Challenger Space Shuttle Disaster Case Study

Please Read sources prior to the tutorial and address the following questions in the tutorial

Some Questions for Group Analysis and Discussion

The immediate cause of the Challenger disaster was the decision by the launch committer to launch, even though low air temperature had the potential to impair vital function of the o-rings.

Discuss the decision making process:

Do you think the decision to launch was incorrect given knowledge at the time?

What pressures were present on those in the meeting?

Were all the participants free to provide their opinion? If not, what forces limited free participation?

How important were the operational drivers relative the engineering and safety drivers?

How did the previous decision making history provide a bias in decision making?

How could better decision making have occurred?

Suggest specific meeting guidelines that could have ensured more open review of safety concerns.

Have you been in groups where “groupthink” unspoken rules or practices have limited your ability to contribute? What were these rules?

Have you been in groups where you felt free to participate and present your point of view? What aspects of the group gave you this freedom?

How do you think you as a manager could enhance good group based decision making?

Source 1. Report of the Presidential Commission on the Space Shuttle Challenger Accident (Rogers Report)http://science.ksc.nasa.gov/shuttle/missions/51-l/docs/rogers-commission/table-of-contents.html

The presidents Commission of Inquiry into the report led by Rogers

Rogers Report Chapter III - The Accident

Just after liftoff at .678 seconds into the flight, photographicdata show a strong puff of gray smoke was spurting from the vicinityof the aft field joint on the right Solid Rocket Booster. The two pad39B cameras that would have recorded the precise location of the puffwere inoperative. Computer graphic analysis of film from othercameras indicated the initial smoke came from the 270 to 310-degreesector of the circumference of the aft field joint of the right SolidRocket Booster. This area of the solid booster faces the ExternalTank. The vaporized material streaming from the joint indicated therewas not complete sealing action within the joint.

Eight more distinctive puffs of increasingly blacker smoke wererecorded between .836 and 2.500 seconds. The smoke appeared to puffupwards from the joint. While each smoke puff was being left behindby the upward flight of the Shuttle, the next fresh puff could be seennear the level of the joint. The multiple smoke puffs in thissequence occurred at about four times per second, approximating thefrequency of the structural load dynamics and resultant joint flexing.Computer graphics applied to NASA photos from a variety of cameras inthis sequence again placed the smoke puffs' origin in the 270- to310-degree sector of the original smoke spurt.

As the Shuttle increased its upward velocity, it flew past theemerging and expanding smoke puffs. The last smoke was seen above thefield joint at 2.733 seconds.

The black color and dense composition of the smoke puffs suggestthat the grease, joint insulation and rubber O-rings in the joint sealwere being burned and eroded by the hot propellant gases.

At approximately 37 seconds, Challenger encountered the first ofseveral high-altitude wind shear conditions, which lasted until about64 seconds. The wind shear created forces on the vehicle withrelatively large fluctuations. These were immediately sensed andcountered by the guidance, navigation and control system.

The steering system (thrust vector control) of the Solid RocketBooster responded to all commands and wind shear effects. The windshear caused the steering system to be more active than on anyprevious flight.

Both the Shuttle main engines and the solid rockets operated atreduced thrust approaching and passing through the area of maximumdynamic pressure of 720 pounds per square foot. Main engines had beenthrottled up to 104 percent thrust and the Solid Rocket Boosters wereincreasing their thrust when the first flickering flame appeared onthe right Solid Rocket Booster in the area of the aft field joint.

This first very small flame was detected on image enhanced film at58.788 seconds into the flight. It appeared to originate at about 305degrees around the booster circumference at or near the aft fieldjoint.

One film frame later from the same camera, the flame was visiblewithout image enhancement. It grew into a continuous, well-definedplume at 59.262 seconds. At about the same time (60 seconds),telemetry showed a pressure differential between the chamber pressuresin the right and left boosters. The right booster chamber pressurewas lower, confirming the growing leak in the area of the field joint.

As the flame plume increased in size, it was deflected rearward bythe aerodynamic slipstream and circumferentially by the protrudingstructure of the upper ring attaching the booster to the ExternalTank. These deflections directed the flame plume onto the surface ofthe External Tank. This sequence of flame spreading is confirmed byanalysis of the recovered wreckage. The growing flame also impingedon the strut attaching the Solid Rocket Booster to the External Tank.

The first visual indication that swirling flame from the rightSolid Rocket Booster breached the External Tank was at 64.660 secondswhen there was an abrupt change in the shape and color of the plume.This indicated that it was mixing with leaking hydrogen from theExternal Tank. Telemetered changes in the hydrogen tankpressurization confirmed the leak. Within 45 milliseconds of thebreach of the External Tank, a bright sustained glow developed on theblack-tiled underside of the Challenger between it and the ExternalTank.

Beginning at about 72 seconds, a series of events occurred extremelyrapidly that terminated the flight. Telemetered data indicate a widevariety of flight system actions that support the visual evidence ofthe photos as the Shuttle struggled futilely against the forces thatwere destroying it.

At about 72.20 seconds the lower strut linking the Solid RocketBooster and the External Tank was severed or pulled away from theweakened hydrogen tank permitting the right Solid Rocket Booster torotate around the upper attachment strut. This rotation is indicatedby divergent yaw and pitch rates between the left and right SolidRocket Boosters.

At 73.124 seconds,. a circumferential white vapor pattern wasobserved blooming from the side of the External Tank bottom dome.This was the beginning of the structural failure of hydrogen tank thatculminated in the entire aft dome dropping away. This releasedmassive amounts of liquid hydrogen from the tank and created a suddenforward thrust of about 2.8 million pounds, pushing the hydrogen tankupward into the intertank structure. At about the same time, therotating right Solid Rocket Booster impacted the intertank structureand the lower part of the liquid oxygen tank. These structures failedat 73.137 seconds as evidenced by the white vapors appearing in theintertank region.

Within milliseconds there was massive, almost explosive, burning ofthe hydrogen streaming from the failed tank bottom and liquid oxygen

breach in the area of the intertank.

At this point in its trajectory, while traveling at a Mach number of1.92 at an altitude of 46,000 feet, the Challenger was totallyenveloped in the explosive burn. The Challenger's reaction controlsystem ruptured and a hypergolic burn of its propellants occurred asit exited the oxygen-hydrogen flames. The reddish brown colors of thehypergolic fuel burn are visible on the edge of the main fireball.The Orbiter, under severe aerodynamic loads, broke into several largesections which emerged from the fireball. Separate sections that canbe identified on film include the main engine/tail section with theengines still burning, one wing of the Orbiter, and the forwardfuselage trailing a mass of umbilical lines pulled loose from thepayload bay.

Chapter 4 - THE CAUSE OF THE ACCIDENT

The consensus of the Commission and participating investigativeagencies is that the loss of the Space Shuttle Challenger was causedby a failure in the joint between the two lower segments of the rightSolid Rocket Motor. The specific failure was the destruction of theseals that are intended to prevent hot gases from leaking through thejoint during the propellant burn of the rocket motor. The evidenceassembled by the Commission indicates that no other element of theSpace Shuttle system contributed to this failure.

In arriving at this conclusion, the Commission reviewed in detailall available data, reports and records; directed and supervisednumerous tests, analyses, and experiments by NASA, civiliancontractors and various government agencies; and then developedspecific scenarios and the range of most probable causative factors.

FINDINGS

1. A combustion gas leak through the right Solid Rocket Motor aft field joint initiated at or shortly after ignition eventually weakened and/or penetrated the External Tank initiating vehicle structural breakup and loss of the Space Shuttle Challenger during STS Mission 51-L.

2. The evidence shows that no other STS 51-L Shuttle element or the payload contributed to the causes of the right Solid Rocket Motor aft field joint combustion gas leak. Sabotage was not a factor.

3. Evidence examined in the review of Space Shuttle material, manufacturing, assembly, quality control, and processing on non-conformance reports found no flight hardware shipped to the launch site that fell outside the limits of Shuttle design specifications.

4. Launch site activities, including assembly and preparation, from receipt of the flight hardware to launch were generally in accord with established procedures and were not considered a factor in the accident.

5. Launch site records show that the right Solid Rocket Motor segments were assembled using approved procedures. However, significant out-of-round conditions existed between the two segments joined at the

right Solid Rocket Motor aft field joint (the joint that failed).

a. While the assembly conditions had the potential of generating debris or damage that could cause O-ring seal failure, these were not considered factors in this accident.

b. The diameters of the two Solid Rocket Motor segments had grown as a result of prior use.

c. The growth resulted in a condition at time of launch wherein the maximum gap between the tang and clevis in the region of the joint's O-rings was no more than .008 inches and the average gap would have been .004 inches.

d. With a tang-to-clevis gap of .004 inches, the O-ring in the joint would be compressed to the extent that it pressed against all three walls of the O-ring retaining channel.

e. The lack of roundness of the segments was such that the smallest tang-to-clevis clearance occurred at the initiation of the assembly operation at positions of 120 degrees and 300 degrees around the circumference of the aft field joint. It is uncertain if this tight condition and the resultant greater compression of the O-rings at these points persisted to the time of launch.

6. The ambient temperature at time of launch was 36 degrees Fahrenheit, or 15 degrees lower than the next coldest previous launch.

a. The temperature at the 300 degree position on the right aft field joint circumference was estimated to be 28 degrees plus or minus 5 degrees Fahrenheit. This was the coldest point on the joint.

b. Temperature on the opposite side of the right Solid Rocket Booster facing the sun was estimated to be about 50 degrees Fahrenheit.

7. Other joints on the left and right Solid Rocket Boosters experienced similar combinations of tang-to-clevis gap clearance and temperature. It is not known whether these joints experienced distress during the flight of 51-L.

8. Experimental evidence indicates that due to several effects associated with the Solid Rocket Booster's ignition and combustion pressures and associated vehicle motions, the gap between the tang and the clevis will open as much as .017 and .029 inches at the secondary and primary O-rings, respectively.

a. This opening begins upon ignition, reaches its maximum rate of opening at about 200-300 milliseconds, and is essentially complete at 600 milliseconds when the Solid Rocket Booster reaches its operating pressure.

b. The External Tank and right Solid Rocket Booster are connected by several struts, including one at 310 degrees near the aft field joint that failed. This strut's effect on the joint dynamics is to enhance the opening of the gap between the tang and clevis by about

10-20 percent in the region of 300-320 degrees.

9. O-ring resiliency is directly related to its temperature.

a. A warm O-ring that has been compressed will return to its original shape much quicker than will a cold O-ring when compression is relieved. Thus, a warm O-ring will follow the opening of the tang-to-clevis gap. A cold O-ring may not.

b. A compressed O-ring at 75 degrees Fahrenheit is five times more responsive in returning to its uncompressed shape than a cold O-ring at 30 degrees Fahrenheit.

c. As a result it is probable that the O-rings in the right solid booster aft field joint were not following the opening of the gap between the tang and cleavis at time of ignition.

10. Experiments indicate that the primary mechanism that actuates O-ring sealing is the application of gas pressure to the upstream (high-pressure) side of the O-ring as it sits in its groove or channel.

a. For this pressure actuation to work most effectively, a space between the O-ring and its upstream channel wall should exist during pressurization.

b. A tang-to-clevis gap of .004 inches, as probably existed in the failed joint, would have initially compressed the O-ring to the degreethat no clearance existed between the O-ring and its upstream channel wall and the other two surfaces of the channel.

c. At the cold launch temperature experienced, the O-ring would be very slow in returning to its normal rounded shape. It would not follow the opening of the tang-to-clevis gap. It would remain in its compressed position in the O-ring channel and not provide a space between itself and the upstream channel wall. Thus, it is probable the O-ring would not be pressure actuated to seal the gap in time to preclude joint failure due to blow-by and erosion from hot combustion gases.

11. The sealing characteristics of the Solid Rocket Booster O-rings are enhanced by timely application of motor pressure.

a. Ideally, motor pressure should be applied to actuate the O-ring and seal the joint prior to significant opening of the tang-to-clevis gap (100 to 200 milliseconds after motor ignition).

b. Experimental evidence indicates that temperature, humidity and other variables in the putty compound used to seal the joint can delay pressure application to the joint by 500 milliseconds or more.

c. This delay in pressure could be a factor in initial joint failure.

12. Of 21 launches with ambient temperatures of 61 degrees Fahrenheit or greater, only four showed signs of O-ring thermal distress; i.e., erosion or blow-by and soot. Each of the launches below 61 degrees

Fahrenheit resulted in one or more O-rings showing signs of thermal distress.

a. Of these improper joint sealing actions, one-half occurred in the aft field joints, 20 percent in the center field joints, and 30 percent in the upper field joints. The division between left and right Solid Rocket Boosters was roughly equal.

b. Each instance of thermal O-ring distress was accompanied by a leak path in the insulating putty. The leak path connects the rocket's combustion chamber with the O-ring region of the tang and clevis. Joints that actuated without incident may also have had these leak paths.

13. There is a possibility that there was water in the clevis of the STS 51-L joints since water was found in the STS-9 joints during a destack operation after exposure to less rainfall than STS 51-L. At time of launch, it was cold enough that water present in the joint would freeze. Tests show that ice in the joint can inhibit proper secondary seal performance.

14. A series of puffs of smoke were observed emanating from the 51-L aft field joint area of the right Solid Rocket Booster between 0.678 and 2.500 seconds after ignition of the Shuttle Solid Rocket Motors.

a. The puffs appeared at a frequency of about three puffs per second. This roughly matches the natural structural frequency of the solids at lift off and is reflected in slight cyclic changes of the tang-to-clevis gap opening.

b. The puffs were seen to be moving upward along the surface of the booster above the aft field joint.

c. The smoke was estimated to originate at a circumferential position of between 270 degrees and 315 degrees on the booster aft field joint, emerging from the top of the joint.

15. This smoke from the aft field joint at Shuttle lift off was the first sign of the failure of the Solid Rocket Booster O-ring seals on STS 51-L.

16. The leak was again clearly evident as a flame at approximately 58 seconds into the flight. It is possible that the leak was continuous but unobservable or non-existent in portions of the intervening period. It is possible in either case that thrust vectoring and normal vehicle response to wind shear as well as planned maneuvers reinitiated or magnified the leakage from a degraded seal in the period preceding the observed flames. The estimated position of the flame, centered at a point 307 degrees around the circumference of the aft field joint, was confirmed by the recovery of two fragments of the right Solid Rocket Booster.

a. A small leak could have been present that may have grown to breach the joint in flame at a time on the order of 58 to 60 seconds after lift off.

b. Alternatively, the O-ring gap could have been resealed by

deposition of a fragile buildup of aluminum oxide and other combustion debris. This resealed section of the joint could have been disturbed by thrust vectoring, Space Shuttle motion and flight loads inducted by changing winds aloft.

c. The winds aloft caused control actions in the time interval of 32 seconds to 62 seconds into the flight that were typical of the largest values experienced on previous missions.

CONCLUSION

In view of the findings, the Commission concluded that the cause ofthe Challenger accident was the failure of the pressure seal in theaft field joint of the right Solid Rocket Booster. The failure wasdue to a faulty design unacceptably sensitive to a number of factors.These factors were the effects of temperature, physical dimensions,the character of materials, the effects of reusability, processing andthe reaction of the joint to dynamic loading.

Chapter 6 - AN ACCIDENT ROOTED IN HISTORY

EARLY DESIGN

The Space Shuttle's Solid Rocket Booster problem beganwith the faulty design of its joint and increased as both NASA andcontractor management first failed to recognize it as a problem, thenfailed to fix it and finally treated it as an acceptable flight risk.

Morton Thiokol, Inc., the contractor, did not accept the implicationof tests early in the program that the design had a serious andunanticipated flaw. NASA did not accept the judgment of its engineersthat the design was unacceptable, and as the joint problems grew innumber and severity NASA minimized them in management briefings andreports. Thiokol's stated position was that "the condition is notdesirable but is acceptable."

Neither Thiokol nor NASA expected the rubber O-rings sealing thejoints to be touched by hot gases of motor ignition, much less to bepartially burned. However, as tests and then flights confirmed damageto the sealing rings, the reaction by both NASA and Thiokol was toincrease the amount of damage considered "acceptable." At no time didmanagement either recommend a redesign of the joint or call for theShuttle's grounding until the problem was solved.

FINDINGS

The genesis of the Challenger accident -- the failure of the jointof the right Solid Rocket Motor -- began with decisions made in thedesign of the joint and in the failure by both Thiokol and NASA'sSolid Rocket Booster project office to understand and respond to factsobtained during testing.

The Commission has concluded that neither Thiokol nor NASA respondedadequately to internal warnings about the faulty seal design.Furthermore, Thiokol and NASA did not make a timely attempt to developand verify a new seal after the initial design was shown to bedeficient. Neither organization developed a solution to the

unexpected occurrences of O-ring erosion and blow-by even though thisproblem was experienced frequently during the Shuttle flight history.Instead, Thiokol and NASA management came to accept erosion andblow-by as unavoidable and an acceptable flight risk. Specifically,the Commission has found that:

1. The joint test and certification program was inadequate. Therewas no requirement to configure the qualifications test motor as itwould be in flight, and the motors were static tested in a horizontalposition, not in the vertical flight position.

2. Prior to the accident, neither NASA nor Thiokol fully understoodthe mechanism by which the joint sealing action took place.

3. NASA and Thiokol accepted escalating risk apparently because they"got away with it last time." As Commissioner Feynman observed, thedecision making was:

"a kind of Russian roulette. ... (The Shuttle) flies (with O-ringerosion) and nothing happens. Then it is suggested, therefore, thatthe risk is no longer so high for the next flights. We can lower ourstandards a little bit because we got away with it last time. ... Yougot away with it, but it shouldn't be done over and over again likethat."

4. NASA's system for tracking anomalies for Flight Readiness Reviewsfailed in that, despite a history of persistent O-ring erosion andblow-by, flight was still permitted. It failed again in the strangesequence of six consecutive launch constraint waivers prior to 51-L,permitting it to fly without any record of a waiver, or even of anexplicit constraint. Tracking and continuing only anomalies that are"outside the data base" of prior flight allowed major problems to beremoved from and lost by the reporting system.

5. The O-ring erosion history presented to Level I at NASAHeadquarters in August 1985 was sufficiently detailed to requirecorrective action prior to the next flight.

6. A careful analysis of the flight history of O-ring performancewould have revealed the correlation of O-ring damage and lowtemperature. Neither NASA nor Thiokol carried out such an analysis;consequently, they were unprepared to properly evaluate the risks oflaunching the 51-L mission in conditions more extreme than they hadencountered before.

The Space Shuttle Challenger Disaster

A failure in decision support system and human factors management

by Jeff ForrestMetropolitan State College

Forrest, J., "The Space Shuttle Challenger Disaster: A failure in decision support system and human factors management", originally prepared November 26, 1996, published October 7, 2005 at URL DSSResources.COM.

INTRODUCTION

This article discusses the environmental and human decision making factors that were associated with the launching of the Space Shuttle Challenger on January 28, 1986. Shortly after launch, the Shuttle exploded destroying the vehicle and all crew members. The cause and contributing factors that lead to the Challenger tragedy are explored in detail. Focus is placed on NASA's use of a group decision support system (GDSS) meeting to make the decision to launch.

Examples are included that show how contributing factors such as multiple priorities and demands influenced NASA from operating in a responsible and ethical manner. Proof that NASA used a flawed database in its GDSS and how it mismanaged the GDSS meeting is also offered. Finally, the inability of each GDSS member to vote anonymously on the decision to launch is discussed as a critical factor that, had it been allowed, probably would have prevented the Challenger tragedy.

THE SHUTTLE 51-L MISSION

Environmental Factors- Societal Impacts

The Space Shuttle Challenger 51-L was the 25th mission in NASA's STS program. On Jan. 28, 1986, STS 51-L exploded shortly after liftoff, destroying the vehicle and all of its seven crew members.

The STS 51-L mission was to deploy the second Tracking and Data Relay Satellite and the Spartan Halley's Comet observer. Paramount to this mission was crew member S. Christa McAuliffe - the first Space Shuttle passenger/observer participating in the NASA Teacher in Space Program (cf. [1]). Ms. McAuliffe would have conducted live educational broadcasts from the Shuttle and transmitted them to classrooms throughout the world.

The loss of life and the unique position that symbolized Christa McAuliffe as the first civilian working as a teacher in space had a profound impact on society and its attitude toward NASA and the U.S. Space programs.

As this article will explore, the tragic decision to launch STS 51-L was based on long term contributing factors and the use of a flawed group decision support system that was further aggravated by its related mismanagement. The outcome of this action created costs to society in terms of life, resources and public mistrust. NASA subsequently experienced years of setback for its related scientific research and operations.

BACKGROUND

Human Factors - Contributing to a Tragedy

Although the destruction of the Shuttle Challenger was caused by the hardware failure of a solid rocket booster (SRB) "O" ring, the human decision to launch was, in itself, flawed. The resolution to launch was based upon faulty group decision support information and further aggravated by the related mismanagement of that information. However, as in most transportation accidents, there are usually other contributing factors that help to create an environment leading to mistakes and failures. Therefore, a brief review of the contributing factors leading to the Challenger destruction is in order.

Environmental Factors - Demands on the Space Shuttle

The process of "selling" the American public and its political system the need for a reusable space transportation system began in the late 1960's. Conceptually, the Space Shuttle was introduced during the crest of the successful Apollo mission. Unlike the Apollo mission, the Space Shuttle was approved as a method for operating in space, without a firm definition of what its operational goals would be ([2] pg. 3). Here is the first contributing factor. The Shuttle was developed as a utility without a firm application. Therefore, support for such a project, both politically and economically, was not very strong. To gain political support it was sold as a project with a "quick payoff" (cf., [2]). Additional support was gained by offering the Shuttle program to the military as a means to increase national security and to industry as a tool to open new commercial opportunity. Scientists argued to the American people that the Shuttle would be an "American Voyage" ([2] pg. 10) with great scientific gain. Globally, the Shuttle was sold as a partnership with the European Space Agency (ESA) and as a means to improve national and social relations by combining peoples of different nationalities, races and sexes who would serve as crew members.

The process used to develop economic, political and social support for the shuttle introduced the second contributing factor called heterogeneous engineering. That is, the Shuttle engineering and management decisions were made to meet the needs of organizational, political, and economic factors as opposed to a single entity mission profile with specific goals ([2] pg. 9). Once functional, the Shuttle became exposed to operational demands from a multitude of users. The Shuttle now had to live up to NASA's promises. Coordinating the needs of political, commercial, military, international and scientific communities placed immense pressures on the Shuttle management team. First, political pressure to provide a reliable, reusable space vehicle with rapid turn around time and deployment seriously hindered the ability for effective systems integration and development. Secondly, it was not feasible to construct any complete management support systems (MSS) that could consider all of the factors associated with such a

diverse group of environmental variables. Third, additional uncertainty and low NASA employee moral was created when the Reagan Administration pushed for the Shuttle to be declared "operational" before the "developmental" stage had been completed [2].

After spending billions of dollars to go to the moon, Congress expected the Shuttle program to be financially self-supportive ([2] pg. 15). This forced NASA to operate as a pseudo commercial business. Therefore, the environment within NASA preceding the Challenger launch was one of conflict, stress, and short cuts [2].

NASA

Decision Support System (DSS) - Environmental Effects

The probability for disaster was growing higher as increasing demands were being placed on NASA just prior to the Challenger launch [2]. A false sense of security was felt by NASA officials, with twenty-four successful Shuttle missions to their credit. Just prior to the STS 51-L launch, NASA was an organization filled with internal strife and territorial battles([3], pg. 412). Mangers operated in an environment of "overload and turbulence" [3]. In short, NASA was characterized as having a "disease " ([3] pg.414) of decay and destruction.

As incredible as it may seem, it would appear that NASA had no formal DSS program initialized for the Shuttle operations before the Challenger launch. Evidence is strong that decisions were made primarily by "satisficing" and conscious "muddling through." Specific characteristics of decision making at the time consisted of short cuts, compromise and operational heuristics ("operational heuristics; to cannibalize existing parts" as defined by Jarman and Kouzmin [3] pg. 414). In short, NASA was operating in a phase of semi-uncontrolled decision making while trying to serve the military, industry and international research organizations with a space vehicle that had been declared operational before completion of the developmental stage [4].

NASA used decision making by default as its primary DSS. Its organizational boundary was highly political and open for manipulation by any entity that could exert political power. Upon declaring the Shuttle "operational," the Reagan Administration removed the motivation of NASA employees to manage and left them with the impression that decision making would be made by directive from political sources.

The declaration of "operational" status was the critical turning point for NASA and its management of Shuttle operations. Complacency began to grow among employees and safety considerations were traded for time spent on keeping the Shuttle on schedule and "the client of the day" satisfied. This was the environment just before the launch of STS 51-L.

THE DECISION TO LAUNCH

Group Decision Support System (GDSS) - Situational Analysis

A group support system did exist between NASA and related developers of the Shuttle. Focus in this discussion will be placed on Thiokol - the subcontractor directly responsible for the development of the SRB "O" rings. The GDSS system between NASA and Thiokol consisted of same-time/different-place conference rooms equipped with a connected and distributed computer interface. Speaker phones with audio only were also available.

On the evening of January 27, 1986, Thiokol was providing information to NASA regarding concerns for the next day's planned launch of STS 51-l. Thiokol engineers were very concerned that the abnormally cold temperatures would affect the "O" rings to nonperformance standards. The mission had already been canceled due to weather, and, as far as NASA was concerned, another cancellation due to weather was unthinkable ([4] pg. 23). Both parties were already aware that the seals on the SRB needed upgrading but did not feel that it was critical. Though the information provided by the GDSS (with an associated expert system) showed that the "O" rings would perform under the predicted temperatures, Thiokol engineers questioned their own testing and data that were programmed into the GDSS. Thus on the eve of the Challenger launch, NASA was being informed that their GDSS had a flawed data base.

At this point, NASA requested a definitive recommendation from Thiokol on whether to launch. Thiokol representatives recommended not to launch until the outside air temperature reached 53º F. The forecast for Florida did not show temperatures reaching this baseline for several days. NASA responded with pressure on Thiokol to change their decision. NASA's level III manager, Mr. Lawrence Mulloy, responded to Thiokol's decision by asking, "My God, Thiokol, when do you want me to launch, next April?" ([4] pg. 24).

After this comment the Thiokol representatives requested five minutes to go off-line from the GDSS. During this period the Thiokol management requested the chief engineer to "take off his engineering hat and put on his management cap," suggesting that organizational goals be placed ahead of safety considerations [4]. Thiokol reentered the GDSS and recommended that NASA launch. NASA asked if there were any other objections from any other GDSS member, and there was not.

Group Support System - Critical Analysis

There is little doubt that the environment from which NASA and its affiliated developers operated provided an opportunity for significant human error. Nevertheless, NASA and Thiokol had a "golden" opportunity to avoid disaster during their GDSS meeting before the STS 51-L launch. The following factors are offered as potential explanations for what created the flawed GDSS and the associated mismanagement of its information:

First, Thiokol was aware of the "O" ring problem at least several months before the Challenger launch. However, the goal was to stay on schedule. NASA was made aware of the problem but it was "down-played" as a low risk situation. Here is the first element of flawed information that was input into the GDSS. If NASA had been aware of the significance of the "O" ring situation, they probably would have given more credence to the advice of the Thiokol engineers' recommendations. However, the data transmitted during the GDSS meeting from Thiokol did say

that it would be safe to launch for the forecasted temperatures. NASA was frustrated over the conflicting advice from the same source.

Second, the decision to delay a Shuttle launch had developed into an "unwanted" decision by the members of the Shuttle team [5]. In other words, suggestions made by any group member that would ultimately support a scheduled launch were met with positive support by the group. Any suggestion that would lead to a delay was rejected by the group.

Third, all members of the GDSS felt that they should live up to the "norms" of the group. Although the Thiokol engineers were firm on their recommendation to scrub the launch, they soon changed their presentation of objections once threatened with the possibility of being expelled from the program (as suggested by a NASA administrator who was "appalled" at a company that would make such a recommendation based on the data available) [5].

Fourth, Thiokol became highly susceptible to "groupthink" when they requested a break from the GDSS. At this point they became insulated, conducted private conversations under high stress and were afraid of losing potential future revenue should they disagree with NASA. All these factors are considered prime to the formulation of "groupthink" [5].

Fifth, all parties were afraid of public and political response to another launch cancellation (there had already been six cancellations that year). Each party began to rationalize that past success equaled future success [5].

Finally, the GDSS was seriously flawed. As already mentioned, the data base contained erroneous information regarding the "O" rings. Ideas, suggestions and objections were solicited but not anonymously. Individuals who departed from the group norms were signaled out as unwelcome members. An agenda was never defined and NASA was therefore surprised by the Thiokol presentation. Conflict management was avoided by NASA's domination of the entire meeting. NASA, at times, became very assertive and intimidating. Considering NASA's attitude, no group member or individual was willing to be held accountable for any comment or decision [5].

The setting for such an important GDSS meeting was also ineffective. Considering that a speaker phone and CPU modem was used, it was easy for NASA to down-play the personal opinions of the Thiokol engineers. If the meeting could have been held at the same place for all members, the outcome might have been different. At the end of the meeting NASA, very reluctantly, suggested that they would still cancel the launch if Thiokol insisted. No response from Thiokol was made and the NASA officials could not see the expression of "self-censorship" that was being communicated on the face of each Thiokol engineer [5].

Perhaps the most significant flaw in the GDSS was when Thiokol requested a private five minute meeting with its own members. Up to this point Thiokol had stayed with its recommendation to cancel the launch. Once disconnected, Thiokol became an isolated member and the GDSS failed altogether. Once reconnected, Thiokol had changed its position and offered the go ahead to launch without any objection.

CONCLUSIONS

The Critical Human Factor - Need for Voting Tool

Many conclusions may be drawn as to the primary cause and contributing factors associated with the Challenger tragedy. It is the opinion of this author that regarding the GDSS and decision to launch the ability of each member to have voted anonymously was the key factor that would have maintained the integrity of the GDSS and the quality of the decision.

It has been shown that just after Thiokol's presentation to NASA, most of the GDSS group members were very concerned with the "O" ring situation and believed that the opinions expressed by Thiokol engineers were cause for serious consideration of launch cancellation [5]. However, only selected senior officials were allowed to vote their "opinion", which they did verbally and at the request of NASA. From the research conducted on this paper, the author believes that had a universal anonymous vote been conducted of the total GDSS membership, a decision to cancel the launch would have been made.

The factors which lead to the Challenger incident can be traced back to the inception of the shuttle program. NASA and Thiokol failed to maintain a quality assurance program through MSS, as was initiated on the Apollo program, due to multiple source demands and political pressures. The GDSS used for the launch decision contained inaccurate data. Engineering members of the GDSS did not believe in the testing procedures used to generate the data components in the GDSS. And, the entire meeting was mismanaged.

The decision to launch the Challenger Shuttle and its subsequent destruction had a major affect on society and the management of our space program. Challenger's unique mission and the death of Christa McAuliffe opened the door for discussion and research on how managers use DSS to make decisions that will affect public trust.

AFTERMATH

Ethics and MSS/DSS - Human Factors Management

A complete discussion of ethical decision making is beyond the scope of this article. However, the question of how NASA and Thiokol managed ethical considerations is central to the decision to launch the Challenger Shuttle and, therefore, deserves a brief overview.

The first area of ethical concern is the area of information accuracy. The fact that both NASA's and Thiokol's managers had little regard to the concerns of Thiokol's engineers is very distressing. All members of the group made a decision knowing that the decision was based on flawed information. A second concern is that the decision made put safety last and operational goals first. Only one member of the GDSS expressed serious concern for the potential loss of life [5]. Additionally, open and free communication before and during the GDSS meeting was discouraged through such group dynamics as mind guarding, direct pressure and self-censorship [5]. Individuals who know of a situation that, unless acted upon with integrity might cause social

harm, have a responsibility to contact any authority that will manage and control that situation in the best interest of the public ([4] "Whistleblowing, pg. 34).

Human factors analysis and management science have begun to define the incorporation of MSS/DSS as a socially responsive way of conducting business ([6] pg. 826). This is especially true for government agencies and large public projects like the Shuttle program. It could be argued that GDSS technology had not evolved to the level of effectiveness that was needed to support the Challenger project. The success of the DSS used in the prior Apollo mission shows that this was not the case. In the Challenger program social and ethical decision making was discarded for the sake of cost, schedule and outside environmental demands.

REFERENCES

[1] NASA Spacelink Challenger Press Release, http://history.nasa.gov/sts51lpresskit.pdf

[2] Launius, Roger D., "Toward an Understanding of the Space Shuttle: A Historiographical Essay". Air Power History, Winter 1992, vil. 39, no. 4.

[3] Jarman A. and Kouzmin, A., "Decision pathways from crisis. A contingency-theory simulation heuristic for the Challenger Shuttle disaster", Contemporary Crises, December 01, 1990, vol. 14, no. 4.

[4] Kramer, Ronald C. and Jaska, James A., "The Space Shuttle Disaster: Ethical Issues in Organizational Decision Making", Western Michigan University, April 1987, 39 pgs.

[5] Groupthink videorecording written by and produced by Kirby Timmons; produced by Melanie Mihal, Carlsbad, Calif., CRM Films, c 1991 25min.

[6] Turban, Efraim, Decision Support and Expert Systems, Macmillan Publishing Company, N.Y., N.Y. 1993.