Challenger Space Shuttle Disaster Case Study

Please Read sources prior to the tutorial and address the following questions in the
tutorial

Some Questions for Group Analysis and Discussion

The immediate cause of the Challenger disaster was the decision by the launch
committer to launch, even though low air temperature had the potential to impair vital
function of the o-rings.

Discuss the decision making process:

Do you think the decision to launch was incorrect given knowledge at the time?

What pressures were present on those in the meeting?

Were all the participants free to provide their opinion? If not, what forces limited free
participation?

How important were the operational drivers relative the engineering and safety
drivers?

How did the previous decision making history provide a bias in decision making?

How could better decision making have occurred?

Suggest specific meeting guidelines that could have ensured more open review
of safety concerns.

Have you been in groups where groupthink unspoken rules or practices have limited
your ability to contribute? What were these rules?

Have you been in groups where you felt free to participate and present your point of
view? What aspects of the group gave you this freedom?

How do you think you as a manager could enhance good group based decision
making?
Source 1. Report of the Presidential Commission on the Space Shuttle Challenger Accident
(Rogers Report)
http://science.ksc.nasa.gov/shuttle/missions/51-l/docs/rogers-
commission/table-of-contents.html

The presidents Commission of Inquiry into the report led by Rogers

Rogers Report Chapter III - The Accident

Just after liftoff at .678 seconds into the flight, photographic

data show a strong puff of gray smoke was spurting from the vicinity
of the aft field joint on the right Solid Rocket Booster. The two pad
39B cameras that would have recorded the precise location of the puff
were inoperative. Computer graphic analysis of film from other
cameras indicated the initial smoke came from the 270 to 310-degree
sector of the circumference of the aft field joint of the right Solid
Rocket Booster. This area of the solid booster faces the External
Tank. The vaporized material streaming from the joint indicated there
was not complete sealing action within the joint.

Eight more distinctive puffs of increasingly blacker smoke were

recorded between .836 and 2.500 seconds. The smoke appeared to puff
upwards from the joint. While each smoke puff was being left behind
by the upward flight of the Shuttle, the next fresh puff could be seen
near the level of the joint. The multiple smoke puffs in this
sequence occurred at about four times per second, approximating the
frequency of the structural load dynamics and resultant joint flexing.
Computer graphics applied to NASA photos from a variety of cameras in
this sequence again placed the smoke puffs' origin in the 270- to
310-degree sector of the original smoke spurt.

As the Shuttle increased its upward velocity, it flew past the

emerging and expanding smoke puffs. The last smoke was seen above the
field joint at 2.733 seconds.

The black color and dense composition of the smoke puffs suggest
that the grease, joint insulation and rubber O-rings in the joint seal
were being burned and eroded by the hot propellant gases.

At approximately 37 seconds, Challenger encountered the first of

several high-altitude wind shear conditions, which lasted until about
64 seconds. The wind shear created forces on the vehicle with
relatively large fluctuations. These were immediately sensed and
countered by the guidance, navigation and control system.

The steering system (thrust vector control) of the Solid Rocket

Booster responded to all commands and wind shear effects. The wind
shear caused the steering system to be more active than on any
previous flight.

Both the Shuttle main engines and the solid rockets operated at
reduced thrust approaching and passing through the area of maximum
dynamic pressure of 720 pounds per square foot. Main engines had been
throttled up to 104 percent thrust and the Solid Rocket Boosters were
increasing their thrust when the first flickering flame appeared on
the right Solid Rocket Booster in the area of the aft field joint.
This first very small flame was detected on image enhanced film at
58.788 seconds into the flight. It appeared to originate at about 305
degrees around the booster circumference at or near the aft field
joint.

One film frame later from the same camera, the flame was visible
without image enhancement. It grew into a continuous, well-defined
plume at 59.262 seconds. At about the same time (60 seconds),
telemetry showed a pressure differential between the chamber pressures
in the right and left boosters. The right booster chamber pressure
was lower, confirming the growing leak in the area of the field joint.

As the flame plume increased in size, it was deflected rearward by

the aerodynamic slipstream and circumferentially by the protruding
structure of the upper ring attaching the booster to the External
Tank. These deflections directed the flame plume onto the surface of
the External Tank. This sequence of flame spreading is confirmed by
analysis of the recovered wreckage. The growing flame also impinged
on the strut attaching the Solid Rocket Booster to the External Tank.

The first visual indication that swirling flame from the right
Solid Rocket Booster breached the External Tank was at 64.660 seconds
when there was an abrupt change in the shape and color of the plume.
This indicated that it was mixing with leaking hydrogen from the
External Tank. Telemetered changes in the hydrogen tank
pressurization confirmed the leak. Within 45 milliseconds of the
breach of the External Tank, a bright sustained glow developed on the
black-tiled underside of the Challenger between it and the External
Tank.

Beginning at about 72 seconds, a series of events occurred extremely

rapidly that terminated the flight. Telemetered data indicate a wide
variety of flight system actions that support the visual evidence of
the photos as the Shuttle struggled futilely against the forces that
were destroying it.

At about 72.20 seconds the lower strut linking the Solid Rocket
Booster and the External Tank was severed or pulled away from the
weakened hydrogen tank permitting the right Solid Rocket Booster to
rotate around the upper attachment strut. This rotation is indicated
by divergent yaw and pitch rates between the left and right Solid
Rocket Boosters.

At 73.124 seconds,. a circumferential white vapor pattern was

observed blooming from the side of the External Tank bottom dome.
This was the beginning of the structural failure of hydrogen tank that
culminated in the entire aft dome dropping away. This released
massive amounts of liquid hydrogen from the tank and created a sudden
forward thrust of about 2.8 million pounds, pushing the hydrogen tank
upward into the intertank structure. At about the same time, the
rotating right Solid Rocket Booster impacted the intertank structure
and the lower part of the liquid oxygen tank. These structures failed
at 73.137 seconds as evidenced by the white vapors appearing in the
intertank region.

Within milliseconds there was massive, almost explosive, burning of

the hydrogen streaming from the failed tank bottom and liquid oxygen
breach in the area of the intertank.

At this point in its trajectory, while traveling at a Mach number of

1.92 at an altitude of 46,000 feet, the Challenger was totally
enveloped in the explosive burn. The Challenger's reaction control
system ruptured and a hypergolic burn of its propellants occurred as
it exited the oxygen-hydrogen flames. The reddish brown colors of the
hypergolic fuel burn are visible on the edge of the main fireball.
The Orbiter, under severe aerodynamic loads, broke into several large
sections which emerged from the fireball. Separate sections that can
be identified on film include the main engine/tail section with the
engines still burning, one wing of the Orbiter, and the forward
fuselage trailing a mass of umbilical lines pulled loose from the
payload bay.

Chapter 4 - THE CAUSE OF THE ACCIDENT

The consensus of the Commission and participating investigative

agencies is that the loss of the Space Shuttle Challenger was caused
by a failure in the joint between the two lower segments of the right
Solid Rocket Motor. The specific failure was the destruction of the
seals that are intended to prevent hot gases from leaking through the
joint during the propellant burn of the rocket motor. The evidence
assembled by the Commission indicates that no other element of the
Space Shuttle system contributed to this failure.

In arriving at this conclusion, the Commission reviewed in detail

all available data, reports and records; directed and supervised
numerous tests, analyses, and experiments by NASA, civilian
contractors and various government agencies; and then developed
specific scenarios and the range of most probable causative factors.

FINDINGS

1. A combustion gas leak through the right Solid Rocket

Motor aft field joint initiated at or shortly after ignition
eventually weakened and/or penetrated the External Tank initiating
vehicle structural breakup and loss of the Space Shuttle Challenger
during STS Mission 51-L.

2. The evidence shows that no other STS 51-L Shuttle element or the
payload contributed to the causes of the right Solid Rocket Motor aft
field joint combustion gas leak. Sabotage was not a factor.

3. Evidence examined in the review of Space Shuttle material,

manufacturing, assembly, quality control, and processing on
non-conformance reports found no flight hardware shipped to the launch
site that fell outside the limits of Shuttle design specifications.

4. Launch site activities, including assembly and preparation, from

receipt of the flight hardware to launch were generally in accord with
established procedures and were not considered a factor in the
accident.

5. Launch site records show that the right Solid Rocket Motor segments
were assembled using approved procedures. However, significant
out-of-round conditions existed between the two segments joined at the
 right Solid Rocket Motor aft field joint (the joint that failed).

a. While the assembly conditions had the potential of generating

debris or damage that could cause O-ring seal failure, these
were not considered factors in this accident.

b. The diameters of the two Solid Rocket Motor segments had grown
as a result of prior use.

c. The growth resulted in a condition at time of launch wherein

the maximum gap between the tang and clevis in the region of
the joint's O-rings was no more than .008 inches and the average
gap would have been .004 inches.

d. With a tang-to-clevis gap of .004 inches, the O-ring in the

joint would be compressed to the extent that it pressed against
all three walls of the O-ring retaining channel.

e. The lack of roundness of the segments was such that the smallest
tang-to-clevis clearance occurred at the initiation of the assembly
operation at positions of 120 degrees and 300 degrees around the
circumference of the aft field joint. It is uncertain if this tight
condition and the resultant greater compression of the O-rings at
these points persisted to the time of launch.

6. The ambient temperature at time of launch was 36 degrees

Fahrenheit, or 15 degrees lower than the next coldest previous launch.

a. The temperature at the 300 degree position on the right aft

field joint circumference was estimated to be 28 degrees plus
or minus 5 degrees Fahrenheit. This was the coldest point on the
joint.

b. Temperature on the opposite side of the right Solid Rocket

Booster facing the sun was estimated to be about 50 degrees
Fahrenheit.

7. Other joints on the left and right Solid Rocket Boosters

experienced similar combinations of tang-to-clevis gap clearance
and temperature. It is not known whether these joints experienced
distress during the flight of 51-L.

8. Experimental evidence indicates that due to several effects

associated with the Solid Rocket Booster's ignition and combustion
pressures and associated vehicle motions, the gap between the tang and
the clevis will open as much as .017 and .029 inches at the secondary
and primary O-rings, respectively.

a. This opening begins upon ignition, reaches its maximum rate of

opening at about 200-300 milliseconds, and is essentially complete
at 600 milliseconds when the Solid Rocket Booster reaches its
operating pressure.

b. The External Tank and right Solid Rocket Booster are connected
by several struts, including one at 310 degrees near the aft field
joint that failed. This strut's effect on the joint dynamics is to
enhance the opening of the gap between the tang and clevis by about
 10-20 percent in the region of 300-320 degrees.

9. O-ring resiliency is directly related to its temperature.

a. A warm O-ring that has been compressed will return to its

original shape much quicker than will a cold O-ring when compression
is relieved. Thus, a warm O-ring will follow the opening of the
tang-to-clevis gap. A cold O-ring may not.

b. A compressed O-ring at 75 degrees Fahrenheit is five times more

responsive in returning to its uncompressed shape than a cold O-ring
at 30 degrees Fahrenheit.

c. As a result it is probable that the O-rings in the right solid

booster aft field joint were not following the opening of the gap
between the tang and cleavis at time of ignition.

10. Experiments indicate that the primary mechanism that actuates

O-ring sealing is the application of gas pressure to the upstream
(high-pressure) side of the O-ring as it sits in its groove or
channel.

a. For this pressure actuation to work most effectively, a space

between the O-ring and its upstream channel wall should exist
during pressurization.

b. A tang-to-clevis gap of .004 inches, as probably existed in the

failed joint, would have initially compressed the O-ring to the
degreethat no clearance existed between the O-ring and its
upstream channel wall and the other two surfaces of the channel.

c. At the cold launch temperature experienced, the O-ring would be

very slow in returning to its normal rounded shape. It would not
follow the opening of the tang-to-clevis gap. It would remain in its
compressed position in the O-ring channel and not provide a space
between itself and the upstream channel wall. Thus, it is probable
the O-ring would not be pressure actuated to seal the gap in time to
preclude joint failure due to blow-by and erosion from hot combustion
gases.

11. The sealing characteristics of the Solid Rocket Booster O-rings

are enhanced by timely application of motor pressure.

a. Ideally, motor pressure should be applied to actuate the O-ring

and seal the joint prior to significant opening of the
tang-to-clevis gap (100 to 200 milliseconds after motor ignition).

b. Experimental evidence indicates that temperature, humidity and

other variables in the putty compound used to seal the joint can
delay pressure application to the joint by 500 milliseconds or more.

c. This delay in pressure could be a factor in initial joint

failure.

12. Of 21 launches with ambient temperatures of 61 degrees Fahrenheit

or greater, only four showed signs of O-ring thermal distress; i.e.,
erosion or blow-by and soot. Each of the launches below 61 degrees
 Fahrenheit resulted in one or more O-rings showing signs of thermal
distress.

a. Of these improper joint sealing actions, one-half occurred in

the aft field joints, 20 percent in the center field joints,
and 30 percent in the upper field joints. The division between
left and right Solid Rocket Boosters was roughly equal.

b. Each instance of thermal O-ring distress was accompanied by a

leak path in the insulating putty. The leak path connects the
rocket's combustion chamber with the O-ring region of the tang
and clevis. Joints that actuated without incident may also have
had these leak paths.

13. There is a possibility that there was water in the clevis of the
STS 51-L joints since water was found in the STS-9 joints during a
destack operation after exposure to less rainfall than STS 51-L. At
time of launch, it was cold enough that water present in the joint
would freeze. Tests show that ice in the joint can inhibit proper
secondary seal performance.

14. A series of puffs of smoke were observed emanating from the 51-L
aft field joint area of the right Solid Rocket Booster between 0.678
and 2.500 seconds after ignition of the Shuttle Solid Rocket Motors.

a. The puffs appeared at a frequency of about three puffs per

second. This roughly matches the natural structural frequency
of the solids at lift off and is reflected in slight cyclic
changes of the tang-to-clevis gap opening.

b. The puffs were seen to be moving upward along the surface of

the booster above the aft field joint.

c. The smoke was estimated to originate at a circumferential

position of between 270 degrees and 315 degrees on the booster
aft field joint, emerging from the top of the joint.

15. This smoke from the aft field joint at Shuttle lift off was the
first sign of the failure of the Solid Rocket Booster O-ring seals on
STS 51-L.

16. The leak was again clearly evident as a flame at approximately 58

seconds into the flight. It is possible that the leak was continuous
but unobservable or non-existent in portions of the intervening
period. It is possible in either case that thrust vectoring and
normal vehicle response to wind shear as well as planned maneuvers
reinitiated or magnified the leakage from a degraded seal in the
period preceding the observed flames. The estimated position of the
flame, centered at a point 307 degrees around the circumference of the
aft field joint, was confirmed by the recovery of two fragments of the
right Solid Rocket Booster.

a. A small leak could have been present that may have grown to
breach the joint in flame at a time on the order of 58 to 60 seconds
after lift off.

b. Alternatively, the O-ring gap could have been resealed by

 deposition of a fragile buildup of aluminum oxide and other
combustion debris. This resealed section of the joint could
have been disturbed by thrust vectoring, Space Shuttle motion
and flight loads inducted by changing winds aloft.

c. The winds aloft caused control actions in the time interval of

32 seconds to 62 seconds into the flight that were typical of the
largest values experienced on previous missions.

CONCLUSION

In view of the findings, the Commission concluded that the cause of

the Challenger accident was the failure of the pressure seal in the
aft field joint of the right Solid Rocket Booster. The failure was
due to a faulty design unacceptably sensitive to a number of factors.
These factors were the effects of temperature, physical dimensions,
the character of materials, the effects of reusability, processing and
the reaction of the joint to dynamic loading.

Chapter 6 - AN ACCIDENT ROOTED IN HISTORY

EARLY DESIGN

The Space Shuttle's Solid Rocket Booster problem began

with the faulty design of its joint and increased as both NASA and
contractor management first failed to recognize it as a problem, then
failed to fix it and finally treated it as an acceptable flight risk.

Morton Thiokol, Inc., the contractor, did not accept the implication
of tests early in the program that the design had a serious and
unanticipated flaw. NASA did not accept the judgment of its engineers
that the design was unacceptable, and as the joint problems grew in
number and severity NASA minimized them in management briefings and
reports. Thiokol's stated position was that "the condition is not
desirable but is acceptable."

Neither Thiokol nor NASA expected the rubber O-rings sealing the
joints to be touched by hot gases of motor ignition, much less to be
partially burned. However, as tests and then flights confirmed damage
to the sealing rings, the reaction by both NASA and Thiokol was to
increase the amount of damage considered "acceptable." At no time did
management either recommend a redesign of the joint or call for the
Shuttle's grounding until the problem was solved.

FINDINGS

The genesis of the Challenger accident -- the failure of the joint

of the right Solid Rocket Motor -- began with decisions made in the
design of the joint and in the failure by both Thiokol and NASA's
Solid Rocket Booster project office to understand and respond to facts
obtained during testing.

The Commission has concluded that neither Thiokol nor NASA responded
adequately to internal warnings about the faulty seal design.
Furthermore, Thiokol and NASA did not make a timely attempt to develop
and verify a new seal after the initial design was shown to be
deficient. Neither organization developed a solution to the
unexpected occurrences of O-ring erosion and blow-by even though this
problem was experienced frequently during the Shuttle flight history.
Instead, Thiokol and NASA management came to accept erosion and
blow-by as unavoidable and an acceptable flight risk. Specifically,
the Commission has found that:

1. The joint test and certification program was inadequate. There

was no requirement to configure the qualifications test motor as it
would be in flight, and the motors were static tested in a horizontal
position, not in the vertical flight position.

2. Prior to the accident, neither NASA nor Thiokol fully understood

the mechanism by which the joint sealing action took place.

3. NASA and Thiokol accepted escalating risk apparently because they

"got away with it last time." As Commissioner Feynman observed, the
decision making was:

"a kind of Russian roulette. ... (The Shuttle) flies (with O-ring
erosion) and nothing happens. Then it is suggested, therefore, that
the risk is no longer so high for the next flights. We can lower our
standards a little bit because we got away with it last time. ... You
got away with it, but it shouldn't be done over and over again like
that."

4. NASA's system for tracking anomalies for Flight Readiness Reviews

failed in that, despite a history of persistent O-ring erosion and
blow-by, flight was still permitted. It failed again in the strange
sequence of six consecutive launch constraint waivers prior to 51-L,
permitting it to fly without any record of a waiver, or even of an
explicit constraint. Tracking and continuing only anomalies that are
"outside the data base" of prior flight allowed major problems to be
removed from and lost by the reporting system.

5. The O-ring erosion history presented to Level I at NASA

Headquarters in August 1985 was sufficiently detailed to require
corrective action prior to the next flight.

6. A careful analysis of the flight history of O-ring performance

would have revealed the correlation of O-ring damage and low
temperature. Neither NASA nor Thiokol carried out such an analysis;
consequently, they were unprepared to properly evaluate the risks of
launching the 51-L mission in conditions more extreme than they had
encountered before.

The Space Shuttle Challenger Disaster

 A failure in decision support system and human factors
management
by Jeff Forrest
Metropolitan State College

Forrest, J., "The Space Shuttle Challenger Disaster: A failure in decision support system and
human factors management", originally prepared November 26, 1996, published October 7, 2005
at URL DSSResources.COM.

INTRODUCTION

This article discusses the environmental and human decision making factors that were associated
with the launching of the Space Shuttle Challenger on January 28, 1986. Shortly after launch, the
Shuttle exploded destroying the vehicle and all crew members. The cause and contributing
factors that lead to the Challenger tragedy are explored in detail. Focus is placed on NASA's use
of a group decision support system (GDSS) meeting to make the decision to launch.

Examples are included that show how contributing factors such as multiple priorities and
demands influenced NASA from operating in a responsible and ethical manner. Proof that NASA
used a flawed database in its GDSS and how it mismanaged the GDSS meeting is also offered.
Finally, the inability of each GDSS member to vote anonymously on the decision to launch is
discussed as a critical factor that, had it been allowed, probably would have prevented the
Challenger tragedy.

THE SHUTTLE 51-L MISSION

Environmental Factors- Societal Impacts

The Space Shuttle Challenger 51-L was the 25th mission in NASA's STS program. On Jan. 28,
1986, STS 51-L exploded shortly after liftoff, destroying the vehicle and all of its seven crew
members.

The STS 51-L mission was to deploy the second Tracking and Data Relay Satellite and the
Spartan Halley's Comet observer. Paramount to this mission was crew member S. Christa
McAuliffe - the first Space Shuttle passenger/observer participating in the NASA Teacher in
Space Program (cf. [1]). Ms. McAuliffe would have conducted live educational broadcasts from
the Shuttle and transmitted them to classrooms throughout the world.

The loss of life and the unique position that symbolized Christa McAuliffe as the first civilian
working as a teacher in space had a profound impact on society and its attitude toward NASA
and the U.S. Space programs.
As this article will explore, the tragic decision to launch STS 51-L was based on long term
contributing factors and the use of a flawed group decision support system that was further
aggravated by its related mismanagement. The outcome of this action created costs to society in
terms of life, resources and public mistrust. NASA subsequently experienced years of setback for
its related scientific research and operations.

BACKGROUND

Human Factors - Contributing to a Tragedy

Although the destruction of the Shuttle Challenger was caused by the hardware failure of a solid
rocket booster (SRB) "O" ring, the human decision to launch was, in itself, flawed. The
resolution to launch was based upon faulty group decision support information and further
aggravated by the related mismanagement of that information. However, as in most
transportation accidents, there are usually other contributing factors that help to create an
environment leading to mistakes and failures. Therefore, a brief review of the contributing
factors leading to the Challenger destruction is in order.

Environmental Factors - Demands on the Space Shuttle

The process of "selling" the American public and its political system the need for a reusable
space transportation system began in the late 1960's. Conceptually, the Space Shuttle was
introduced during the crest of the successful Apollo mission. Unlike the Apollo mission, the
Space Shuttle was approved as a method for operating in space, without a firm definition of what
its operational goals would be ([2] pg. 3). Here is the first contributing factor. The Shuttle was
developed as a utility without a firm application. Therefore, support for such a project, both
politically and economically, was not very strong. To gain political support it was sold as a
project with a "quick payoff" (cf., [2]). Additional support was gained by offering the Shuttle
program to the military as a means to increase national security and to industry as a tool to open
new commercial opportunity. Scientists argued to the American people that the Shuttle would be
an "American Voyage" ([2] pg. 10) with great scientific gain. Globally, the Shuttle was sold as a
partnership with the European Space Agency (ESA) and as a means to improve national and
social relations by combining peoples of different nationalities, races and sexes who would serve
as crew members.

The process used to develop economic, political and social support for the shuttle introduced the
second contributing factor called heterogeneous engineering. That is, the Shuttle engineering and
management decisions were made to meet the needs of organizational, political, and economic
factors as opposed to a single entity mission profile with specific goals ([2] pg. 9). Once
functional, the Shuttle became exposed to operational demands from a multitude of users. The
Shuttle now had to live up to NASA's promises. Coordinating the needs of political, commercial,
military, international and scientific communities placed immense pressures on the Shuttle
management team. First, political pressure to provide a reliable, reusable space vehicle with
rapid turn around time and deployment seriously hindered the ability for effective systems
integration and development. Secondly, it was not feasible to construct any complete
management support systems (MSS) that could consider all of the factors associated with such a
diverse group of environmental variables. Third, additional uncertainty and low NASA employee
moral was created when the Reagan Administration pushed for the Shuttle to be declared
"operational" before the "developmental" stage had been completed [2].

After spending billions of dollars to go to the moon, Congress expected the Shuttle program to
be financially self-supportive ([2] pg. 15). This forced NASA to operate as a pseudo commercial
business. Therefore, the environment within NASA preceding the Challenger launch was one of
conflict, stress, and short cuts [2].

NASA

Decision Support System (DSS) - Environmental Effects

The probability for disaster was growing higher as increasing demands were being placed on
NASA just prior to the Challenger launch [2]. A false sense of security was felt by NASA
officials, with twenty-four successful Shuttle missions to their credit. Just prior to the STS 51-L
launch, NASA was an organization filled with internal strife and territorial battles([3], pg. 412).
Mangers operated in an environment of "overload and turbulence" [3]. In short, NASA was
characterized as having a "disease " ([3] pg.414) of decay and destruction.

As incredible as it may seem, it would appear that NASA had no formal DSS program initialized
for the Shuttle operations before the Challenger launch. Evidence is strong that decisions were
made primarily by "satisficing" and conscious "muddling through." Specific characteristics of
decision making at the time consisted of short cuts, compromise and operational heuristics
("operational heuristics; to cannibalize existing parts" as defined by Jarman and Kouzmin [3] pg.
414). In short, NASA was operating in a phase of semi-uncontrolled decision making while
trying to serve the military, industry and international research organizations with a space vehicle
that had been declared operational before completion of the developmental stage [4].

NASA used decision making by default as its primary DSS. Its organizational boundary was
highly political and open for manipulation by any entity that could exert political power. Upon
declaring the Shuttle "operational," the Reagan Administration removed the motivation of NASA
employees to manage and left them with the impression that decision making would be made by
directive from political sources.

The declaration of "operational" status was the critical turning point for NASA and its
management of Shuttle operations. Complacency began to grow among employees and safety
considerations were traded for time spent on keeping the Shuttle on schedule and "the client of
the day" satisfied. This was the environment just before the launch of STS 51-L.

THE DECISION TO LAUNCH

Group Decision Support System (GDSS) - Situational Analysis

A group support system did exist between NASA and related developers of the Shuttle. Focus in
this discussion will be placed on Thiokol - the subcontractor directly responsible for the
development of the SRB "O" rings. The GDSS system between NASA and Thiokol consisted of
same-time/different-place conference rooms equipped with a connected and distributed computer
interface. Speaker phones with audio only were also available.

On the evening of January 27, 1986, Thiokol was providing information to NASA regarding
concerns for the next day's planned launch of STS 51-l. Thiokol engineers were very concerned
that the abnormally cold temperatures would affect the "O" rings to nonperformance standards.
The mission had already been canceled due to weather, and, as far as NASA was concerned,
another cancellation due to weather was unthinkable ([4] pg. 23). Both parties were already
aware that the seals on the SRB needed upgrading but did not feel that it was critical. Though the
information provided by the GDSS (with an associated expert system) showed that the "O" rings
would perform under the predicted temperatures, Thiokol engineers questioned their own testing
and data that were programmed into the GDSS. Thus on the eve of the Challenger launch, NASA
was being informed that their GDSS had a flawed data base.

At this point, NASA requested a definitive recommendation from Thiokol on whether to launch.
Thiokol representatives recommended not to launch until the outside air temperature reached 53
F. The forecast for Florida did not show temperatures reaching this baseline for several days.
NASA responded with pressure on Thiokol to change their decision. NASA's level III manager,
Mr. Lawrence Mulloy, responded to Thiokol's decision by asking, "My God, Thiokol, when do
you want me to launch, next April?" ([4] pg. 24).

After this comment the Thiokol representatives requested five minutes to go off-line from the
GDSS. During this period the Thiokol management requested the chief engineer to "take off his
engineering hat and put on his management cap," suggesting that organizational goals be placed
ahead of safety considerations [4]. Thiokol reentered the GDSS and recommended that NASA
launch. NASA asked if there were any other objections from any other GDSS member, and there
was not.

Group Support System - Critical Analysis

There is little doubt that the environment from which NASA and its affiliated developers
operated provided an opportunity for significant human error. Nevertheless, NASA and Thiokol
had a "golden" opportunity to avoid disaster during their GDSS meeting before the STS 51-L
launch. The following factors are offered as potential explanations for what created the flawed
GDSS and the associated mismanagement of its information:

First, Thiokol was aware of the "O" ring problem at least several months before the Challenger
launch. However, the goal was to stay on schedule. NASA was made aware of the problem but it
was "down-played" as a low risk situation. Here is the first element of flawed information that
was input into the GDSS. If NASA had been aware of the significance of the "O" ring situation,
they probably would have given more credence to the advice of the Thiokol engineers'
recommendations. However, the data transmitted during the GDSS meeting from Thiokol did say
that it would be safe to launch for the forecasted temperatures. NASA was frustrated over the
conflicting advice from the same source.

Second, the decision to delay a Shuttle launch had developed into an "unwanted" decision by the
members of the Shuttle team [5]. In other words, suggestions made by any group member that
would ultimately support a scheduled launch were met with positive support by the group. Any
suggestion that would lead to a delay was rejected by the group.

Third, all members of the GDSS felt that they should live up to the "norms" of the group.
Although the Thiokol engineers were firm on their recommendation to scrub the launch, they
soon changed their presentation of objections once threatened with the possibility of being
expelled from the program (as suggested by a NASA administrator who was "appalled" at a
company that would make such a recommendation based on the data available) [5].

Fourth, Thiokol became highly susceptible to "groupthink" when they requested a break from
the GDSS. At this point they became insulated, conducted private conversations under high
stress and were afraid of losing potential future revenue should they disagree with NASA. All
these factors are considered prime to the formulation of "groupthink" [5].

Fifth, all parties were afraid of public and political response to another launch cancellation (there
had already been six cancellations that year). Each party began to rationalize that past success
equaled future success [5].

Finally, the GDSS was seriously flawed. As already mentioned, the data base contained
erroneous information regarding the "O" rings. Ideas, suggestions and objections were solicited
but not anonymously. Individuals who departed from the group norms were signaled out as
unwelcome members. An agenda was never defined and NASA was therefore surprised by the
Thiokol presentation. Conflict management was avoided by NASA's domination of the entire
meeting. NASA, at times, became very assertive and intimidating. Considering NASA's attitude,
no group member or individual was willing to be held accountable for any comment or decision
[5].

The setting for such an important GDSS meeting was also ineffective. Considering that a speaker
phone and CPU modem was used, it was easy for NASA to down-play the personal opinions of
the Thiokol engineers. If the meeting could have been held at the same place for all members, the
outcome might have been different. At the end of the meeting NASA, very reluctantly, suggested
that they would still cancel the launch if Thiokol insisted. No response from Thiokol was made
and the NASA officials could not see the expression of "self-censorship" that was being
communicated on the face of each Thiokol engineer [5].

Perhaps the most significant flaw in the GDSS was when Thiokol requested a private five minute
meeting with its own members. Up to this point Thiokol had stayed with its recommendation to
cancel the launch. Once disconnected, Thiokol became an isolated member and the GDSS failed
altogether. Once reconnected, Thiokol had changed its position and offered the go ahead to
launch without any objection.
CONCLUSIONS

The Critical Human Factor - Need for Voting Tool

Many conclusions may be drawn as to the primary cause and contributing factors associated with
the Challenger tragedy. It is the opinion of this author that regarding the GDSS and decision to
launch the ability of each member to have voted anonymously was the key factor that would
have maintained the integrity of the GDSS and the quality of the decision.

It has been shown that just after Thiokol's presentation to NASA, most of the GDSS group
members were very concerned with the "O" ring situation and believed that the opinions
expressed by Thiokol engineers were cause for serious consideration of launch cancellation [5].
However, only selected senior officials were allowed to vote their "opinion", which they did
verbally and at the request of NASA. From the research conducted on this paper, the author
believes that had a universal anonymous vote been conducted of the total GDSS membership, a
decision to cancel the launch would have been made.

The factors which lead to the Challenger incident can be traced back to the inception of the
shuttle program. NASA and Thiokol failed to maintain a quality assurance program through
MSS, as was initiated on the Apollo program, due to multiple source demands and political
pressures. The GDSS used for the launch decision contained inaccurate data. Engineering
members of the GDSS did not believe in the testing procedures used to generate the data
components in the GDSS. And, the entire meeting was mismanaged.

The decision to launch the Challenger Shuttle and its subsequent destruction had a major affect
on society and the management of our space program. Challenger's unique mission and the death
of Christa McAuliffe opened the door for discussion and research on how managers use DSS to
make decisions that will affect public trust.

AFTERMATH

Ethics and MSS/DSS - Human Factors Management

A complete discussion of ethical decision making is beyond the scope of this article. However,
the question of how NASA and Thiokol managed ethical considerations is central to the decision
to launch the Challenger Shuttle and, therefore, deserves a brief overview.

The first area of ethical concern is the area of information accuracy. The fact that both NASA's
and Thiokol's managers had little regard to the concerns of Thiokol's engineers is very
distressing. All members of the group made a decision knowing that the decision was based on
flawed information. A second concern is that the decision made put safety last and operational
goals first. Only one member of the GDSS expressed serious concern for the potential loss of life
[5]. Additionally, open and free communication before and during the GDSS meeting was
discouraged through such group dynamics as mind guarding, direct pressure and self-censorship
[5]. Individuals who know of a situation that, unless acted upon with integrity might cause social
harm, have a responsibility to contact any authority that will manage and control that situation in
the best interest of the public ([4] "Whistleblowing, pg. 34).

Human factors analysis and management science have begun to define the incorporation of
MSS/DSS as a socially responsive way of conducting business ([6] pg. 826). This is especially
true for government agencies and large public projects like the Shuttle program. It could be
argued that GDSS technology had not evolved to the level of effectiveness that was needed to
support the Challenger project. The success of the DSS used in the prior Apollo mission shows
that this was not the case. In the Challenger program social and ethical decision making was
discarded for the sake of cost, schedule and outside environmental demands.

REFERENCES

[1] NASA Spacelink Challenger Press Release, http://history.nasa.gov/sts51lpresskit.pdf

[2] Launius, Roger D., "Toward an Understanding of the Space Shuttle: A Historiographical
Essay". Air Power History, Winter 1992, vil. 39, no. 4.

[3] Jarman A. and Kouzmin, A., "Decision pathways from crisis. A contingency-theory
simulation heuristic for the Challenger Shuttle disaster", Contemporary Crises, December 01,
1990, vol. 14, no. 4.

[4] Kramer, Ronald C. and Jaska, James A., "The Space Shuttle Disaster: Ethical Issues in
Organizational Decision Making", Western Michigan University, April 1987, 39 pgs.

[5] Groupthink videorecording written by and produced by Kirby Timmons; produced by

Melanie Mihal, Carlsbad, Calif., CRM Films, c 1991 25min.

[6] Turban, Efraim, Decision Support and Expert Systems, Macmillan Publishing Company,
N.Y., N.Y. 1993.