circles because of
dimensional tolerances, stresses, distortions.....





---







---



[59] ....from previous
use, and the effects of shipping and handling. The most important
effect is from the load of propellant, a plastic and rubbery
material, which can take a set that relaxes very slowly. For example,
since the segments are shipped in a horizontal position on railroad
cars, their weight can make them somewhat elliptical-a shape they can
maintain for some time. At assembly, after the lower segment (with
the clevis on top) is placed vertically, the tang of the next segment
is lowered into it. To make the fit easier, the upper segment is
purposely reshaped by connecting the lifting crane in an appropriate
position and, on occasion (51-L was one of these), directly squeezing
the tang section with a special tool. To monitor the fit, the
diameters of the clevis, DC, and the tang,
DT(Figure 15) are measured at six positions 30 degrees apart, and
difference of these measurements (DT- DCare noted. When
these differences are such that the tang encroaches somewhat into the
outer clevis, slanted edges (chamfers) permit the pieces to slide
together. If the difference is too great, flat areas of the tang meet
flat areas of the clevis. What really counts, of course, are
differences of radii, which diameter measurements alone do not
determine, for one does not know during the assembly how far off the
centers are. This is a circumstance to be avoided, but one that can
be detected during assembly. Experience has shown that a diameter
difference of less than + 0.25 inches usually permits assembly
without a flat-on-flat condition arising. A negative diameter
difference means the tang encroaches on the inside of the clevis. The
possibility was noted that contaminants from sliding metal and direct
O-ring pinching might occur if this overlap is large. If it is too
great, a flat-on-flat condition can arise inside the joint where it
is very difficult to see. These dimensions shift as the pieces slide
together and they change further as the propellant stresses relax
during the period between assembly and launch. Therefore, a condition
such as that which occurred during assembly of the aft segment for
flight 51-L, wherein the maximum interference between tang and clevis
at the O-rings was at approximately 300 degrees, may or may not have
persisted until launch-seven weeks after assembly.

The O-rings are heavily greased to prevent
damage. This grease adds another element of uncertainty to the
configuration and action of the seal under pressurization, especially
at low temperatures.

Testing was conducted during the investigation
to evaluate the potential for assembly damage and contaminant
generation, and its effect on seal performance. A sub-scale section
of a field joint was configured in a test fixture and simulated
assembly operations were conducted. This section was much stiffer
than the full-scale booster segments and did not fully simulate
actual assembly conditions. However, under these test circumstances,
metal slivers were generated during situations wherein the tang flat
overlapped the flat end of the clevis leg by 0.005 to 0.010 inches.
The metal slivers in turn were carried into the joint and deposited
on and around the O-rings. A second finding from this test series was
that the O-ring section increased in length as the tang entered the
clevis and compressed the O-ring diameter. The implication of this
finding is that canted tang entry in a full diameter segment, while
unlikely, could chase the O-ring around the circumference, resulting
in gathering (bulging from the groove) on the opposite side. This
could make the O-ring more vulnerable to damage. There is no known
experience of such bulging during previous assemblies.

To understand the effects of potential
contaminants on sealing performance, tests were conducted employing
metal contaminants simulating those generated in the segment assembly
tests. The tests were to determine if joints with metal shavings
positioned between the O-ring and sealing surface could pass a static
leak check but fail under dynamic conditions. The contaminants that
passed the 50 pounds per square inch leak check were between 0.001
and 0.003 inches thick. Testing to determine seal performance under
dynamic conditions with these representative contaminations is not
complete. However, the possibility cannot be dismissed that
contamination generated under some assembly conditions could pass a
leak check and yet cause the seal to leak under dynamic
conditions.

A second concern was structural damage to the
clevis due to abnormal loading during assembly. An analysis was made
to determine the deflections and stresses experienced during assembly
of the right Solid Rocket Motor aft center segment to the aft
segment. These stresses were then used in a fracture mechanics
analysis of the O-ring groove to determine the maximum flaw size that
would not fail under the 51-L case segment life cycle history.
Included in this analysis was the single point load needed to deflect
a suspended [60] segment to the side by 0.200 inches, and the maximum
stress on the case clevis that this causes. The analysis further
addressed a condition that has been encountered, where the tang sits
on top of the inner clevis leg on one side and slips down into the
clevis groove on the opposite side.

The result of this analysis is that the
stresses induced during the operation were low and would not have
resulted in hardware damage. Also, the stresses would have resulted
in significant growth of an undetected flaw, which then would be
detectable by inspection on its next use.



Gap Opening

The gap to be sealed between the tang and the
inside leg of the clevis opens as the combustion gas pressure rises.
This gap opening was calculated as a function of pressure and time by
an analysis that was calibrated to joint deflections measured on a
structural test article. The analysis extended the results beyond
test calibration conditions to include propellant effects and
external loads. The initial static gap dimensions combined with the
time history of the gap opening determined the minimum and maximum
gap conditions used for testing the capability of the O-rings to
seal.

The joint deflection analysis established time
histories for gap openings for primary and secondary O-rings for all
field joints. For the aft field joints these data indicate gap
opening increases of approximately 0.029 inches and 0.017 inches for
the primary and secondary O-rings respectively. These values were
used for sub-scale dynamic tests. Due to differences in motor
pressure and loads, the gap opening increases for forward field
joints are approximately 0.008 inches greater than for the aft field
joints. Gap opening changes (called delta gap openings) versus time
are shown inFigure
17for the aft field joints. The total
gap at any time also depends on the initial static gap, on rounding
effects during segment pressurization, and on loadings due to struts
and airloads. Sub-scale tests were run containing combinations of the
above variables, but did not include the effects of the struts and
airloads.





---

|                                                                                                                                                                                                                                                  |                                                                                                                                                                                                                                                                                  | 
|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | 
|Figure 16.Pressurized Joint Deflection. Drawings show how tang/clevis joint deflects
         during pressurization to open gap at location of O-ring
         slots. Inside of motor case and propellant are to left in
         sketches. | Figure 17.Right Hand SRM Aft Field Joint Primary And
         Secondary Delta Gap Opening.
         Graph plots changes in right booster's aft field joint
         primary and secondary gap openings. Horizontal scale is time
         in milliseconds from ignition.

---



---









O-Ring Compression at Launch
(Static)

As noted previously, diameters measured just
prior to assembly do not permit determination of conditions at launch
because, among other things, the propellant slowly relaxes. For STS
51-L, the difference in the true diameters of the surfaces of tang
and clevis measured at the factory was 0.008 inches. Thus, the
average gap at the O-rings between the tang and clevis was 0.004
inches. The minimum gap could be somewhat less, and possibly
metal-to-metal contact (zero gap) could exist at some
locations.

During the investigation, measurements were
made on segments that had been refurbished and reused. The data
indicate that segment circumferences at the sealing surfaces change
with repeated use. This expectation was not unique to this
joint.

Recent analysis has shown and tests tend to
confirm that O-ring sealing performance is significantly improved
when actuating pressure can get behind the entire face of the O-ring
on the upstream side of the groove within which the O-ring sits
(Figure 18). If the groove is too narrow or if the initial
squeeze is so great as to compress the O-ring to the extent that it
fills the entire groove and contacts all groove surfaces, pressure
actuation of the seal could be inhibited. This latter condition is
relieved as the joint gap opens and the O-ring attempts to return to
its uncompressed shape. However, if the temperature is low,
resiliency is severely reduced and the O-ring is very slow in
returning towards its original shape. Thus, it may remain compressed
in the groove, contact all three surfaces of that groove, and inhibit
pressure actuation of the seal. In addition, as the gap opens between
the O-ring and tang surface allowing pressure bypass, O-ring
actuation is further inhibited.

Two sub-scale dynamic test fixtures were
designed and built that simulated the initial static gap, gap opening
rate, maximum gap opening and ignition transient pressures. These
fixtures were tested over a temperature range with varying initial
static gap openings. A summary of results with initial gap openings
of 0.020 and 0.004 inches is provided inFigure 19. The results indicate that with a 0.020-inch maximum
initial gap, sealing can be achieved in most instances at
temperatures as low as 25 degrees Fahrenheit, while with the
0.004-inch initial gap, sealing is not achieved at 25 degrees
Fahrenheit and is marginal even in the 40 and 50 degree Fahrenheit
temperature range. For the 0.004-inch initial gap condition, sealing
without any gas blow-by, did not occur consistently until the
temperature was raised to 55 degrees Fahrenheit. To evaluate the
sensitivity to initial gap opening, tour tests were conducted at 25
degrees Fahrenheit with an initial gap of 0.010 inch. In contrast to
the tests at a 0.004 inch gap, these tests resulted in sealing with
some minimal O-ring blow-by observed during the sealing
process.

These tests indicate the sensitivity of the
O-ring seals to temperature and O-ring squeeze in a joint with the
gap opening characteristics of the Solid Rocket Motors.

It should be noted that the test fixture
placed....





---









.....the O-rings at a specific initial gap and
squeeze condition uniformly around the circumference. It is not
certain what the effect of differences in circumferential gaps might
be in full size joints. Such effects could not be simulated in the
subscale test results reported above.



Joint Temperature

Analyses were conducted to establish STS 51-L
joint temperatures at launch. Some differences existed among the six
51-L field joints. The joints on the right Solid Rocket Motor had
larger circumferential gradients than those on the left motor at
launch. It is possible that the aft field joint of the right Solid
Rocket Booster was at the lowest temperature at launch, although all
joints had calculated local temperatures as low as 28 +/- 5 degrees
Fahrenheit. Estimated transient temperature for several
circumferential locations on the joints are shown for the right Solid
Rocket Motor aft field joint and the left motor aft field joint inFigures 20and21.
These data are representative of other joints on the respective Solid
Rocket Motors.

The investigation has shown that the low
launch temperatures had two effects that could potentially affect the
seal performance: (1) O-ring resiliency degradation, the effects of
which are explained above; and (2) the potential for ice in the
joints. O-ring hardness is also a function of temperature and may
have been another factor in joint performance.

Consistent results from numerous O-ring tests
have shown a resiliency degradation with reduced temperatures.Figure 23provides O-ring recovery from 0.040 inches of initial
compression versus time. This shows how quickly an O-ring will move
back towards its uncompressed shape at temperatures ranging from 10
to 75 degrees Fahrenheit. When these data are compared with the gap
openings versus time fromFigure 17, it can be seen that the O-rings will not track
or.....





---



|                                                                                                                                                                                                                                                   |                                                                                                                                                                                                                                                  | 
|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | 
|Figure 20.Aft Right Segment Temperatures for STS
         51-L. Temperature model for
         51-L right solid booster aft segment circumferential
         positions from 16.5 hours prior to launch to 3.5 hours after
         launch. | Figure 21.Aft Left Segment Temperatures for STS
         51-L. Temperature model for
         51-L left solid booster aft segment circumferential
         positions from 16.5 hours prior to launch to 3.5 hours after
         launch.

---

[64]Field Joint Distress

|Flight   | Joint | SRB (right or left) | Angular location | Joint Temp
            (°F) | Previous Use of Segments
            (2) | Type of Distress
|-------- | ----- | ------------------- | ---------------- | ----------------------------- | ------------------------------------------ | ----------------
|.       
|STS-2    | AFT   | RH                  | 090              | 70                            | none/none                                  | Erosion         
|41-B     | FWD   | LH                  | 351              | 57                            | 1/none                                     | Erosion         
|41-C     | AFT   | LH                  | n/a              | 63                            | 1/1                                        | O-ring heat     
|41-D     | FWD   | RH                  | 275/110          | 70                            | 2/none                                     | Erosion         
|51-C     | FWD   | LH                  | 163              | 53                            | 1/none                                     | Erosion         
|51-C (3) | MID   | RH                  | 354              | 53                            | 1/1                                        | Erosion         
|61-A     | MID   | LH                  | 36-66            | 75                            | none/none                                  | Blow-by         
|61-A     | AFT   | LH                  | 338/018          | 75                            | none/none                                  | Blow-by         
|61-C     | AFT   | LH                  | 154              | 58                            | 1/none                                     | Erosion         
|51-L     | AFT   | RH                  | 307              | 28                            | 1/2                                        | Flame           





.....recover to the gap opening by 600
milliseconds (gap full open) at low to moderate temperatures. These
data show the importance of timely O-ring pressure actuation to
achieve proper sealing.

It is possible that water got into some, if
not all STS 51-L field joints. Subsequent to the Challenger accident,
it was learned that water had been observed in the STS-9 joints
during restacking operations following exposure to less rain than
that experienced by STS 51-L. It was reported that water had drained
from the STS-9 joint when the pins were removed and that
approximately 0.5 inch of water was present in the clevis well. While
on the pad for 38 days, STS 51-L was exposed to approximately seven
inches of rain. Analyses and tests conducted show that water will
freeze under the environmental conditions experienced prior to the
51-L launch and could unseat the secondary O-ring. To determine the
effects of unseating, tests were conducted on the sub-scale dynamic
test fixture at Thiokol to further evaluate seal performance. For
these tests, water was frozen downstream of the secondary O-ring.
With ice present, there were conditions under which the O-ring failed
to seal.



Putty Performance

The significance of the possibility that putty
could keep the motor pressure from promptly reaching the O-rings to
pressure actuate and seal them was apparently not fully appreciated
prior to the Challenger accident. During the investigation, it became
evident that several variables may affect the putty performance and,
in turn, seal performance. However, limited test data and lack of
fidelity in full scale joint simulation prevented a complete
engineering assessment of putty performance. Tests were conducted
over a range of putty conditions, including temperature at ignition,
pretest conditioning to simulate the environmental effects, and
dimensional variations within the joint. These test results
demonstrated that putty performance as a pressure seal is highly
variable. The results may be interpreted to indicate that the putty
can maintain pressure during the ignition transient and prevent
O-ring sealing. For example, one test conducted with putty, which had
been conditioned for 10 hours at 80 percent relative humidity and 75
degrees Fahrenheit, delayed the pressure rise at the primary O-ring
for 530 milliseconds at a....





---







---



.....temperature of 75 degrees. Tests at 20
degrees Fahrenheit with similarly conditioned putty delayed the
pressurization time by 1.9 seconds. Such delays would allow full
joint gap opening before a seal could pressure actuate.

To evaluate this effect, a sub-scale test
fixture was fabricated that effectively simulated gap opening at the
time of putty rupture and pressure application. The tests simulate
the O-ring pressure actuation delay due to the putty temporarily
holding the motor pressure. They were conducted over a range of
temperatures, putty rupture time and initial O-ring squeeze. Test
results (Appendix L, Fig. 6.5.1) demonstrated that sealing
performance is dependent on temperature and initial squeeze, both of
which affect the pressure actuation capability of the O-rings. The
tests indicate that sealing capability is marginal for maximum
squeeze conditions, i.e., a 0.004-inch gap, at 50 degrees Fahrenheit
with a pressure delay of 500 milliseconds. For the temperature and
O-ring squeeze conditions that existed for several of the STS 51-L
field joints, O-ring sealing was not achieved in these tests with
simulated putty rupture times delayed to 250 to 500
milliseconds.

Note that the sub-scale tests do not
faithfully reproduce what happens in the real joint. These data do
indicate, however, that the potential exists for O-rings not to seal
as a result of variables related to the putty.

The seal is checked by pressurizing the volume
between the primary and secondary O-rings. This action seats the
secondary seal and drives the primary seal upstream into its groove.
Because of concern that the putty could mask a leaking primary seal,
the pressure was first increased from [66] 50 psi to 100 psi
and then to 200 psi. The consequence of increasing the pressure is
shown below.





|.            | Stabilization Pressure,
         psi | Number of Flights | Percentage of Flights With
         O-ring Anomalies.
|------------ | -------------------------------------- | ----------------- | -------------------------------------------------------
|.           
|Field Joint  | 50                                     | 7                 | 14                                                     
|100          | 2                                      | 0                
|200          | 15                                     | 56               
|Nozzle joint | 50                                     | 8                 | 12                                                     
|100          | 8                                      | 56               
|200          | 8                                      | 88               

Clearly the increased pressure used in the
leak check increased the likelihood of a gas path through the putty
to the primary seal. That is, with increased pressure, blow holes in
the putty are more likely with a resulting greater potential for
erosion damage to the O-ring. On the positive side the blow holes
tend to prevent the delay in pressurization discussed in the previous
paragraphs. This further illustrates the influence of putty variables
on the performance of the Solid Rocket Motor seals.



The Dynamic Characteristics of the Field
Joint Seal

The discussion of static factors which affect
joint performance is based on the assumption that motor segments
remain perfectly round, and that stacked segments are always a
perfectly straight column. At launch the boosters are subjected to
forces which bend and twist them. These forces cause physical changes
in the shape of the boosters, actually squashing them out-of-round
and bending them along their entire length. The dynamic effects of
this out-of-roundness are most significant just after booster
ignition when the hold-down bolts have been released because in the
previous 6.6 seconds the boosters have actually been bent forward by
the thrust from the main engines. The elastic energy stored in the
entire system is then released, inducing a bending vibration in the
boosters. This bending causes the case to change its shape from
circular to elliptical, the maximum out-of-roundness occurring on the
045-315 degree line on the outside of the right booster. This
deflection is a consequence of a vibration and occurs at a frequency
of about 3 cycles per second. The same occurs in the left booster,
only the deflection axis is oriented differently, being a mirror
image of that which takes place in the right side. The dynamic
effects cause an increase in the joint rotation, and, hence, increase
the gap between the tang and clevis by about 10 percent. Another
dynamic load results from the geometry of the struts which attach the
booster to the external tank. Strut P 12 is attached to the booster
at about the 314 degree point and imposes additional inertial forces
on the booster which tend to additionally increase the gap by 10 to
21 percent.



Analysis of the Wreckage

The investigation of the sequence of events
that led to the final breakup of the Challenger rests upon three
primary sources of data: launch photographs, telemetry and tracking
data, and the recovered pieces of the Shuttle wreckage. The third
source of data is presented here, which is largely descriptive. It
provides support for the conclusions reached through use of the data
from the other two sources. A more detailed analysis that provides
technical details to be used for subsequent redesign or accident
analysis is available in the appendix.

Figure 24shows an overview of the search areas with the general
location of parts of both the left and the right Solid Rocket
Boosters indicated. The area is at the edge of the Gulf Stream in
water depth that ranged from 100 to 1,200 feet. Pertinent pieces were
examined by use of a remotely controlled submarine containing a flood
light and a television camera. The television picture was available
on ship board and was transmitted to Kennedy and to Marshall. The
arrangement allowed a number of people who were familiar with the
Solid Rocket Booster to comment upon the merit of recovering a
particular piece.

The aft left side of the Orbiter contained its
original paint markings and showed no apparent sign of heat damage
(photoA. All photo references are to color section, pp.
74-81). Thermal distress, however, was apparent on the right rudder
speed brake panel and elevon (photoB). The
paint was scorched and blackened on the right side panels of the aft
part of the fuselage and vertical fin. The remaining recovered parts
of the Orbiter did not seem to be affected by a hydrogen fire. The
bottom side of the right wing showed some indentation on the tiles
that make up the Thermal Protection System. This indentation
was.....





---









....consistent with impact with the right
booster as it rotated following loss of restraint of one or more of
its lower struts.

The frustum of the nose cone of the right
Solid Rocket Booster was damaged (photoE) as if
it had struck the External Tank, but there were no signs of thermal
distress. The frustum of the nose cone of the left Solid Rocket
Booster (photoF) was
essentially undamaged.

A substantial part of the External Tank was
recovered. Analysis of this recovered structure showed some
interesting features. Interpretation of the photographs suggests that
the flame from the right hand Solid Rocket Booster encircled the
External Tank. A short time later the dome at the base of the
External Tank was thought to break free. Since the internal pressure
of the liquid hydrogen tank is at approximately 33 pounds per square
inch, a sudden venting at the aft section will produce a large
initial thrust that tails off as the pressure drops. The intertank
region of the wreckage contained buckling in the fore and aft
direction consistent with this impulsive thrust. Similarly, the right
side of the intertank showed signs of crushing. This crushing is
consistent with the rotational impact of the frustum of the right
Solid Rocket Booster with the External Tank following complete loss
of restraint at the aft lower strut attachment area.

The telemetered signals from the rate gyros in
the right Solid Rocket Booster clearly show a change in angular
velocity of the booster with respect to the Orbiter. It is believed
that this velocity change was initiated by a failure at or near the
P12 strut connecting the booster to the External Tank. Photographs of
the flight could not define the failure point and none of the
connecting struts to the right Solid Rocket Booster or the
corresponding area on the External Tank in this region were
recovered. Therefore the exact location of initial separation could
not be determined by the evidence. At the time of relative booster
movement, the hole in the shell of the right Solid Rocket Booster was
calculated to be six to eight inches in diameter located 12 to 15
inches forward and adjacent to the P12....





---









....strut. This location was within the center
of the burned out zone on the right Solid Rocket Booster (photoG). As a matter of interest, the P12 strut is located
close to the point on the circumference where the booster case
experiences maximum radial deflection due to flight loads. It seems
likely that the plume from the hole in the booster would impact near
the location of the P12 strut connection and the External Tank. Using
geometric considerations alone suggests this strut separated from the
External Tank before it separated from the right hand Solid Rocket
Booster.

Figure 25shows a sketch of an interior unrolled view of the aft
part of the right hand Solid Rocket Booster with the recovered burned
pieces 131 and 712 noted. The critical region is between parts 131,
the upper segment tang region, and part 712, the lower clevis region
of the joint. This burned area extends roughly from station 1476, in
the upper section, to 1517 on the lower region. In a circumferential
direction (seefigure
26) the lower end of the eroded region
extends from roughly 291 degrees to 320 degrees and the upper eroded
section extends between 296 and 318 degrees. Note that the region at
about 314 degrees includes the attachment region of the strut to the
attachment ring on the right Solid Rocket Booster.

Some observations were made from a detailed
examination of the aft center section of the joint, contact 131. This
piece (photoI) shows
a large hole that is approximately centered on the.....





---









...307-degree circumferential position.
Although irregular, the hole is roughly rectangular in shape,
extending approximately 27 inches circumferentially along the tang
(296 to 318 degrees) with total burnout extension approximately 15
inches forward of the tang. At either side in the interior of the
hole (photoK) the
insulation and steel case material showed evidence of hot gas erosion
that beveled these surfaces (indicative of combustion products
flowing through the hole from the interior of the Solid Rocket
Motor). The top surface of the hole was hardly beveled at all. The
tang O-ring sealing surface next to either side of the hole showed
distinct erosion grooves starting from the O-ring locations (photoJ). These erosion grooves indicate the O-rings were
sealing the joint away from the central area during the later stages
of the trajectory. No other evidence of thermal distress, melting or
burning was noted in the tang section of the joint.

The part of the aft section of the right Solid
Rocket Booster in the circumferential position of the hole was
recovered (photosLandN). This piece, contact 712, showed evidence of a burned
hole edge extending from 291 degrees to 318 degrees, approximately 33
inches long (see bracket, photoL). The
burned surface extended into the aft attach stub region of the case
adjacent to the P 12 strut attach point. The box structure of the aft
attachment ring was missing from the attach stubs. The piece
displayed fractures which led circumferentially or aft from the hole
and the burned surface. Booster pieces on either side have not been
recovered. Thus in the burn area no portion of the clevis or
attachment ring other than the stubs was available for examination
.

The exterior surface of the aft case piece
also contained a large heat affected area (photoM). The
shape and location of this area indicates a plume impingement from
the escaping gases. The light colored material at the downstream edge
of the area is probably asbestos from the insulator. The rust colored
line more or less parallel to the stubs may be a stagnation line
produced in the gas flow when the gases passed around the attachment
ring. Secondary flow of metal from the aft attach stub ring also
shows this feature. There was a small burn hole in the case wall
(arrow, photoO) which
appeared to have penetrated the case from the exterior toward the
interior. This may also have been due to a swirling flow of hot gases
within the attachment ring box structure. The shadow of the
insulation downstream of the attach box can also be seen. This
evidence suggests strongly that a hot gas plume impinged against the
attachment ring, passed around and through it, and ultimately
destroyed its structural integrity, probably late in the flight of
the Solid Rocket Booster.

The photographsL,M,N, andOview the lower case piece in the inverted position. A
correct orientation of this piece is shown in a composite view of the
burn area located in photoP.



[70]Findings

1. A combustion gas leak through the right
Solid Rocket Motor aft field joint initiated at or shortly after
ignition eventually weakened and/or penetrated the External Tank
initiating vehicle structural breakup and loss of the Space Shuttle
Challenger during STS Mission 51-L.

2. The evidence shows that no other STS 51-L
Shuttle element or the payload contributed to the causes of the right
Solid Rocket Motor aft field joint combustion gas leak. Sabotage was
not a factor.

3. Evidence examined in the review of Space
Shuttle material, manufacturing, assembly, quality control, and
processing of nonconformance reports found no flight hardware shipped
to the launch site that fell outside the limits of Shuttle design
specifications.

4. Launch site activities, including assembly
and preparation, from receipt of the flight hardware to launch were
generally in accord with established procedures and were not
considered a factor in the accident.

5. Launch site records show that the right
Solid Rocket Motor segments were assembled using approved procedures.
However, significant out-of-round conditions existed between the two
segments joined at the right Solid Rocket Motor aft field joint (the
joint that failed).

> a. While the assembly conditions
> had the potential of generating debris or damage that could cause
> O-ring seal failure, these were not considered factors in this
> accident.
> 
> b. The diameters of the two Solid Rocket Motor
> segments had grown as a result of prior use.
> 
> c. The growth resulted in a condition at time
> of launch wherein the maximum gap between the tang and clevis in the
> region of the joint's O-rings was no more than .008 inches and the
> average gap would have been .004 inches.
> 
> d. With a tang-to-clevis gap of .004 inches,
> the O-ring in the joint would be compressed to the extent that it
> pressed against all three walls of the O-ring retaining
> channel.
> 
> e. The lack of roundness of the segments was
> such that the smallest tang-to-clevis clearance occurred at the
> initiation of the assembly operation at positions of 120 degrees and
> 300 degrees around the circumference of the aft field joint. It is
> uncertain if this tight condition and the resultant greater
> compression of the O-rings at these points persisted to the time of
> launch.

6. The ambient temperature at time of launch
was 36 degrees Fahrenheit, or 15 degrees lower than the next coldest
previous launch.

> a. The temperature at the 300
> degree position on the right aft field joint circumference was
> estimated to be 28degrees +/- 5 degrees Fahrenheit. This was the
> coldest point on the joint.
> 
> b. Temperature on the opposite side of the
> right Solid Rocket Booster facing the sun was estimated to be about
> 50 degrees Fahrenheit.

7. Other joints on the left and right Solid
Rocket Boosters experienced similar combinations of tang-to-clevis
gap clearance and temperature. It is not known whether these joints
experienced distress during the flight of 51-L.

8. Experimental evidence indicates that due to
several effects associated with the Solid Rocket Booster's ignition
and combustion pressures and associated vehicle motions, the gap
between the tang and the clevis will open as much as .017 and .029
inches at the secondary and primary O-rings, respectively.

> a. This opening begins upon
> ignition, reaches its maximum rate of opening at about 200-300
> milliseconds, and is essentially complete at 600 milliseconds when
> the Solid Rocket Booster reaches its operating pressure.
> 
> b. The External Tank and right Solid Rocket
> Booster are connected by several struts, including one at 310 degrees
> near the aft field joint that failed. This strut's effect on the
> joint dynamics is to enhance the opening of the gap between the tang
> and clevis by about 10-20 percent in the region of 300-320
> degrees.

9. O-ring resiliency is directly related to
its temperature.

> a. A warm O-ring that has been
> [71]
> compressed will return to its original shape much quicker than will a
> cold O-ring when compression is relieved. Thus, a warm O-ring will
> follow the opening of the tang-to-clevis gap. A cold O-ring may
> not.
> 
> b. A compressed O-ring at 75 degrees
> Fahrenheit is five times more responsive in returning to its
> uncompressed shape than a cold O-ring at 30 degrees
> Fahrenheit.
> 
> c. As a result it is probable that the O-rings
> in the right solid booster aft field joint were not following the
> opening of the gap between the tang and clevis at time of
> ignition.

10. Experiments indicate that the primary
mechanism that actuates O-ring sealing is the application of gas
pressure to the upstream (high-pressure) side of the O-ring as it
sits in its groove or channel.

> a. For this pressure actuation to
> work most effectively, a space between the O-ring and its upstream
> channel wall should exist during pressurization.
> 
> b. A tang-to-clevis gap of .O04 inches, as
> probably existed in the failed joint, would have initially compressed
> the O-ring to the degree that no clearance existed between the O-ring
> and its upstream channel wall and the other two surfaces of the
> channel.
> 
> c. At the cold launch temperature experienced,
> the O-ring would be very slow in returning to its normal rounded
> shape. It would not follow the opening of the tang-to-clevis gap. It
> would remain in its compressed position in the O-ring channel and not
> provide a space between itself and the upstream channel wall. Thus,
> it is probable the O-ring would not be pressure actuated to seal the
> gap in time to preclude joint failure due to blow-by and erosion from
> hot combustion gases.

11. The sealing characteristics of the Solid
Rocket Booster O-rings are enhanced by timely application of motor
pressure.

> a. Ideally, motor pressure should
> be applied to actuate the O-ring and seal the joint prior to
> significant opening of the tang-to-clevis gap (100 to 200
> milliseconds after motor ignition).
> 
> b. Experimental evidence indicates that
> temperature, humidity and other variables in the putty compound used
> to seal the joint can delay pressure application to the joint by 500
> milliseconds or more.
> 
> c. This delay in pressure could be a factor in
> initial joint failure.

12. Of 21 launches with ambient temperatures
of 61 degrees Fahrenheit or greater, only four showed signs of O-ring
thermal distress; i.e., erosion or blow-by and soot. Each of the
launches below 61. degrees Fahrenheit resulted in one or more O-rings
showing signs of thermal distress.

> a. Of these improper joint sealing
> actions, one-half occurred in the aft field joints, 20 percent in the
> center field joints, and 30 percent in the upper field joints. The
> division between left and right Solid Rocket Boosters was roughly
> equal. Each instance of thermal O-ring distress was accompanied by a
> leak path in the insulating putty. The leak path connects the
> rocket's combustion chamber with the O-ring region of the tang and
> clevis. Joints that actuated without incident may also have had these
> leak paths.

13. There is a possibility that there was
water in the clevis of the STS 51-L joints since water was found in
the STS-9 joints during a destack operation after exposure to less
rainfall than STS 51-L. At time of launch, it was cold enough that
water present in the joint would freeze. Tests show that ice in the
joint can inhibit proper secondary seal performance.

14. A series of puffs of smoke were observed
emanating from the 51-L aft field joint area of the right Solid
Rocket Booster between 0.678 and 2.500 seconds after ignition of the
Shuttle Solid Rocket Motors.

> a. The puffs appeared at a
> frequency of about three puffs per second. This roughly matches the
> natural structural frequency of the solids at lift off and is
> reflected in slight cyclic changes of the tang-to-clevis gap
> opening.
> 
> [72] b. The puffs were
> seen to be moving upward along the surface of the booster above the
> aft field joint.
> 
> c. The smoke was estimated to originate at a
> circumferential position of between 270 degrees and 315 degrees on
> the booster aft field joint, emerging from the top of the
> joint.

15. This smoke from the aft field joint at
Shuttle lift off was the first sign of the failure of the Solid
Rocket Booster O-ring seals on STS 51-L.

16. The leak was again clearly evident as a
flame at approximately 58 seconds into the flight. It is possible
that the leak was continuous but unobservable or non-existent in
portions of the intervening period. It is possible in either case
that thrust vectoring and normal vehicle response to wind shear as
well as planned maneuvers reinitiated or magnified the leakage from a
degraded seal in the period preceding the observed flames. The
estimated position of the flame, centered at a point 307 degrees
around the circumference of the aft field joint, was confirmed by the
recovery of two fragments of the right Solid Rocket Booster.

> a. A small leak could have been
> present that may have grown to breach the joint in flame at a time on
> the order of 58 to 60 seconds after lift off.
> 
> b. Alternatively, the O-ring gap could have
> been resealed by deposition of a fragile buildup of aluminum oxide
> and other combustion debris. This resealed section of the joint could
> have been disturbed by thrust vectoring, Space Shuttle motion and
> flight loads induced by changing winds aloft.
> 
> c. The winds aloft caused control actions in
> the time interval of 32 seconds to 62 seconds into the flight that
> were typical of the largest values experienced on previous
> missions.



Conclusion

In view of the findings, the Commission
concluded that the cause of the Challenger accident was the failure
of the pressure seal in the aft field joint of the right Solid Rocket
Motor.The failure was due to a faulty
design unacceptably sensitive to a number of factors. These factors
were the effects of temperature, physical dimensions, the character
of materials, the effects of reusability, processing, and the
reaction of the joint to dynamic loading.



[73]References







|Photo A                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | Photo B
|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------
|The upper photos show, from
         left to right, the left side of the orbiter (unburned), the
         right lower and upper rudder speed brake (both burned
         damaged) and left upper seed brake (unburned), confirmation
         that the fire was on the right side of the Shuttle stack.
         The lower photos show the range safety destruct charges in
         the External Tank. These charges were exonerated when they
         were recovered intact and undetonated.
|Photo C                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | Photo D





|Photo E                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | Photo G
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------
|The frustrums on the left
         page are parts of the Solid Rocket Booster forward
         assemblies that contain recovery parachutes, location aids
         and flotation devices. The frustrum of the left hand booster
         (lower left) is virtually undamaged. The right frustrum
         shows impact damage at top and burns along the base of the
         cone; evidence indicates it was damaged when it impacted
         with the External Tank. Shown at right above is another
         Solid Rocket Motor stack crosshatched to show the burned
         area of the right booster's aft joint (diagram at right).
         The flame from the hole impinged on the External Tank and
         caused a failure at the aft connection at the External
         Tank.
|Photo F                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | Photo H





|Photos I, J & K
         [clockwise]                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | Photos L & M
         [top, bottom]
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------
|Examined at Kennedy Space
         Center after their recovery from the ocean, these fragments
         show the extent of burn through the right hand booster's aft
         field joint. On the left page are sections of the aft center
         motor above the joint. On the right page are sections
         (inverted) of the aft motor segment showing burn-hole below
         the joint (bracket). Except for the interior views on lower
         left, the camera is viewing the parts from outside the
         casing.





|Photos N & O
         [top, bottom]                                                                                                                                                                                                                                                                                                                                        | Photo P
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------
|At upper left is the aft
         segment burn viewed from inside the casing; the lower photo
         is a closeup of the same section. The latter photo shows a
         hole (arrow) where the flame plume may have burned through
         the casing from the outside. At right is a composite view of
         the burn above and below the aft field joint.