The spreadsheet is organized primarily according to the sections discussed in the CAIB report. RTF indicates that the recommendation must be 

addressed before the shuttles return to flight. The findings have been placed with the recommendations that correspond to them. You will note 

that some of the findings have been cited more than once. A synopsis to summarize the recommendation(s) and its corresponding findings has 

also been added. The colors serve only to distinguish between recommendation sections. For a complete analysis of the Columbia accident, 

please see the CAIB report, available from the Government Printing Office.

Rec # Recommendation/

Comments

Find# Findings

Part One-The Accident

Thermal Protection System

R3.2-1 Initiate an aggressive program to eliminate all

External Tank Thermal Protection System debris-shedding at the 

source with particular emphasis on the region where the bipod 

struts attach to the External Tank. [RTF] (p. 55, 225)

F3.2-1 NASA does not fully understand the mechanisms that cause foam loss 

on almost all flights from larger areas of foam coverage and from areas 

that are sculpted by hand. (p. 55)

F3.2-2 There are no qualified non-destructive evaluation techniques for the asinstalled foam to determine the characteristics of the foam before 

flight.(p. 55)

Synopsis Foam is applied to the external tank and the bipod foam ramp (the 

y juncture that attaches the External Tank to the Shuttle) to keep 

the gas in the external tank at a super cool temperature. The 

shedding of the foam during takeoff has happened before and is a 

threat to the shuttle and crew. To prevent future incidents, CAIB 

recommends looking into the foam shedding problem and 

developing technologies to troubleshoot and eliminate it. These 

technologies include better imaging and different inspection 

procedures. CAIB hopes that by better understanding the incidents 

of foam loss, the root causes of it may be eliminated.

F3.2-3 Foam loss from an External Tank is unrelated to the tank’s age and to its 

total pre-launch exposure to the elements. Therefore, the foam loss on 

STS-107 is unrelated to either the age or exposure of External Tank 93 

before launch.(p. 55)

F3.2-4 The Board found no indications of negligence in the application of the 

External Tank Thermal Protection System.(p. 55)

F3.2-5 The Board found instances of left bipod ramp shedding on launch that 

NASA was not aware of, bringing the total known left bipod ramp 

shedding events to 7 out of 72 missions for which imagery of the launch 

or External Tank separation is available.(p. 55)

F3.2-6 Subsurface defects were found during the dissection of three bipod foam 

ramps, suggesting that similar defects were likely present in the left 

bipod

ramp of External Tank 93 used on STS-107.(p. 55)
F3.2-7 Foam loss occurred on more than 80 percent of the 79 missions for 

which imagery was available to confirm or rule out foam loss. (p. 55)

F3.2-8 Thirty percent of all missions lacked sufficient imagery to determine if 

foam had been lost. (p. 55)

F3.2-9 Analysis of numerous separate variables indicated that none could be 

identified as the sole initiating factor of bipod foam loss. The Board 

therefore concludes that a combination of several factors resulted in 

bipod foam loss. (p. 55)

R3.3-1 Develop and implement a comprehensive inspection

plan to determine the structural integrity of all Reinforced CarbonCarbon system components. This inspection plan should take 

advantage of advanced non-destructive inspection technology. 

[RTF] (p. 59,225)

F3.3-1 The original design specifications required the RCC components to have 

essentially no impact resistance. (p.58)

Synopsis

for R3.3-1

The CAIB is suggesting that a means to inspect the RCC tile be 

developed to ascertain their strength. The RCC inspection plan 

will need to include a mechanism for inspecting tiles both on Earth 

and in orbit.

R3.3-2 Initiate a program designed to increase the

Orbiter’s ability to sustain minor debris damage by measures such 

as improved impact-resistant Reinforced Carbon-Carbon and 

acreage tiles. This program should determine the actual impact 

resistance of current materials and the effect of likely debris 

strikes. [RTF] (59,225)

F3.3-2 Current inspection techniques are not adequate to assess structural 

integrity of the RCC components. (p.58)

Synopsis

for R3.3-2

The impact of foam on the RCC tiles can compromise the orbiter's 

structural integrity. Many factors can lead to the weakening of the 

RCC tiles, potentially endangering the shuttle and crew. CAIB is 

essentially recommending that the RCC tiles be strengthened in 

effort to reduce the risk of breakage.

R3.3-3 To the extent possible, increase the Orbiter’s ability to successfully 

re-enter Earth’s atmosphere with minor leading edge structural 

sub-system damage. (p.59, 225)

 

F3.3-3 After manufacturer’s acceptance non-destructive evaluation, only 

periodic visual and touch tests are conducted. (p.58)

Synopsis

for R3.3-3

The goal is to safely return the shuttle and crew home from 

orbit. By studying the RCC panels that have already flown in 

orbit, CAIB suggests that NASA develop a procedure that would 

allow the shuttle to land safely-despite minor damage to the TPS 

System.
R3.3-4 In order to understand the true material characteristics of 

Reinforced Carbon-Carbon components, develop a comprehensive 

database of flown Rein-forced Carbon-Carbon material 

characteristics by destructive testing and evaluation. (59,225)

F3.3-4 RCC components are weakened by mass loss caused by oxidation within 

the substrate, which accumulates with age. The extent of oxidation is not 

directly measurable, and the resulting mission life reduction is 

developed analytically. (p.58)

R3.3-5 Improve the maintenance of launch pad structures to minimize the 

leaching of zinc primer onto Reinforced Carbon-Carbon 

components. (p.59,225)

F3.3-5 To date, only two flown RCC panels, having achieved 15 and 19 

missions, have been destructively tested to determine actual loss of 

strength due to oxidation. (p.58)

Synopsis

for R3.3-5

The RCC panels were found to be subject to since contamination 

from the launch pad. CAIB recommends that the launch pad be 

carefully maintained to avoid zinc contamination to the RCC 

components.

F3.3-6 Contamination from zinc leaching from a primer under the paint topcoat 

on the launch pad structure increases the opportunities for localized 

oxidation. (p.58)

R6.4-1 For missions to the International Space Station, develop a 

practicable capability to inspect and effect emergency repairs to 

the widest possible range of damage to the Thermal Protection 

System, including both tile and Reinforced Carbon-Carbon, taking 

advantage of the additional capabilities available when near to or 

docked at the International Space Station.

 For non-Station missions, develop a comprehensive 

autonomous (independent of Station) inspection and repair 

capability to cover the widest possible range of damage scenarios.

 Accomplish an on-orbit Thermal Protection System inspection, 

using appropriate assets and capabilities, early in all missions.

 The ultimate objective should be a fully autonomous capability 

for all missions to address the possibility that an International 

Space Station mission fails to achieve the correct orbit, fails to 

dock successfully, or is damaged during or after undocking. [RTF] 

(p. 174, 225)

F6.4-1 The repair option, while logistically viable using existing materials 

onboard Columbia, relied on so many uncertainties that NASA rated this 

option “high risk.” (p. 174)

Synopsis The safe and effective functioning of the TPS system is vital to the 

successful and safe return of the shuttle and crew. CAIB 

recommends that the RCC system be thoroughly inspected while 

on orbit to determine its status. This will require the development 

of new technology to view and inspect the RCC system. CAIB 

further suggests that TPS inspections become a routine operation 

for shuttle crews once achieving orbit on every mission.

F6.4-2 If Program managers were able to unequivocally determine before Flight 

Day Seven that there was potentially catastrophic damage to the left 

wing, accelerated processing of Atlantis might have provided a window 

in which Atlantis could rendezvous with Columbia before Columbia’s 

limited consumables ran out. (p. 174)
R3.8-1 Obtain sufficient spare Reinforced Carbon-Carbon panel

assemblies and associated support components to ensure that 

decisions on Reinforced Carbon-Carbon maintenance are made on 

the basis of component specifications, free of external pressures 

relating to schedules, costs, or other considerations. (p. 83, 225)

No Findings Listed for this Recommendation

Synopsis The existence of spare parts will eliminate some of the pressure 

associated with launch schedules.

R3.8-2 Develop, validate, and maintain physics-based computer

models to evaluate Thermal Protection System damage from 

debris impacts. These tools should provide realistic and timely 

estimates of any impact damage from possible debris from any 

source that may ultimately impact the Orbiter. Establish impact 

damage thresholds that trigger responsive corrective action, such 

as on-orbit inspection and repair, when indicated. (p. 83, 226)

F3-8-1 The impact test program demonstrated that foam can cause a wide range 

of impact damage, from cracks to a 16- by 17-inch hole.(p. 83)

Synopsis The creation of comprehensive, accurate computer models to 

measure debris impact damage will assist engineers in evaluating 

the need for repair and inspection of the system.

F3.8-2 The wing leading edge Reinforced Carbon-Carbon composite material 

and

associated support hardware are remarkably tough and have impact 

capabilities that far exceed the minimal impact resistance specified in 

their original design requirements. Nevertheless, these tests demonstrate 

that this inherent toughness can be exceeded by impacts representative 

of those that occurred during Columbia’s ascent. (p. 83)

F3.8-3 The response of the wing leading edge to impacts is complex and can 

vary

greatly, depending on the location of the impact, projectile mass, 

orientation, composition, and the material properties of the panel 

assembly, making analytic predictions of damage to RCC assemblies a 

challenge. (p.83)

F3.8-4 Testing indicates the RCC panels and T-seals have much higher impact

resistance than the design specifications call for. (p.83)

F3.8-5 NASA has an inadequate number of spare Reinforced Carbon-Carbon

panel assemblies. (p. 83)

F3.8-6 NASA’s current tools, including the Crater model, are inadequate to

evaluate Orbiter Thermal Protection System damage from debris 

impacts during pre-launch, on-orbit, and post-launch activity. (p.83)

F3.8-7 The bipod ramp foam debris critically damaged the leading edge of

Columbia’s left wing. (p.83)
Imaging

R3.4-1 Upgrade the imaging system to be capable of providing a 

minimum of three useful views of the Space Shuttle from liftoff to 

at least Solid Rocket Booster separation, along any expected 

ascent azimuth. The operational status of these assets should be 

included in the Launch Commit Criteria for future launches. 

Consider using ships or aircraft to provide additional views of the 

Shuttle during ascent. [RTF] (p. 62, 226)

F3.4-1 Photographic evidence during ascent indicates the projectile that struck 

the Orbiter was the left bipod ramp foam. (p. 62)

Synopsis

for R3.4-1

Images if the orbiter when assessing possible damage occurring 

during ascent are essential to correctly determining whether or not 

further maintenance action is necessary to guarantee the safe 

return of the shuttle and crew. Additional images provided by 

multiple vantage points will provide a more comprehensive picture 

of launch events. Clear images of the External Tank following 

separation are useful in determining whether or not significant 

damage occurred to the shuttle by debris originating in the 

External Tank area.

F3.4-2 The same photographic evidence, confirmed by independent analysis, 

indicates the projectile struck the underside of the leading edge of the 

left wing in the vicinity of RCC panels 6 through 9 or the tiles directly 

behind, with a velocity of approximately 775 feet per second. (p. 62)

R3.4-2 Provide a capability to obtain and downlink high-resolution 

images of the External Tank after it separates. [RTF] (p.62, 226)

F3.4-3 There is a requirement to obtain and downlink on-board engineering 

quality imaging from the Shuttle during launch and ascent. (p. 62)

Synopsis

for R3.4-2

Images if the orbiter when assessing possible damage occurring 

during ascent are essential to correctly determining whether or not 

further maintenance action is necessary to guarantee the safe 

return of the shuttle and crew. Additional images provided by 

multiple vantage points will provide a more comprehensive picture 

of launch events. Clear images of the External Tank following 

separation are useful in determining whether or not significant 

damage occurred to the shuttle by debris originating in the 

External Tank area.

F3.4-4 The current long-range camera assets on the Kennedy Space Center and 

Eastern Range do not provide best possible engineering data during 

Space Shuttle ascents. (p. 62)

R3.4-3 Provide a capability to obtain and downlink high-resolution 

images of the underside of the Orbiter wing leading edge and 

forward section of both wings. Thermal Protection System. [RTF] 

(p.62, 226)

F3.4-5 Evaluation of STS-107 debris impact was hampered by lack of high 

resolution, high speed cameras (temporal and spatial imagery data). (p. 

62)

F3.4-6 Despite the lack of high quality visual evidence, the information 

available about the foam impact during the mission was adequate to 

determine its effect on both the thermal tiles and RCC. (p. 62)
R6.3-2 Modify the Memorandum of Agreement with the National 

Imagery and Mapping Agency to make the imaging of each 

Shuttle flight while on orbit a standard requirement. [RTF] 

(p.172,226)

F6.3-1 The foam strike was first seen by the Intercenter Photo Working Group 

on the morning of Flight Day Two during the standard review of launch 

video and high-speed photography. The strike was larger than any seen 

in the past, and the group was concerned about possible damage to the 

Orbiter. No conclusive images of the strike existed. One camera that 

may have provided an additional view was out of focus because of an 

improperly maintained lens. (p. 170)

Synopsis

for R6.3-2

The best photo imaging assets we have in space are those used by 

the Department of Defense. The images provided by DoD are 

invaluable in ascertaining the extent of damage to the orbiter while 

in orbit. CAIB recommended that these images be taken for every 

shuttle flight.

F6.3-2 The Chair of the Intercenter Photo Working Group asked management 

to begin the process of getting outside imagery to help in damage 

assessment. This request, the first of three, began its journey through the 

management hierarchy on Flight Day Two. (p. 170)

R6.3-1* Implement an expanded training program in which the Mission 

Management Team faces potential crew and vehicle safety 

contingencies beyond launch and ascent. These contingencies 

should involve potential loss of Shuttle or crew, contain numerous 

uncertainties and unknowns, and require the Mission Management 

Team to assemble and interact with support organizations across 

NASA/Contractor lines and in various locations. [RTF] *(p. 172, 

226)

F6.3-3 The Intercenter Photo Working Group distributed its first report, 

including a digitized video clip and initial assessment of the strike, on 

Flight Day Two. This information was widely disseminated to NASA 

and contractor engineers, Shuttle Program managers, and Mission 

Operations Directorate personnel. (p. 170-1)

Synopsis

for R6.3-1

The Mission Management Team training program should be 

expanded to incorporate previously unrehearsed contingencies.

F6.3-4 Initial estimates of debris size, speed, and origin were remarkably 

accurate. Initial in-formation available to managers stated that the debris 

originated in the left bipod area of the External Tank, was quite large, 

had a high velocity, and struck the underside of the left wing near its 

leading edge. The report stated that the debris could have hit the RCC or 

tile. (p. 171)

*Recommendation R6.3-1 appears in the Part Two Training 

Section of recommendations. Its findings, however, are the same 

as those associated with the R6.3-2 recommendation.

F6.3-5 A Debris Assessment Team began forming on Flight Day two to analyze 

the impact. Once the debris strike was categorized as “out of family” by 

United Space Alliance, contractual obligations led to the Team being 

Co-Chaired by the cognizant contractor sub-system manager and her 

NASA counterpart. The team was not designated a Tiger Team by the 

Mission Evaluation Room or Mission Management Team. (p. 171)

F6.3-6 Though the Team was clearly reporting its plans (and final results) 

through the Mission Evaluation Room to the Mission Management 

Team, no Mission manager appeared to “own” the Team’s actions. The 

Mission Management Team, through the Mission Evaluation Room, 

provided no direction for team activities, and Shuttle managers did not 

formally consult the Team’s leaders about their progress or interim 

results. (p. 171)
F6.3-7 During an organizational meeting, the Team discussed the uncertainty of 

the data and the value of on-orbit imagery to “bound” their analysis. In 

its first official meeting the next day, the Team gave its NASA Co-Chair 

the action to request imagery of Columbia on-orbit. (p. 171)

F6.3-8 The Team routed its request for imagery through Johnson Space 

Center’s Engineering Directorate rather than through the Mission 

Evaluation Room to the Mission Management Team to the Flight 

Dynamics Officer, the channel used during a mission. This routing 

diluted the urgency of their request. Managers viewed it as a non-critical 

engineering desire rather than a critical operational need. (p. 171)

F6.3-9 Team members never realized that management’s decision against 

seeking imagery was not intended as a direct or final response to their 

request.(p. 171)

F6.3-10 The Team’s assessment of possible tile damage was performed using an 

impact simulation that was well outside Crater’s test database. The 

Boeing analyst was inexperienced in the use of Crater and the 

interpretation of its results. Engineers with extensive Thermal Protection 

System expertise at Huntington Beach were not actively involved in 

determining if the Crater results were properly interpreted. (p. 171)

F6.3-11 Crater initially predicted tile damage deeper than the actual tile depth, 

but engineers used their judgment to conclude that damage would not 

penetrate the densified layer of tile. Similarly, RCC damage conclusions 

were based primarily on judgment and experience rather than analysis. 

(p. 171)

F6.3-12 For a variety of reasons, including management failures, communication 

breakdowns, inadequate imagery, inappropriate use of assessment tools, 

and flawed engineering judgments, the damage assessments contained 

substantial uncertainties. (p. 171)

F6.3-13 The assumptions (and their uncertainties) used in the analysis were 

never presented or discussed in full to either the Mission Evaluation 

Room or the Mission Management Team. (p. 171)

F6.3-14

F6.3-14 While engineers and managers knew the foam could have 

struck RCC panels; the briefings on the analysis to the Mission 

Evaluation Room and Mission Management Team did not address RCC 

damage, and neither Mission Evaluation Room nor Mission 

Management Team managers asked about it. (p. 171)
F6.3-15 There were lapses in leadership and communication that made it 

difficult for engineers to raise concerns or understand decisions. 

Management failed to actively engage in the analysis of potential 

damage caused by the foam strike. (p. 171)

F6.3-16 Mission Management Team meetings occurred infrequently (five times 

during a 16 day mission), not every day, as specified in Shuttle Program 

management rules. (p. 171)

F6.3-17 Shuttle Program Managers entered the mission with the belief, recently 

reinforced by the STS-113 Flight Readiness Review, that a foam strike 

is not a safety-of-flight issue. (p.171)

F6.3-18 After Program managers learned about the foam strike, their belief that 

it would not be a problem was confirmed (early, and without analysis) 

by a trusted expert who was readily accessible and spoke from 

“experience.” No one in management questioned this conclusion. (p. 

172)

F6.3-19 Managers asked “Who’s requesting the photos?” instead of assessing the 

merits of the request. Management seemed more concerned about the 

staff following proper channels (even while they were themselves taking 

informal advice) than they were about the analysis. (p. 172)

F6.3-20 No one in the operational chain of command for STS-107 held a security 

clearance that would enable them to understand the capabilities and 

limitations of National imagery resources. (p.172)

F6.3-21 Managers associated with STS-107 began investigating the implications 

of the foam strike on the launch schedule, and took steps to expedite 

post-flight analysis. (p.172)

F6.3-22 Program managers required engineers to prove that the debris strike 

created a safety-of-flight issue: that is, engineers had to produce 

evidence that the system was unsafe rather than prove that it was safe. 

(p.172)

F6.3-23 In both the Mission Evaluation Room and Mission Management Team 

meetings over the Debris Assessment Team’s results, the focus was on 

the bottom line – was there a safety-of-flight issue, or not? There was 

little discussion of analysis, assumptions, issues, or ramifications.

(p.172)

F6.3-24 Communication did not flow effectively up to or down from Program 

managers. (p.172)

F6.3-25 Three independent requests for imagery were initiated. (p.172)
F6.3-26 Much of Program managers’ information came through informal 

channels, which prevented relevant opinion and analysis from reaching 

decision makers. (p.172)

F6.3-27 Program Managers did not actively communicate with the Debris 

Assessment Team. Partly as a result of this, the Team went through 

institutional, not mission-related, channels with its request for imagery, 

and confusion surrounded the origin of imagery requests and their 

subsequent denial. (p.172)

F6.3-28 Communication was stifled by the Shuttle Program attempts to find out 

who had a “mandatory requirement” for imagery. (p.172)

F6.3-29 Safety representatives from the appropriate organizations attended 

meetings of the Debris Assessment Team, Mission Evaluation Room, 

and Mission Management Team, but were passive, and therefore were 

not a channel through which to voice concerns or dissenting views. 

(p.172)

Orbiter Sensor Data [1]

R3.6-1 The Modular Auxiliary Data System instrumentation and sensor 

suite on each Orbiter should be maintained and updated to include 

current sensor and data acquisition technologies. (p. 73, 226)

F3.6-1 The de-orbit burn and re-entry flight path were normal until just before 

Loss of Signal. (p.73)

Synopsis

for R3.6-1

CAIB determined that the instrumentation and sensor suite 

(Modular Auxiliary Data System) should utilize the latest 

technologies available, given that the sensors are able to provide 

necessary structural integrity data. By the time Mission Control 

received the data on the wing heating, the damage was 

unrecoverable.

F3.6-2 Columbia re-entered the atmosphere with a preexisting breach in the left 

wing. (p.73)

R3.6-2 The Modular Auxiliary Data System should be redesigned to 

include engineering performance and vehicle health information, 

and have the ability to be reconfigured during flight in order to 

allow certain data to be recorded, telemetered, or both as needs 

change. (p.73, 226)

F3.6-3 Data from the Modular Auxiliary Data System recorder indicates the 

location of the breach was in the RCC panels on the left wing leading 

edge.(p.73)

Synopsis

for R3.6-2

The Modular Auxiliary Data System should be redesigned to allow 

essential vehicle integrity information to be communicated.

F3.6-4 Abnormal heating events preceded abnormal aerodynamic events by 

several minutes. (p.73)
F3.6-5 By the time data indicating problems was telemetered to Mission 

Control Center, the Orbiter had already suffered damage from which it 

could not recover. (p.73)

Wiring

R4.2-2 As part of the Shuttle Service Life Extension Program and 

potential 40-year service life, develop a state-of-the-art means to 

inspect all Orbiter wiring, including that which is inaccessible. (p. 

89, 226)

F4.2-5 Based on the extensive wiring inspections, maintenance, and 

modifications prior to STS-107, analysis of sensor/wiring failure 

signatures, and the alignment of the signatures with thermal intrusion 

into the wing, the Board found no evidence that Kapton wiring problems 

caused or contributed to this accident. (p.189)

Synopsis

for R4.2-2

Although the CAIB determined that faulty wiring was not the 

culprit of the accident, they recommended all wiring on the Shuttle 

be inspected.

Bolt Catchers

R4.2-1 Test and qualify the flight hardware bolt catchers. [RTF] (p.88, 

226)

F4.2-1 The certification of the bolt catchers flown on STS-107 was 

accomplished by extrapolating analysis done on similar but not identical 

bolt catchers in original testing. No testing of flight hardware was 

performed. (p. 88)

Synopsis

for R4.2-1

The CAIB was unable to rule out the bolt catchers as potentially 

being the cause of the orbiter left wing damage, though should it 

have been the cause it is expected that the impact would have 

registered on sensors. The CAIB further recommended that the 

bolt catchers be tested prior to flight. The bolt catcher is designed 

to "catch" the upper half of the bolt that connects that Solid Rocket 

Boosters (SRB) and the External Tank (ET) that are explosively 

separated when the SRBs are separated from the ET.

F4.2-2 Board-directed testing of a small sample size demonstrated that the “asflown” bolt catchers do not have the required 1.4 margin of safety. (p. 

88)

F4.2-3 Quality assurance processes for bolt catchers (a Criticality 1 subsystem) 

were not adequate to as-sure contract compliance or product adequacy.

(p. 88)

F4.2-4 An unknown metal object was seen separating from the stack during 

Solid Rocket Booster separation during six Space Shuttle missions. 

These objects were not identified, but were characterized as of little to 

no concern. (p. 88)

Closeouts
R4.2-3 Require that at least two employees attend all final closeouts and 

intertank area hand-spraying procedures. [RTF] (p. 94, 226)

F4.2-12 The Board found no evidence that willful damage was a factor in this 

accident. (p. 94)

Synopsis

for R4.2-3

Though CAIB found that no damage was purposely done to the 

orbiter, they recommended that two people attend all final 

closeouts and intertank spraying procedures. Close out is when 

the component of the space transportation system is "sealed and 

flight certified".

F4.2-13 Two close-out processes at the Michoud Assembly Facility are currently 

able to be performed by a single person. (p. 94)

F4.2-14 Photographs of every close out activity are not routinely taken. (p. 94)

Micrometeoroid and Orbital Debris

R4.2-4 Require the Space Shuttle to be operated with the same degree of 

safety for micrometeoroid and orbital debris as the degree of safety 

calculated for the International Space Station. Change the 

micrometeoroid and orbital debris safety criteria from guidelines 

to requirements. (p. 95, 226)

F4.2-15 There is little evidence that Columbia encountered either 

micrometeoroids or orbital debris on this flight. (p. 94)

Synopsis

for R4.2-4

CAIB could not dismiss micrometeoroids/space debris as a 

potential factor in the Columbia accident, though shuttle data 

"rules out major impact". CAIB considers the roughly 1/200 

mission impact odds to be unacceptable and recommends that the 

shuttle be operated with a greater degree of safety.

F4.2-16 The Board found markedly different criteria for margins of 

micrometeoroid and orbital debris safety between the International 

Space Station and the Shuttle. (p. 95)
Foreign Object Debris

R4.2-5 Kennedy Space Center Quality Assurance and United Space 

Alliance must return to the straightforward, industry-standard 

definition of “Foreign Object Debris” and eliminate any alternate or statistically deceptive definitions like “processing 

debris.” [RTF] (p.95, 226)

F4.2-18 Since 2001, Kennedy Space Center has used a non-standard approach to 

define foreign object debris. The industry standard term “Foreign Object 

Damage” has been divided into two categories, one of which is much more 

permissive. (p. 95)

Synopsis

for R4.2-5

The definition that Kennedy Space Center (KSC) and the 

United Space Alliance (USA) uses for debris differs from the 

industry standard and thus can be deceptive. CAIB 

recommends that KSC and USA return to the original 

definition.

Part Two-Why the Accident Occurred

Scheduling

R6.2-1 Adopt and maintain a Shuttle flight schedule that is consistent 

with available resources. Although schedule deadlines are an 

important management tool, those deadlines must be regularly 

evaluated to ensure that any additional risk incurred to meet the 

schedule is recognized, understood, and acceptable. [RTF] (p. 

139, 226)

F6.2-1 NASA Headquarters’ focus was on the Node 2 launch date, February 19, 

2004. (p.139)

Synopsis

for R6.2-1

The schedule used for shuttle flights should not be set in stone 

and should be realistic. The schedule should be revised 

periodically in order to mitigate potential risk created by 

deadline pressures.

F6.2-2 The intertwined nature of the Space Shuttle and the Space Station programs 

significantly increased the complexity of the schedule and made meeting the 

schedule far more challenging. (p. 139)

F6.2-3 The capabilities of the system were being stretched to the limit to support the 

schedule. Projections into 2003 showed stress on vehicle processing at the 

Kennedy Space Center, on flight controller training at Johnson Space Center, 

and on Space Station crew rotation schedules. Effects of this stress included 

neglecting flight controller recertification requirements, extending crew 

rotation schedules, and adding incremental risk by scheduling additional 

Orbiter movements at Kennedy. (p.139)

F6.2-4 The four flights scheduled in the five months from October 2003, to 

February 2004, would have required a processing effort comparable to the 

effort immediately before the Challenger accident. (p.139)
F6.2-5 There was no schedule margin to accommodate unforeseen problems. When 

flights come in rapid succession, there is no assurance that anomalies on one 

flight will be identified and appropriately addressed before the next flight. 

(p.139)

F6.2-6 The environment of the countdown to Node 2 and the importance of 

maintaining the schedule may have begun to influence managers. decisions, 

including those made about the STS-112 foam strike. (p.139)

F6.2-7 During STS-107, Shuttle Program managers were concerned with the foam 

strike’s possible effect on the launch schedule. (p.139)

Organization

R7.5-1 Establish an independent Technical Engineering Authority that 

is responsible for technical requirements and all waivers to 

them, and will build a disciplined, systematic approach to 

identifying, analyzing, and controlling hazards throughout the 

life cycle of the Shuttle System. The independent technical 

authority does the following as a minimum

•Develop and maintain technical standards for all Space Shuttle 

Program projects and elements

• Be the sole waiver-granting authority for all technical 

standards

• Conduct trend and risk analysis at the sub-system, system, and 

enterprise levels

• Own the failure mode, effects analysis and hazard reporting 

systems

• Conduct integrated hazard analysis

• Decide what is and is not an anomalous event

• Independently verify launch readiness

• Approve the provisions of the recertification program called 

for in Recommendation R9.1-1.

The Technical Engineering Authority should be funded directly 

from NASA Headquarters, and should have no connection to or 

responsibility for schedule or program cost. (p. 193, 227)

F7. 1-1 Throughout its history, NASA has consistently struggled to achieve viable 

safety programs and adjust them to the constraints and vagaries of changing 

budgets. Yet, according to multiple high level independent reviews, NASA’s 

safety system has fallen short of the mark. (p. 192)
Synopsis

for R7.5-1

CAIB recommends an independent technical engineering 

authority be created to monitor hazards to the shuttle system.

F7.4-1 The Associate Administrator for Safety and Mission Assurance is not 

responsible for safety and mission assurance execution, as intended by the 

Rogers Commission, but is responsible for Safety and Mission Assurance 

policy, advice, coordination, and budgets. This view is consistent with 

NASA’s recent philosophy of management at a strategic level at NASA 

Headquarters but contrary to the Rogers. Commission recommendation. (p. 

193)

R7.5-2 NASA Headquarters Office of Safety and Mission Assurance 

should have direct line authority over the entire Space Shuttle 

Program safety organization and should be independently 

resourced. (p. 193, 227)

F7.4-2 Safety and Mission Assurance organizations sup-porting the Shuttle Program 

are largely dependent upon the Program for funding, which hampers their 

status as independent advisors. (p. 193)

Synopsis

for R7.5-2

The Headquarters Office of Mission and Safety Assurance shall 

be the authority on shuttle program safety.

F7.4-3 Over the last two decades, little to no progress has been made toward 

attaining integrated, independent, and detailed analyses of risk to the Space 

Shuttle system. (p. 193)

F7.4-4 System safety engineering and management is separated from mainstream 

engineering, is not vigorous enough to have an impact on system de-sign, 

and is hidden in the other safety disciplines at NASA Headquarters. (p. 193)

R7.5-3 Reorganize the Space Shuttle Integration Office to make it 

capable of integrating all elements of the Space Shuttle 

Program, including the Orbiter. (p. 193, 227)

F7.4-5 Risk information and data from hazard analyses are not communicated 

effectively to the risk assessment and mission assurance processes. The 

Board could not find adequate application of a process, database, or metric 

analysis tool that took an integrated, systemic view of the entire Space 

Shuttle system. (p. 193)

Synopsis

for R7.5-3

This will also integrate all safety aspects of the shuttle 

program.

F7.4-6 The Space Shuttle Systems Integration Office handles all Shuttle systems 

except the Orbiter. Therefore, it is not a true integration office. (p. 193)

F7.4-7 When the Integration Office convenes the Integration Control Board, the 

Orbiter Office usually does not send a representative, and its staff makes 

verbal inputs only when requested. (p. 193)

F7.4-8 The Integration office did not have continuous responsibility to integrate 

responses to bipod foam shedding from various offices. Sometimes the 

Orbiter Office had responsibility, sometimes the External Tank Office at 

Marshall Space Flight Center had responsibility, and sometime the bi-pod 

shedding did not result in any designation of an In-Flight Anomaly. 

Integration did not occur. (p. 193)

F7.4-9 NASA information databases such as The Problem Reporting and Corrective 

Action and the Web Program Compliance Assurance and Status System are 

marginally effective decision tools. (p. 193)
F7.4-10 Senior Safety, Reliability & Quality Assurance and element managers do not 

use the Lessons Learned Information System when making decisions. NASA 

subsequently does not have a constructive program to use past lessons to 

educate engineers, managers, astronauts, or safety personnel. (p. 193)

F7.4-11 The Space Shuttle Program has a wealth of data tucked away in multiple 

databases without a convenient way to integrate and use the data for 

management, engineering, or safety decisions. (p. 193)

F7.4-12 The dependence of Safety, Reliability & Quality Assurance personnel on 

Shuttle Program support limits their ability to oversee operations and 

communicate potential problems throughout the organization. (p. 193)

F7.4-13 There are conflicting roles, responsibilities, and guidance in the Space 

Shuttle safety programs. The Safety & Mission Assurance Pre-Launch 

Assessment Review process is not recognized by the Space Shuttle Program 

as a requirement that must be followed (NSTS 22778). Failure to 

consistently apply the Pre-Launch Assessment Review as a requirements 

document creates confusion about roles and responsibilities in the NASA 

safety organization. (p. 193)

Part Three-A Look Ahead

Organization

R9.1-1 Prepare a detailed plan for defining, establishing, transitioning, 

and implementing an independent Technical Engineering 

Authority, independent safety program, and a reorganized Space 

Shuttle Integration Office as described in R7.5-1, R7.5-2, and 

R7.5-3. In addition, NASA should submit annual reports to 

Congress, as part of the budget review process, on its 

implementation activities. [RTF] (p. 208, 227)

There are no findings associated with this recommendation.

Recertification

R9.2-1 Prior to operating the Shuttle beyond 2010, develop and 

conduct a vehicle recertification at the material, component, 

subsystem, and system levels. Recertification requirements 

should be included in the Service Life Extension Program. (p. 

209, 227)

There are no findings associated with this recommendation.
Closeout Photos/Drawing System

R10.3-1 Develop an interim program of closeout photographs for all 

critical sub-systems that differ from engineering drawings. 

Digitize the close-out photograph system so that images are 

immediately available for on-orbit troubleshooting. [RTF] (p. 

217, 227)

F10.3-1 The engineering drawing system contains outdated information and is paperbased rather than computer-aided. (p. 217)

Synopsis

for R10.3-1

Photos of the current sealed and certified shuttle components 

should be organized and made easily accessible to utilize on 

orbit.

F10.3-2 The current drawing system cannot quickly portray Shuttle sub-systems for 

on-orbit trouble-shooting. (p. 217)

R10.3-2 Provide adequate resources for a long-term program to upgrade 

the Shuttle engineering drawing system including:

• Reviewing drawings for accuracy

• Converting all drawings to a computer-aided drafting system

• Incorporating engineering changes

(p. 217, 227)

F10.3-3 NASA normally uses closeout photographs but lacks a clear system to define 

which critical sub-systems should have such photographs. The current 

system does not allow the immediate retrieval of closeout photos. (p. 217)

Synopsis

for R10.3-2

The Shuttle engineering drawing system should be revised and 

updated.

By: Jennifer Troxell, NASA History Office