Remembering STS-51L Challenger


Just after liftoff at .678 seconds into the flight, photographic data show a strong puff of gray smoke was spurting from the vicinity of the aft field joint on the right Solid Rocket Booster. Computer graphic analysis of film from pad cameras indicated the initial smoke came from the 270 to 310-degree sector of the circumference of the aft field joint of the right Solid Rocket Booster. This area of the solid booster faces the External Tank. The vaporized material streaming from the joint indicated there was not complete sealing action within the joint. Eight more distinctive puffs of increasingly blacker smoke were recorded between .836 and 2.500 seconds. The smoke appeared to puff upwards from the joint. While each smoke puff was being left behind by the upward flight of the Shuttle, the next fresh puff could be seen near the level of the joint. The multiple smoke puffs in this sequence occurred at about four times per second, approximating the frequency of the structural load dynamics and resultant joint flexing. As the Shuttle increased its upward velocity, it flew past the emerging and expanding smoke puffs. The last smoke was seen above the field joint at 2.733 seconds. The black color and dense composition of the smoke puffs suggest that the grease, joint insulation and rubber O-rings in the joint seal were being burned and eroded by the hotpropellant gases. At approximately 37 seconds, Challenger encountered the first of several high-altitude wind shear conditions, which lasted until about 64 seconds. The wind shear created forces on the vehicle with relatively large fluctuations. These were immediately sensed and countered by the guidance, navigation and control system. The steering system (thrust vector control) of the Solid Rocket Booster responded to all commands and wind shear effects. The wind shear caused the steering system to be more active than on any previous flight. Both the Shuttle main engines and the solid rockets operated at reduced thrust approaching and passing through the area of maximum dynamic pressure of 720 pounds per square foot. Main engines had been throttled up to 104 percent thrust and the Solid Rocket Boosterswere increasing their thrust when the first flickering flame appeared on the right Solid Rocket Booster in the area of the aft field joint. This first very small flame was detected on image enhanced film at 58.788 seconds into the flight. It appeared to originate at about 305 degrees around the booster circumference at or near the aft field joint. One film frame later from the same camera, the flame was visible without image enhancement. It grew into a continuous, well-defined plume at 59.262 seconds. At about the same time (60 seconds), telemetry showed a pressure differential between the chamber pressures in the right and left boosters. The right booster chamber pressure was lower, confirming the growing leak in the area of the field joint. As the flame plume increased in size, it was deflected rearward by the aerodynamic slipstream and circumferentially by the protruding structure of the upper ring attaching the booster to the External Tank. These deflections directed the flame plume onto the surface of the External Tank. This sequence of flame spreading is confirmed by analysis of the recovered wreckage. The growing flame also impinged on the strut attaching the Solid Rocket Booster to the External Tank. The first visual indication that swirling flame from the right Solid Rocket Booster breached the External Tank was at 64.660 seconds when there was an abrupt change in the shape and color of the plume. This indicated that it was mixing with leaking hydrogen from the External Tank. Telemetered changes in the hydrogen tank pressurization confirmed the leak. Within 45 milliseconds of the breach of the External Tank, a bright sustained glow developed on the black-tiled underside of the Challenger between it and the External Tank. Beginning at about 72 seconds, a series of events occurred extremely rapidly that terminated the flight. Telemetered data indicate a wide variety of flight system actions that support the visual evidence of the photos as the Shuttle struggled futilely against the forces that were destroying it. At about 72.20 seconds the lower strut linking the Solid Rocket Booster and the External Tank was severed or pulled away from the weakened hydrogen tank permitting the right Solid Rocket Booster to rotate around the upper attachment strut. This rotation is indicated by divergent yaw and pitch rates between the left and right Solid Rocket Boosters. At 73.124 seconds,. a circumferential white vapor pattern was observed blooming from the side of the External Tank bottom dome. This was the beginning of the structural failure of hydrogen tank that culminated in the entire aft dome dropping away. This released massive amounts of liquid hydrogen from the tank and created a sudden forward thrust of about 2.8 million pounds, pushing the hydrogen tank upward into the intertank structure. At about the same time, the rotating right Solid Rocket Booster impacted the intertank structure and the lower part of the liquid oxygen tank. These structures failed at 73.137 seconds as evidenced by the white vapors appearing in the intertank region. Within milliseconds there was massive, almost explosive, burning of the hydrogen streaming from the failed tank bottom and liquid oxygen breach in the area of the intertank. At this point in its trajectory, while traveling at a Mach number of 1.92 at an altitude of 46,000 feet, the Challenger was totally enveloped in the explosive burn. The Challenger's reaction control system ruptured and a hypergolic burn of its propellants occurred as it exited the oxygen-hydrogen flames. The reddish brown colors of the hypergolic fuel burn are visible on the edge of the main fireball. The Orbiter, under severe aerodynamic loads, broke into several large sections which emerged from the fireball. Separate sections that can be identified on film include the main engine/tail section with the engines still burning, one wing of the Orbiter, and the forward fuselage trailing a mass of umbilical lines pulled loose from the payload bay. The Explosion 73 seconds after liftoff claimed crew and vehicle. Cause of explosion was determined to be an O-ring failure in right SRB. Cold weather was a contributing factor. Launch Weight: 268,829 lbs. A failure in decision support system and human factors management by Jeff Forrest Metropolitan State College INTRODUCTION This article discusses the environmental and human decision making factors that were associated with the launching of the Space Shuttle Challenger on January 28, 1986. Shortly after launch, the Shuttle exploded destroying the vehicle and all crew members. The cause and contributing factors that lead to the Challenger tragedy are explored in detail. Focus is placed on NASA's use of a group decision support system (GDSS) meeting to make the decision to launch. Examples are included that show how contributing factors such as multiple priorities and demands influenced NASA from operating in a responsible and ethical manner. Proof that NASA used a flawed database in its GDSS and how it mismanaged the GDSS meeting is also offered. Finally, the inability of each GDSS member to vote anonymously on the decision to launch is discussed as a critical factor that, had it been allowed, probably would have prevented the Challenger tragedy. THE SHUTTLE 51-L MISSION Environmental Factors- Societal Impacts The Space Shuttle Challenger 51-L was the 25th mission in NASA's STS program. On Jan. 28, 1986, STS 51-L exploded shortly after liftoff, destroying the vehicle and all of its seven crew members. The STS 51-L mission was to deploy the second Tracking and Data Relay Satellite and the Spartan Halley's Comet observer. Paramount to this mission was crew member S. Christa McAuliffe - the first Space Shuttle passenger/observer participating in the NASA Teacher in Space Program (cf. [1]). Ms. McAuliffe would have conducted live educational broadcasts from the Shuttle and transmitted them to classrooms throughout the world. The loss of life and the unique position that symbolized Christa McAuliffe as the first civilian working as a teacher in space had a profound impact on society and its attitude toward NASA and the U.S. Space programs. As this article will explore, the tragic decision to launch STS 51-L was based on long term contributing factors and the use of a flawed group decision support system that was further aggravated by its related mismanagement. The outcome of this action created costs to society in terms of life, resources and public mistrust. NASA subsequently experienced years of setback for its related scientific research and operations. BACKGROUND Human Factors - Contributing to a Tragedy Although the destruction of the Shuttle Challenger was caused by the hardware failure of a solid rocket booster (SRB) "O" ring, the human decision to launch was, in itself, flawed. The resolution to launch was based upon faulty group decision support information and further aggravated by the related mismanagement of that information. However, as in most transportation accidents, there are usually other contributing factors that help to create an environment leading to mistakes and failures. Therefore, a brief review of the contributing factors leading to the Challenger destruction is in order. Environmental Factors - Demands on the Space Shuttle The process of "selling" the American public and its political system the need for a reusable space transportation system began in the late 1960's. Conceptually, the Space Shuttle was introduced during the crest of the successful Apollo mission. Unlike the Apollo mission, the Space Shuttle was approved as a method for operating in space, without a firm definition of what its operational goals would be ([2] pg. 3). Here is the first contributing factor. The Shuttle was developed as a utility without a firm application. Therefore, support for such a project, both politically and economically, was not very strong. To gain political support it was sold as a project with a "quick payoff" (cf., [2]). Additional support was gained by offering the Shuttle program to the military as a means to increase national security and to industry as a tool to open new commercial opportunity. Scientists argued to the American people that the Shuttle would be an "American Voyage" ([2] pg. 10) with great scientific gain. Globally, the Shuttle was sold as a partnership with the European Space Agency (ESA) and as a means to improve national and social relations by combining peoples of different nationalities, races and sexes who would serve as crew members. The process used to develop economic, political and social support for the shuttle introduced the second contributing factor called heterogeneous engineering. That is, the Shuttle engineering and management decisions were made to meet the needs of organizational, political, and economic factors as opposed to a single entity mission profile with specific goals ([2] pg. 9). Once functional, the Shuttle became exposed to operational demands from a multitude of users. The Shuttle now had to live up to NASA's promises. Coordinating the needs of political, commercial, military, international and scientific communities placed immense pressures on the Shuttle management team. First, political pressure to provide a reliable, reusable space vehicle with rapid turn around time and deployment seriously hindered the ability for effective systems integration and development. Secondly, it was not feasible to construct any complete management support systems (MSS) that could consider all of the factors associated with such a diverse group of environmental variables. Third, additional uncertainty and low NASA employee moral was created when the Reagan Administration pushed for the Shuttle to be declared "operational" before the "developmental" stage had been completed [2]. After spending billions of dollars to go to the moon, Congress expected the Shuttle program to be financially self-supportive ([2] pg. 15). This forced NASA to operate as a pseudo commercial business. Therefore, the environment within NASA preceding the Challenger launch was one of conflict, stress, and short cuts [2]. NASA Decision Support System (DSS) - Environmental Effects The probability for disaster was growing higher as increasing demands were being placed on NASA just prior to the Challenger launch [2]. A false sense of security was felt by NASA officials, with twenty-four successful Shuttle missions to their credit. Just prior to the STS 51-L launch, NASA was an organization filled with internal strife and territorial battles([3], pg. 412). Mangers operated in an environment of "overload and turbulence" [3]. In short, NASA was characterized as having a "disease " ([3] pg.414) of decay and destruction. As incredible as it may seem, it would appear that NASA had no formal DSS program initialized for the Shuttle operations before the Challenger launch. Evidence is strong that decisions were made primarily by "satisficing" and conscious "muddling through." Specific characteristics of decision making at the time consisted of short cuts, compromise and operational heuristics ("operational heuristics; to cannibalize existing parts" as defined by Jarman and Kouzmin [3] pg. 414). In short, NASA was operating in a phase of semi-uncontrolled decision making while trying to serve the military, industry and international research organizations with a space vehicle that had been declared operational before completion of the developmental stage [4]. NASA used decision making by default as its primary DSS. Its organizational boundary was highly political and open for manipulation by any entity that could exert political power. Upon declaring the Shuttle "operational," the Reagan Administration removed the motivation of NASA employees to manage and left them with the impression that decision making would be made by directive from political sources. The declaration of "operational" status was the critical turning point for NASA and its management of Shuttle operations. Complacency began to grow among employees and safety considerations were traded for time spent on keeping the Shuttle on schedule and "the client of the day" satisfied. This was the environment just before the launch of STS 51-L. THE DECISION TO LAUNCH Group Decision Support System (GDSS) - Situational Analysis A group support system did exist between NASA and related developers of the Shuttle. Focus in this discussion will be placed on Thiokol - the subcontractor directly responsible for the development of the SRB "O" rings. The GDSS system between NASA and Thiokol consisted of same-time/different-place conference rooms equipped with a connected and distributed computer interface. Speaker phones with audio only were also available. On the evening of January 27, 1986, Thiokol was providing information to NASA regarding concerns for the next day's planned launch of STS 51-l. Thiokol engineers were very concerned that the abnormally cold temperatures would affect the "O" rings to nonperformance standards. The mission had already been canceled due to weather, and, as far as NASA was concerned, another cancellation due to weather was unthinkable ([4] pg. 23). Both parties were already aware that the seals on the SRB needed upgrading but did not feel that it was critical. Though the information provided by the GDSS (with an associated expert system) showed that the "O" rings would perform under the predicted temperatures, Thiokol engineers questioned their own testing and data that were programmed into the GDSS. Thus on the eve of the Challenger launch, NASA was being informed that their GDSS had a flawed data base. At this point, NASA requested a definitive recommendation from Thiokol on whether to launch. Thiokol representatives recommended not to launch until the outside air temperature reached 53º F. The forecast for Florida did not show temperatures reaching this baseline for several days. NASA responded with pressure on Thiokol to change their decision. NASA's level III manager, Mr. Lawrence Mulloy, responded to Thiokol's decision by asking, "My God, Thiokol, when do you want me to launch, next April?" ([4] pg. 24). After this comment the Thiokol representatives requested five minutes to go off-line from the GDSS. During this period the Thiokol management requested the chief engineer to "take off his engineering hat and put on his management cap," suggesting that organizational goals be placed ahead of safety considerations [4]. Thiokol reentered the GDSS and recommended that NASA launch. NASA asked if there were any other objections from any other GDSS member, and there was not. Group Support System - Critical Analysis There is little doubt that the environment from which NASA and its affiliated developers operated provided an opportunity for significant human error. Nevertheless, NASA and Thiokol had a "golden" opportunity to avoid disaster during their GDSS meeting before the STS 51-L launch. The following factors are offered as potential explanations for what created the flawed GDSS and the associated mismanagement of its information: First, Thiokol was aware of the "O" ring problem at least several months before the Challenger launch. However, the goal was to stay on schedule. NASA was made aware of the problem but it was "down-played" as a low risk situation. Here is the first element of flawed information that was input into the GDSS. If NASA had been aware of the significance of the "O" ring situation, they probably would have given more credence to the advice of the Thiokol engineers' recommendations. However, the data transmitted during the GDSS meeting from Thiokol did say that it would be safe to launch for the forecasted temperatures. NASA was frustrated over the conflicting advice from the same source. Second, the decision to delay a Shuttle launch had developed into an "unwanted" decision by the members of the Shuttle team [5]. In other words, suggestions made by any group member that would ultimately support a scheduled launch were met with positive support by the group. Any suggestion that would lead to a delay was rejected by the group. Third, all members of the GDSS felt that they should live up to the "norms" of the group. Although the Thiokol engineers were firm on their recommendation to scrub the launch, they soon changed their presentation of objections once threatened with the possibility of being expelled from the program (as suggested by a NASA administrator who was "appalled" at a company that would make such a recommendation based on the data available) [5]. Fourth, Thiokol became highly susceptible to "groupthink" when they requested a break from the GDSS. At this point they became insulated, conducted private conversations under high stress and were afraid of losing potential future revenue should they disagree with NASA. All these factors are considered prime to the formulation of "groupthink" [5]. Fifth, all parties were afraid of public and political response to another launch cancellation (there had already been six cancellations that year). Each party began to rationalize that past success equaled future success [5]. Finally, the GDSS was seriously flawed. As already mentioned, the data base contained erroneous information regarding the "O" rings. Ideas, suggestions and objections were solicited but not anonymously. Individuals who departed from the group norms were signaled out as unwelcome members. An agenda was never defined and NASA was therefore surprised by the Thiokol presentation. Conflict management was avoided by NASA's domination of the entire meeting. NASA, at times, became very assertive and intimidating. Considering NASA's attitude, no group member or individual was willing to be held accountable for any comment or decision [5]. The setting for such an important GDSS meeting was also ineffective. Considering that a speaker phone and CPU modem was used, it was easy for NASA to down-play the personal opinions of the Thiokol engineers. If the meeting could have been held at the same place for all members, the outcome might have been different. At the end of the meeting NASA, very reluctantly, suggested that they would still cancel the launch if Thiokol insisted. No response from Thiokol was made and the NASA officials could not see the expression of "self-censorship" that was being communicated on the face of each Thiokol engineer [5]. Perhaps the most significant flaw in the GDSS was when Thiokol requested a private five minute meeting with its own members. Up to this point Thiokol had stayed with its recommendation to cancel the launch. Once disconnected, Thiokol became an isolated member and the GDSS failed altogether. Once reconnected, Thiokol had changed its position and offered the go ahead to launch without any objection. CONCLUSIONS The Critical Human Factor - Need for Voting Tool Many conclusions may be drawn as to the primary cause and contributing factors associated with the Challenger tragedy. It is the opinion of this author that regarding the GDSS and decision to launch the ability of each member to have voted anonymously was the key factor that would have maintained the integrity of the GDSS and the quality of the decision. It has been shown that just after Thiokol's presentation to NASA, most of the GDSS group members were very concerned with the "O" ring situation and believed that the opinions expressed by Thiokol engineers were cause for serious consideration of launch cancellation [5]. However, only selected senior officials were allowed to vote their "opinion", which they did verbally and at the request of NASA. From the research conducted on this paper, the author believes that had a universal anonymous vote been conducted of the total GDSS membership, a decision to cancel the launch would have been made. The factors which lead to the Challenger incident can be traced back to the inception of the shuttle program. NASA and Thiokol failed to maintain a quality assurance program through MSS, as was initiated on the Apollo program, due to multiple source demands and political pressures. The GDSS used for the launch decision contained inaccurate data. Engineering members of the GDSS did not believe in the testing procedures used to generate the data components in the GDSS. And, the entire meeting was mismanaged. The decision to launch the Challenger Shuttle and its subsequent destruction had a major affect on society and the management of our space program. Challenger's unique mission and the death of Christa McAuliffe opened the door for discussion and research on how managers use DSS to make decisions that will affect public trust. AFTERMATH Ethics and MSS/DSS - Human Factors Management A complete discussion of ethical decision making is beyond the scope of this article. However, the question of how NASA and Thiokol managed ethical considerations is central to the decision to launch the Challenger Shuttle and, therefore, deserves a brief overview. The first area of ethical concern is the area of information accuracy. The fact that both NASA's and Thiokol's managers had little regard to the concerns of Thiokol's engineers is very distressing. All members of the group made a decision knowing that the decision was based on flawed information. A second concern is that the decision made put safety last and operational goals first. Only one member of the GDSS expressed serious concern for the potential loss of life [5]. Additionally, open and free communication before and during the GDSS meeting was discouraged through such group dynamics as mind guarding, direct pressure and self-censorship [5]. Individuals who know of a situation that, unless acted upon with integrity might cause social harm, have a responsibility to contact any authority that will manage and control that situation in the best interest of the public ([4] "Whistleblowing, pg. 34). Human factors analysis and management science have begun to define the incorporation of MSS/DSS as a socially responsive way of conducting business ([6] pg. 826). This is especially true for government agencies and large public projects like the Shuttle program. It could be argued that GDSS technology had not evolved to the level of effectiveness that was needed to support the Challenger project. The success of the DSS used in the prior Apollo mission shows that this was not the case. In the Challenger program social and ethical decision making was discarded for the sake of cost, schedule and outside environmental demands. REFERENCES [1] NASA Spacelink Challenger Press Release, http://history.nasa.gov/sts51lpresskit.pdf [2] Launius, Roger D., "Toward an Understanding of the Space Shuttle: A Historiographical Essay". Air Power History, Winter 1992, vil. 39, no. 4. [3] Jarman A. and Kouzmin, A., "Decision pathways from crisis. A contingency-theory simulation heuristic for the Challenger Shuttle disaster", Contemporary Crises, December 01, 1990, vol. 14, no. 4. [4] Kramer, Ronald C. and Jaska, James A., "The Space Shuttle Disaster: Ethical Issues in Organizational Decision Making", Western Michigan University, April 1987, 39 pgs. [5] Groupthink videorecording written by and produced by Kirby Timmons; produced by Melanie Mihal, Carlsbad, Calif., CRM Films, c 1991 25min. [6] Turban, Efraim, Decision Support and Expert Systems, Macmillan Publishing Company, N.Y., N.Y. 1993. Editor's Note The NASA history site on the Challenger STS 51-L Accident at http://history.nasa.gov/sts51l.html links to many resources including Jeff Forrest's analysis. Reader's are especially encouraged to read and review the Report of the Presidential Commission on the Space Shuttle Challenger Accident (commonly called the Rogers Commission Report), June 1986 and the Implementations of the Recommendations, June 1987. The GDSS was an audio teleconference. The slides had been faxed to the NASA meeting site. Mr. Mulloy of NASA testified that Mr. Kilminster of Thiokol requested the 5 minute off-net caucus that ultimately lasted approximately 30 minutes. The opinions in this analysis are those of the author and not necessarily those of the Editor or of DSSResources.com. Some Questions for Further Analysis and Discussion 1. What is a group decision support system? 2. Did NASA and Thiokol use a GDSS? 3. Did the group decision support system fail or was the problem with the participants? 4. What do you think was the cause of the decision-making failure in this situation? 5. Could improved GDSS technology have avoided this tragedy? If so what was needed? Video, anonymous voting? Web links 1. http://www.aerospaceweb.org/question/investigations/q0122.shtml 2. http://history.nasa.gov/sts51l.html ________________________________________ Please cite as: Forrest, J., "The Space Shuttle Challenger Disaster: A failure in decision support system and human factors management", originally prepared November 26, 1996, published October 7, 2005 at URL DSSResources.COM.

Just after liftoff at .678 seconds into the flight, photographic data show a strong puff of gray smoke was spurting from the vicinity of the aft field joint on the right Solid Rocket Booster. Computer graphic analysis of film from pad cameras indicated the initial smoke came from the 270 to 310-degree sector of the circumference of the aft field joint of the right Solid Rocket Booster. This area of the solid booster faces the External Tank. The vaporized material streaming from the joint indicated there was not complete sealing action within the joint.

Eight more distinctive puffs of increasingly blacker smoke were recorded between .836 and 2.500 seconds. The smoke appeared to puff upwards from the joint. While each smoke puff was being left behind by the upward flight of the Shuttle, the next fresh puff could be seen near the level of the joint. The multiple smoke puffs in this sequence occurred at about four times per second, approximating the frequency of the structural load dynamics and resultant joint flexing. As the Shuttle increased its upward velocity, it flew past the emerging and expanding smoke puffs. The last smoke was seen above the field joint at 2.733 seconds.

The black color and dense composition of the smoke puffs suggest that the grease, joint insulation and rubber O-rings in the joint seal were being burned and eroded by the hotpropellant gases.

At approximately 37 seconds, Challenger encountered the first of several high-altitude wind shear conditions, which lasted until about 64 seconds. The wind shear created forces on the vehicle with relatively large fluctuations. These were immediately sensed and countered by the guidance, navigation and control system. The steering system (thrust vector control) of the Solid Rocket Booster responded to all commands and wind shear effects. The wind shear caused the steering system to be more active than on any previous flight.

Both the Shuttle main engines and the solid rockets operated at reduced thrust approaching and passing through the area of maximum dynamic pressure of 720 pounds per square foot. Main engines had been throttled up to 104 percent thrust and the Solid Rocket Boosterswere increasing their thrust when the first flickering flame appeared on the right Solid Rocket Booster in the area of the aft field joint. This first very small flame was detected on image enhanced film at 58.788 seconds into the flight. It appeared to originate at about 305 degrees around the booster circumference at or near the aft field joint.
One film frame later from the same camera, the flame was visible without image enhancement. It grew into a continuous, well-defined plume at 59.262 seconds. At about the same time (60 seconds), telemetry showed a pressure differential between the chamber pressures in the right and left boosters. The right booster chamber pressure was lower, confirming the growing leak in the area of the field joint.

As the flame plume increased in size, it was deflected rearward by the aerodynamic slipstream and circumferentially by the protruding structure of the upper ring attaching the booster to the External Tank. These deflections directed the flame plume onto the surface of the External Tank. This sequence of flame spreading is confirmed by analysis of the recovered wreckage. The growing flame also impinged on the strut attaching the Solid Rocket Booster to the External Tank.

The first visual indication that swirling flame from the right Solid Rocket Booster breached the External Tank was at 64.660 seconds when there was an abrupt change in the shape and color of the plume. This indicated that it was mixing with leaking hydrogen from the External Tank. Telemetered changes in the hydrogen tank pressurization confirmed the leak. Within 45 milliseconds of the breach of the External Tank, a bright sustained glow developed on the black-tiled underside of the Challenger between it and the External Tank.

Beginning at about 72 seconds, a series of events occurred extremely rapidly that terminated the flight. Telemetered data indicate a wide variety of flight system actions that support the visual evidence of the photos as the Shuttle struggled futilely against the forces that were destroying it.
At about 72.20 seconds the lower strut linking the Solid Rocket Booster and the External Tank was severed or pulled away from the weakened hydrogen tank permitting the right Solid Rocket Booster to rotate around the upper attachment strut. This rotation is indicated by divergent yaw and pitch rates between the left and right Solid Rocket Boosters.

At 73.124 seconds,. a circumferential white vapor pattern was observed blooming from the side of the External Tank bottom dome. This was the beginning of the structural failure of hydrogen tank that culminated in the entire aft dome dropping away. This released massive amounts of liquid hydrogen from the tank and created a sudden forward thrust of about 2.8 million pounds, pushing the hydrogen tank upward into the intertank structure. At about the same time, the rotating right Solid Rocket Booster impacted the intertank structure and the lower part of the liquid oxygen tank. These structures failed at 73.137 seconds as evidenced by the white vapors appearing in the intertank region.

Within milliseconds there was massive, almost explosive, burning of the hydrogen streaming from the failed tank bottom and liquid oxygen breach in the area of the intertank.

At this point in its trajectory, while traveling at a Mach number of 1.92 at an altitude of 46,000 feet, the Challenger was totally enveloped in the explosive burn. The Challenger's reaction control system ruptured and a hypergolic burn of its propellants occurred as it exited the oxygen-hydrogen flames. The reddish brown colors of the hypergolic fuel burn are visible on the edge of the main fireball. The Orbiter, under severe aerodynamic loads, broke into several large sections which emerged from the fireball. Separate sections that can be identified on film include the main engine/tail section with the engines still burning, one wing of the Orbiter, and the forward fuselage trailing a mass of umbilical lines pulled loose from the payload bay.

The Explosion 73 seconds after liftoff claimed crew and vehicle. Cause of explosion was determined to be an O-ring failure in right SRB. Cold weather was a contributing factor. Launch Weight: 268,829 lbs.
A failure in decision support system and human factors management
by Jeff Forrest
Metropolitan State College
INTRODUCTION

This article discusses the environmental and human decision making factors that were associated with the launching of the Space Shuttle Challenger on January 28, 1986. Shortly after launch, the Shuttle exploded destroying the vehicle and all crew members. The cause and contributing factors that lead to the Challenger tragedy are explored in detail. Focus is placed on NASA's use of a group decision support system (GDSS) meeting to make the decision to launch.
Examples are included that show how contributing factors such as multiple priorities and demands influenced NASA from operating in a responsible and ethical manner. Proof that NASA used a flawed database in its GDSS and how it mismanaged the GDSS meeting is also offered. Finally, the inability of each GDSS member to vote anonymously on the decision to launch is discussed as a critical factor that, had it been allowed, probably would have prevented the Challenger tragedy.

THE SHUTTLE 51-L MISSION
Environmental Factors- Societal Impacts
The Space Shuttle Challenger 51-L was the 25th mission in NASA's STS program. On Jan. 28, 1986, STS 51-L exploded shortly after liftoff, destroying the vehicle and all of its seven crew members.
The STS 51-L mission was to deploy the second Tracking and Data Relay Satellite and the Spartan Halley's Comet observer. Paramount to this mission was crew member S. Christa McAuliffe - the first Space Shuttle passenger/observer participating in the NASA Teacher in Space Program (cf. [1]). Ms. McAuliffe would have conducted live educational broadcasts from the Shuttle and transmitted them to classrooms throughout the world.

The loss of life and the unique position that symbolized Christa McAuliffe as the first civilian working as a teacher in space had a profound impact on society and its attitude toward NASA and the U.S. Space programs.

As this article will explore, the tragic decision to launch STS 51-L was based on long term contributing factors and the use of a flawed group decision support system that was further aggravated by its related mismanagement. The outcome of this action created costs to society in terms of life, resources and public mistrust. NASA subsequently experienced years of setback for its related scientific research and operations.

BACKGROUND
Human Factors - Contributing to a Tragedy
Although the destruction of the Shuttle Challenger was caused by the hardware failure of a solid rocket booster (SRB) "O" ring, the human decision to launch was, in itself, flawed. The resolution to launch was based upon faulty group decision support information and further aggravated by the related mismanagement of that information. However, as in most transportation accidents, there are usually other contributing factors that help to create an environment leading to mistakes and failures. Therefore, a brief review of the contributing factors leading to the Challenger destruction is in order.
Environmental Factors - Demands on the Space Shuttle

The process of "selling" the American public and its political system the need for a reusable space transportation system began in the late 1960's. Conceptually, the Space Shuttle was introduced during the crest of the successful Apollo mission. Unlike the Apollo mission, the Space Shuttle was approved as a method for operating in space, without a firm definition of what its operational goals would be ([2] pg. 3). Here is the first contributing factor. The Shuttle was developed as a utility without a firm application. Therefore, support for such a project, both politically and economically, was not very strong. To gain political support it was sold as a project with a "quick payoff" (cf., [2]). Additional support was gained by offering the Shuttle program to the military as a means to increase national security and to industry as a tool to open new commercial opportunity. Scientists argued to the American people that the Shuttle would be an "American Voyage" ([2] pg. 10) with great scientific gain. Globally, the Shuttle was sold as a partnership with the European Space Agency (ESA) and as a means to improve national and social relations by combining peoples of different nationalities, races and sexes who would serve as crew members.

The process used to develop economic, political and social support for the shuttle introduced the second contributing factor called heterogeneous engineering. That is, the Shuttle engineering and management decisions were made to meet the needs of organizational, political, and economic factors as opposed to a single entity mission profile with specific goals ([2] pg. 9). Once functional, the Shuttle became exposed to operational demands from a multitude of users. The Shuttle now had to live up to NASA's promises. Coordinating the needs of political, commercial, military, international and scientific communities placed immense pressures on the Shuttle management team. First, political pressure to provide a reliable, reusable space vehicle with rapid turn around time and deployment seriously hindered the ability for effective systems integration and development. Secondly, it was not feasible to construct any complete management support systems (MSS) that could consider all of the factors associated with such a diverse group of environmental variables. Third, additional uncertainty and low NASA employee moral was created when the Reagan Administration pushed for the Shuttle to be declared "operational" before the "developmental" stage had been completed [2].

After spending billions of dollars to go to the moon, Congress expected the Shuttle program to be financially self-supportive ([2] pg. 15). This forced NASA to operate as a pseudo commercial business. Therefore, the environment within NASA preceding the Challenger launch was one of conflict, stress, and short cuts [2].

NASA
Decision Support System (DSS) - Environmental Effects
The probability for disaster was growing higher as increasing demands were being placed on NASA just prior to the Challenger launch [2]. A false sense of security was felt by NASA officials, with twenty-four successful Shuttle missions to their credit. Just prior to the STS 51-L launch, NASA was an organization filled with internal strife and territorial battles([3], pg. 412). Mangers operated in an environment of "overload and turbulence" [3]. In short, NASA was characterized as having a "disease " ([3] pg.414) of decay and destruction.

As incredible as it may seem, it would appear that NASA had no formal DSS program initialized for the Shuttle operations before the Challenger launch. Evidence is strong that decisions were made primarily by "satisficing" and conscious "muddling through." Specific characteristics of decision making at the time consisted of short cuts, compromise and operational heuristics ("operational heuristics; to cannibalize existing parts" as defined by Jarman and Kouzmin [3] pg. 414). In short, NASA was operating in a phase of semi-uncontrolled decision making while trying to serve the military, industry and international research organizations with a space vehicle that had been declared operational before completion of the developmental stage [4].

NASA used decision making by default as its primary DSS. Its organizational boundary was highly political and open for manipulation by any entity that could exert political power. Upon declaring the Shuttle "operational," the Reagan Administration removed the motivation of NASA employees to manage and left them with the impression that decision making would be made by directive from political sources.
The declaration of "operational" status was the critical turning point for NASA and its management of Shuttle operations. Complacency began to grow among employees and safety considerations were traded for time spent on keeping the Shuttle on schedule and "the client of the day" satisfied. This was the environment just before the launch of STS 51-L.

THE DECISION TO LAUNCH
Group Decision Support System (GDSS) - Situational Analysis
A group support system did exist between NASA and related developers of the Shuttle. Focus in this discussion will be placed on Thiokol - the subcontractor directly responsible for the development of the SRB "O" rings. The GDSS system between NASA and Thiokol consisted of same-time/different-place conference rooms equipped with a connected and distributed computer interface. Speaker phones with audio only were also available.

On the evening of January 27, 1986, Thiokol was providing information to NASA regarding concerns for the next day's planned launch of STS 51-l. Thiokol engineers were very concerned that the abnormally cold temperatures would affect the "O" rings to nonperformance standards. The mission had already been canceled due to weather, and, as far as NASA was concerned, another cancellation due to weather was unthinkable ([4] pg. 23). Both parties were already aware that the seals on the SRB needed upgrading but did not feel that it was critical. Though the information provided by the GDSS (with an associated expert system) showed that the "O" rings would perform under the predicted temperatures, Thiokol engineers questioned their own testing and data that were programmed into the GDSS. Thus on the eve of the Challenger launch, NASA was being informed that their GDSS had a flawed data base.

At this point, NASA requested a definitive recommendation from Thiokol on whether to launch. Thiokol representatives recommended not to launch until the outside air temperature reached 53º F. The forecast for Florida did not show temperatures reaching this baseline for several days. NASA responded with pressure on Thiokol to change their decision. NASA's level III manager, Mr. Lawrence Mulloy, responded to Thiokol's decision by asking, "My God, Thiokol, when do you want me to launch, next April?" ([4] pg. 24).

After this comment the Thiokol representatives requested five minutes to go off-line from the GDSS. During this period the Thiokol management requested the chief engineer to "take off his engineering hat and put on his management cap," suggesting that organizational goals be placed ahead of safety considerations [4]. Thiokol reentered the GDSS and recommended that NASA launch. NASA asked if there were any other objections from any other GDSS member, and there was not.

Group Support System - Critical Analysis
There is little doubt that the environment from which NASA and its affiliated developers operated provided an opportunity for significant human error. Nevertheless, NASA and Thiokol had a "golden" opportunity to avoid disaster during their GDSS meeting before the STS 51-L launch. The following factors are offered as potential explanations for what created the flawed GDSS and the associated mismanagement of its information:

First, Thiokol was aware of the "O" ring problem at least several months before the Challenger launch. However, the goal was to stay on schedule. NASA was made aware of the problem but it was "down-played" as a low risk situation. Here is the first element of flawed information that was input into the GDSS. If NASA had been aware of the significance of the "O" ring situation, they probably would have given more credence to the advice of the Thiokol engineers' recommendations. However, the data transmitted during the GDSS meeting from Thiokol did say that it would be safe to launch for the forecasted temperatures. NASA was frustrated over the conflicting advice from the same source.
Second, the decision to delay a Shuttle launch had developed into an "unwanted" decision by the members of the Shuttle team [5]. In other words, suggestions made by any group member that would ultimately support a scheduled launch were met with positive support by the group. Any suggestion that would lead to a delay was rejected by the group.

Third, all members of the GDSS felt that they should live up to the "norms" of the group. Although the Thiokol engineers were firm on their recommendation to scrub the launch, they soon changed their presentation of objections once threatened with the possibility of being expelled from the program (as suggested by a NASA administrator who was "appalled" at a company that would make such a recommendation based on the data available) [5].

Fourth, Thiokol became highly susceptible to "groupthink" when they requested a break from the GDSS. At this point they became insulated, conducted private conversations under high stress and were afraid of losing potential future revenue should they disagree with NASA. All these factors are considered prime to the formulation of "groupthink" [5].

Fifth, all parties were afraid of public and political response to another launch cancellation (there had already been six cancellations that year). Each party began to rationalize that past success equaled future success [5].

Finally, the GDSS was seriously flawed. As already mentioned, the data base contained erroneous information regarding the "O" rings. Ideas, suggestions and objections were solicited but not anonymously. Individuals who departed from the group norms were signaled out as unwelcome members. An agenda was never defined and NASA was therefore surprised by the Thiokol presentation. Conflict management was avoided by NASA's domination of the entire meeting. NASA, at times, became very assertive and intimidating. Considering NASA's attitude, no group member or individual was willing to be held accountable for any comment or decision [5].

The setting for such an important GDSS meeting was also ineffective. Considering that a speaker phone and CPU modem was used, it was easy for NASA to down-play the personal opinions of the Thiokol engineers. If the meeting could have been held at the same place for all members, the outcome might have been different. At the end of the meeting NASA, very reluctantly, suggested that they would still cancel the launch if Thiokol insisted. No response from Thiokol was made and the NASA officials could not see the expression of "self-censorship" that was being communicated on the face of each Thiokol engineer [5].

Perhaps the most significant flaw in the GDSS was when Thiokol requested a private five minute meeting with its own members. Up to this point Thiokol had stayed with its recommendation to cancel the launch. Once disconnected, Thiokol became an isolated member and the GDSS failed altogether. Once reconnected, Thiokol had changed its position and offered the go ahead to launch without any objection.

CONCLUSIONS
The Critical Human Factor - Need for Voting Tool
Many conclusions may be drawn as to the primary cause and contributing factors associated with the Challenger tragedy. It is the opinion of this author that regarding the GDSS and decision to launch the ability of each member to have voted anonymously was the key factor that would have maintained the integrity of the GDSS and the quality of the decision.

It has been shown that just after Thiokol's presentation to NASA, most of the GDSS group members were very concerned with the "O" ring situation and believed that the opinions expressed by Thiokol engineers were cause for serious consideration of launch cancellation [5]. However, only selected senior officials were allowed to vote their "opinion", which they did verbally and at the request of NASA. From the research conducted on this paper, the author believes that had a universal anonymous vote been conducted of the total GDSS membership, a decision to cancel the launch would have been made.
The factors which lead to the Challenger incident can be traced back to the inception of the shuttle program. NASA and Thiokol failed to maintain a quality assurance program through MSS, as was initiated on the Apollo program, due to multiple source demands and political pressures. The GDSS used for the launch decision contained inaccurate data. Engineering members of the GDSS did not believe in the testing procedures used to generate the data components in the GDSS. And, the entire meeting was mismanaged.

The decision to launch the Challenger Shuttle and its subsequent destruction had a major affect on society and the management of our space program. Challenger's unique mission and the death of Christa McAuliffe opened the door for discussion and research on how managers use DSS to make decisions that will affect public trust.

AFTERMATH
Ethics and MSS/DSS - Human Factors Management
A complete discussion of ethical decision making is beyond the scope of this article. However, the question of how NASA and Thiokol managed ethical considerations is central to the decision to launch the Challenger Shuttle and, therefore, deserves a brief overview.

The first area of ethical concern is the area of information accuracy. The fact that both NASA's and Thiokol's managers had little regard to the concerns of Thiokol's engineers is very distressing. All members of the group made a decision knowing that the decision was based on flawed information. A second concern is that the decision made put safety last and operational goals first. Only one member of the GDSS expressed serious concern for the potential loss of life [5]. Additionally, open and free communication before and during the GDSS meeting was discouraged through such group dynamics as mind guarding, direct pressure and self-censorship [5]. Individuals who know of a situation that, unless acted upon with integrity might cause social harm, have a responsibility to contact any authority that will manage and control that situation in the best interest of the public ([4] "Whistleblowing, pg. 34).
Human factors analysis and management science have begun to define the incorporation of MSS/DSS as a socially responsive way of conducting business ([6] pg. 826). This is especially true for government agencies and large public projects like the Shuttle program. It could be argued that GDSS technology had not evolved to the level of effectiveness that was needed to support the Challenger project. The success of the DSS used in the prior Apollo mission shows that this was not the case. In the Challenger program social and ethical decision making was discarded for the sake of cost, schedule and outside environmental demands.

REFERENCES
[1] NASA Spacelink Challenger Press Release, http://history.nasa.gov/sts51lpresskit.pdf
[2] Launius, Roger D., "Toward an Understanding of the Space Shuttle: A Historiographical Essay". Air Power History, Winter 1992, vil. 39, no. 4.
[3] Jarman A. and Kouzmin, A., "Decision pathways from crisis. A contingency-theory simulation heuristic for the Challenger Shuttle disaster", Contemporary Crises, December 01, 1990, vol. 14, no. 4.
[4] Kramer, Ronald C. and Jaska, James A., "The Space Shuttle Disaster: Ethical Issues in Organizational Decision Making", Western Michigan University, April 1987, 39 pgs.
[5] Groupthink videorecording written by and produced by Kirby Timmons; produced by Melanie Mihal, Carlsbad, Calif., CRM Films, c 1991 25min.
[6] Turban, Efraim, Decision Support and Expert Systems, Macmillan Publishing Company, N.Y., N.Y. 1993.

Editor's Note
The NASA history site on the Challenger STS 51-L Accident at http://history.nasa.gov/sts51l.html links to many resources including Jeff Forrest's analysis. Reader's are especially encouraged to read and review the Report of the Presidential Commission on the Space Shuttle Challenger Accident (commonly called the Rogers Commission Report), June 1986 and the Implementations of the Recommendations, June 1987. The GDSS was an audio teleconference. The slides had been faxed to the NASA meeting site. Mr. Mulloy of NASA testified that Mr. Kilminster of Thiokol requested the 5 minute off-net caucus that ultimately lasted approximately 30 minutes. The opinions in this analysis are those of the author and not necessarily those of the Editor or of DSSResources.com.

Some Questions for Further Analysis and Discussion
1. What is a group decision support system?
2. Did NASA and Thiokol use a GDSS?
3. Did the group decision support system fail or was the problem with the participants?
4. What do you think was the cause of the decision-making failure in this situation?
5. Could improved GDSS technology have avoided this tragedy? If so what was needed? Video, anonymous voting?
Web links
1. http://www.aerospaceweb.org/question/investigations/q0122.shtml
2. http://history.nasa.gov/sts51l.html
________________________________________
Please cite as:
Forrest, J., "The Space Shuttle Challenger Disaster: A failure in decision support system and human factors management", originally prepared November 26, 1996, published October 7, 2005 at URL DSSResources.COM.