2 ms·

40 years ago, a classified Shuttle mission foreshadowed Challenger's fatal flaw

11 points by LorenDB 2y ago

buildsjets 2y ago
I'd recommend that anyone who is interested in the nitty gritty details of the Challenger disaster, and anyone who is in an engineering position and signs off of safety approvals, to read "Truth, Lies, and O-Rings" by Allan McDonald. He was the Thiokol program manager who refused to sign the Thiokol safe-to-fly memo but was overruled by executives. The STS-4 erosion is discussed, as is erosion in the Minuteman missile system which has a similar joint design as the Shuttle SRB. The book is very technically detailed, probably too detailed for the non-engineering general public to appreciate. But any reader will be appalled by the corporate and government malfeasance that lead the the disaster, and the attempts that were made to cover it up. https://www.goodreads.com/en/book/show/5070507-truth-lies-and-o-rings https://www.goodreads.com/en/book/show/5070507-truth-lies-an...
- jordanb 2y ago
  I feel like a major thing that isn't really discussed is just the way the safety culture evolved (or failed to evolve) at NASA at the beginning of the shuttle program. The Mercury/Gemini/Apollo program was a crash program essentially developed with a wartime urgency (run by people who had experience with wartime development efforts). The astronauts were mostly people with military aviation and test-pilot backgrounds at a time when that was a very risky profession. There's been a lot of talk about quality fade and normalization of deviance and while that's very useful I think if you look at the history of the earlier programs, it should be clear that NASA wasn't an organization that started with high safety standards and allowed them to degrade, rather it was an organization built on a "kick the tires and light the fires" culture focused on the moonshot, who then failed to transition into an organization that could build and operate a "space airliner."
imtringued 2y ago
I hope people are aware that the O-rings are the last line of defense. Blaming the O-rings misses the fact that the entire joint design and the testing methodology were the problem. You can see people in the theregister commentsection say that the solution is to add more O-rings. But in reality you don't want redundancy in a joint like this at all. You want the metal of the joint itself and the putty applied on the interior side of the joint to form the seal. The O-ring is the redundant part! The last line of defense! Adding more O-rings just adds more joint rotation, making it worse than having even just a single O-ring.
- jordanb 2y ago
  No the O-rings were essential to prevent blowby. If the seal the o-rings provided was lost, then exhaust gasses could exit the rocket not via the nozzle. This would cause a cascading failure where the exhaust gasses would erode the structure of the booster and make the hole bigger until eventual failure. In the case of Challenger, the booster structure didn't fail completely due to blowby because the fuel tank exploded first. What you're thinking of is the fact that they used multiple O-rings to prevent blowby, but in reality only one was needed. Blowby appearing on the primary O-rings was ignored since the secondaries prevented catastrophic failure on earlier flights, but any blowby erosion on any O-ring should have been recognized as a dangerous anomaly. O-rings were the best way to seal this joint because they had a high ability to resist temperature and pressure, while remaining flexible. There's no "putty" that could be applied that would have worked better.
- buildsjets 2y ago
  Not really. The 2-ring design was designed so the second ring was a "backup", but as you note, this only increases loads that act in the direction of aiding "Joint Rotation" and hot gas leakage. The third O-Ring was added on the opposite side of the joint from the original O-rings, and the tang was re-designed with an additional clevis socket so that pressure loads are balanced to prevent "Joint Rotation". A comparison of the designs can be seen at https://www.semanticscholar.org/paper/Axisymmetric-shell-analysis-of-the-Space-Shuttle-Nemeth-Anderson/56e940967229d37eaf1256962671e3ba1c5e9ea6/figure/0 https://www.semanticscholar.org/paper/Axisymmetric-shell-ana... . McDonald's book has FEA showing the predicted clevis deflections for both configurations, and the 3 O-ring design significantly reduces the "Joint Rotation." But still, since they were continuing to the same use Viton O-rings, a resistance heater and temperature monitoring was added to address low-temperature performance. (Edit - I think this was McDonald's source for the FEA diagrams in his book - https://web.archive.org/web/20210717050737/https://ntrs.nasa.gov/api/citations/19910005305/downloads/19910005305.pdf https://web.archive.org/web/20210717050737/https://ntrs.nasa...) I've never really liked the description of the failure mechanism as "Joint Rotation" anyway. It's only rotating when you look at it in a 2D cross section. In 3D I'd call it "tang outward deflection." It's increasing in diameter, not rotating. The problem, at it's root cause, was a failure of requirements management. On the night of the launch, no one was able to identify what temperature either the SRBs or the Orbiter had been designed and qualified to. Within the specification for the SRBs, there are several low temperature requirements that conflict with each other, and were misapplied both in design, in testing, and on the night of the launch. Literally no one could say whether it was safe to launch the shuttle that night, because the requirements were not clearly defined. NB- I've personally designed and specified numerous O-ring installations in both static and dynamic aerospace applications, and done all the required DO-160 environmental testing to demonstrate that they perform as required throughout the thermal envelope. I am literally at a supplier/vendor right now doing a salt fog exposure test per DO-160.

11 points by LorenDB 2y ago

I'd recommend that anyone who is interested in the nitty gritty details of the Challenger disaster, and anyone who is in an engineering position and signs off of safety approvals, to read "Truth, Lies, and O-Rings" by Allan McDonald. He was the Thiokol program manager who refused to sign the Thiokol safe-to-fly memo but was overruled by executives. The STS-4 erosion is discussed, as is erosion in the Minuteman missile system which has a similar joint design as the Shuttle SRB. The book is very technically detailed, probably too detailed for the non-engineering general public to appreciate. But any reader will be appalled by the corporate and government malfeasance that lead the the disaster, and the attempts that were made to cover it up. https://www.goodreads.com/en/book/show/5070507-truth-lies-and-o-rings https://www.goodreads.com/en/book/show/5070507-truth-lies-an...

jordanb 2y ago
I feel like a major thing that isn't really discussed is just the way the safety culture evolved (or failed to evolve) at NASA at the beginning of the shuttle program. The Mercury/Gemini/Apollo program was a crash program essentially developed with a wartime urgency (run by people who had experience with wartime development efforts). The astronauts were mostly people with military aviation and test-pilot backgrounds at a time when that was a very risky profession. There's been a lot of talk about quality fade and normalization of deviance and while that's very useful I think if you look at the history of the earlier programs, it should be clear that NASA wasn't an organization that started with high safety standards and allowed them to degrade, rather it was an organization built on a "kick the tires and light the fires" culture focused on the moonshot, who then failed to transition into an organization that could build and operate a "space airliner."

imtringued 2y ago

I hope people are aware that the O-rings are the last line of defense. Blaming the O-rings misses the fact that the entire joint design and the testing methodology were the problem. You can see people in the theregister commentsection say that the solution is to add more O-rings. But in reality you don't want redundancy in a joint like this at all. You want the metal of the joint itself and the putty applied on the interior side of the joint to form the seal. The O-ring is the redundant part! The last line of defense! Adding more O-rings just adds more joint rotation, making it worse than having even just a single O-ring.

jordanb 2y ago
No the O-rings were essential to prevent blowby. If the seal the o-rings provided was lost, then exhaust gasses could exit the rocket not via the nozzle. This would cause a cascading failure where the exhaust gasses would erode the structure of the booster and make the hole bigger until eventual failure. In the case of Challenger, the booster structure didn't fail completely due to blowby because the fuel tank exploded first. What you're thinking of is the fact that they used multiple O-rings to prevent blowby, but in reality only one was needed. Blowby appearing on the primary O-rings was ignored since the secondaries prevented catastrophic failure on earlier flights, but any blowby erosion on any O-ring should have been recognized as a dangerous anomaly. O-rings were the best way to seal this joint because they had a high ability to resist temperature and pressure, while remaining flexible. There's no "putty" that could be applied that would have worked better.
buildsjets 2y ago
Not really. The 2-ring design was designed so the second ring was a "backup", but as you note, this only increases loads that act in the direction of aiding "Joint Rotation" and hot gas leakage. The third O-Ring was added on the opposite side of the joint from the original O-rings, and the tang was re-designed with an additional clevis socket so that pressure loads are balanced to prevent "Joint Rotation". A comparison of the designs can be seen at https://www.semanticscholar.org/paper/Axisymmetric-shell-analysis-of-the-Space-Shuttle-Nemeth-Anderson/56e940967229d37eaf1256962671e3ba1c5e9ea6/figure/0 https://www.semanticscholar.org/paper/Axisymmetric-shell-ana... . McDonald's book has FEA showing the predicted clevis deflections for both configurations, and the 3 O-ring design significantly reduces the "Joint Rotation." But still, since they were continuing to the same use Viton O-rings, a resistance heater and temperature monitoring was added to address low-temperature performance. (Edit - I think this was McDonald's source for the FEA diagrams in his book - https://web.archive.org/web/20210717050737/https://ntrs.nasa.gov/api/citations/19910005305/downloads/19910005305.pdf https://web.archive.org/web/20210717050737/https://ntrs.nasa...) I've never really liked the description of the failure mechanism as "Joint Rotation" anyway. It's only rotating when you look at it in a 2D cross section. In 3D I'd call it "tang outward deflection." It's increasing in diameter, not rotating. The problem, at it's root cause, was a failure of requirements management. On the night of the launch, no one was able to identify what temperature either the SRBs or the Orbiter had been designed and qualified to. Within the specification for the SRBs, there are several low temperature requirements that conflict with each other, and were misapplied both in design, in testing, and on the night of the launch. Literally no one could say whether it was safe to launch the shuttle that night, because the requirements were not clearly defined. NB- I've personally designed and specified numerous O-ring installations in both static and dynamic aerospace applications, and done all the required DO-160 environmental testing to demonstrate that they perform as required throughout the thermal envelope. I am literally at a supplier/vendor right now doing a salt fog exposure test per DO-160.