Weather and launch failuresby Wayne Eleazer
|
| NASA did not violate the temperature limits on the Shuttle for the Challenger’s last launch because, like most everything else that launched, there weren’t any. |
The reality is that US launch vehicles pretty much did not have overall launch weather temperature limits. The majority of US ELVs—Atlas, Thor/Delta, and Titan—were derived directly from US ballistic missiles. Inherent in the design of such missiles, or for that matter most military aerospace equipment, were very broad and robust temperature requirements. The usual low temperature design requirement was 65 degrees below zero Fahrenheit (–54°C). After all, it would be rather embarrassing to miss participating in a nuclear exchange because the winter was too cold in Wyoming, North Dakota, or Maine for your delicate missile. This same robust design philosophy carried over to the missiles’ use as space launch vehicles and applied to more than just launch temperatures.
There were numerous very specific temperature limits on parts of the ELVs. Some versions of the Atlas had launch limitations designed to ensure that the LOX that entered the turbopumps was cold enough to ensure that cavitation did not occur at start up. On some Titan space launch missions with tight performance margins the fuel had to be preheated to ensure that the performance would be adequate. And of course the payloads, dainty creatures that they are, usually have all sorts of limitations designed to make sure they did not get too cold or too hot before being thrust into the generally much harsher environment of space.
The introduction of large solid motors made temperature more important. Solid fuels can develop cracks in the grain and voids between the motor case and the propellant due to excessively cold temperatures. Of course, by the time such motors came along, ICBM deployment had advanced to the use of underground silos, which kept the missiles nice and comfy. Launch pads for ELVs using big solid motors, such as the Titan IIIC, became more enclosed than the earlier facilities as well and were better able to protect the hardware.
Then there were the typical weather conditions encountered at the main US launch bases at Cape Canaveral AFS and Vandenberg AFB. When it came to temperatures the situation was mild. Sub-freezing temperatures were only rarely encountered at the Cape and were even more rare at Vandenberg. And temperatures much over 100°F (38°C) were all but unknown at both launch bases.
So for the US ELVs, there were no real temperature launch limits and little reason to worry about them. It was not surprising that NASA had none in effect for the Space Shuttle. And that was the real problem. NASA did not violate the temperature limits on the Shuttle for the Challenger’s last launch because, like most everything else that launched, there weren’t any.
A NASA general requirements document from 1973 required that “Aerospace Vehicles” be able to operate in temperatures as low as 31°F (–0.6°C). While this requirement was referenced in NASA’s 1983 Space Shuttle Flight and Ground System Specification there was little or no evidence that anyone ever gave any thought to this requirement in the design of the shuttle. The shuttle SRB’s were supposed to be able to operate in temperatures as low as 40°F (4°C). It was not clear that this capability was ever even demonstrated in the motor ground testing, but in any case, the concern was the effect of the cold temperatures on the motor grain, not the SRB joints. And the 40°F design requirement was in any case never applied as a launch condition limitation.
Examination of recovered Shuttle SRBs on flights before STS-51-L had shown that there was a problem with the joint design relative to gas leakage. Nearly half the SRBs recovered showed some kind of a problem, and it appeared that the situation got worse at lower temperatures. Based on this, Thiokol recommended that no launch occur in temperatures lower than 53°F (12°C). Such a launch weather limitation was not just disturbing to NASA relative to meeting schedules and staying within budget, it was an alien concept based on everything the entire launch industry had come to expect.
Under pressure from NASA, Thiokol officials began “thinking like managers and not like an engineers,” to use a phrase employed on morning of the launch; the company retracted its recommended 53°F temperature limitation, and the rest is tragic history. Air temperatures were in the upper 20s Fahrenheit the morning that Challenger began its final fatal ascent. Thiokol later calculated that the combination of cold weather and conduction through the strut from the cold ET to the SRB produced localized joint temperatures in the vicinity of 16°F (–9°C) at the failed joint.
But NASA did not bust the temperature limits. It just never occurred to them to have any.
The loss of Challenger was still fresh in everyone’s minds when an Atlas Centaur booster with a military communications satellite was readied for launch on March 26, 1987. In contrast to the STS-51-L launch, the weather was warm, and the Atlas Centaur vehicle had no launch weather temperature restrictions to worry about in any case.
But the weather for the launch still proved a big issue. Thunderstorms covered much of central Florida, and this threatened to violate the standard lightning restrictions.
| If the problem for Challenger was a condition outside of normal experience, the Atlas problem could have been described as being one of excessive familiarity—and familiarity breeds contempt. |
Vehicles could not be launched within three miles (five kilometers) of a thunderstorm. Vehicles could not be launched when the trajectory would penetrate a thunderstorm. Vehicles could not be launched within three miles of observed lightning. Those requirements were to prevent the possibility of the vehicle being struck by lightning or triggering a lighting strike by its passage through a storm. Also, vehicles could not be launched when they would penetrate a cloud thickness of 5,000 feet (1,500 meters) where any part of the cloud reached freezing temperature; this requirement was to prevent the formation of a high voltage discharge that could damage vehicle electronics.
It did not look good for the launch, and part of the problem was getting adequate weather data—in part because the weather itself was interfering with data collection. A weather reconnaissance aircraft was scheduled, but the weather was so bad where the aircraft was based that it could not take off. The proximity of lightning to the launch pad could not be discerned accurately because the observation helicopters were forced off station—by lightning.
But unlike the extraordinarily cold temperatures experienced by the Challenger mission, thunderstorms in Florida were all too common. And that experience was itself a problem. If the problem for Challenger was a condition outside of normal experience, the Atlas problem could have been described as being one of excessive familiarity—and familiarity breeds contempt.
There was data from passing aircraft indicating that the flight path of the vehicle was reasonably clear of thunderstorms and other data indicating that it was not. Given the uncertainties inherent in weather forecasting there had developed a tendency during launches to accept the good data and ignore the bad, or “take data until you get an answer you like and then stop.” Finally, the Air Force Meteorologist said “Okay, I’m go if you are.”
That this was accepted and the launch allowed to proceed revealed some basic errors in countdown management. The weather officer did not even get a “Go” vote. He simply had to say whether the required conditions were met or not. In key weather areas such as winds aloft, the weather officer did not even do that much. Winds were measured and the impact assessed by the booster manufacturer by means of a computer program. In the case of the lightning conditions “I’m Go if you are” really meant “I don’t know.”
The uncertainty was exacerbated by the fact that the decision makers and technical experts were distributed across the Cape rather than where they could all eyeball each other directly. The Air Force leadership was in the range control center, the NASA booster and satellite people were in the blockhouse and the telemetry center, and the weather experts were in the weather station. During a countdown some of the most useful exchanges can take place off line and off console, but the distributed nature of the process at the Cape made this difficult at best.
And additional confusion factor was who was in charge of the launch. The satellite was for the US Navy and had been procured by the US Air Force. The booster had been procured by NASA for the Air Force. Meanwhile, General Dynamics had been promoting the idea of a government hands-off approach to launches and was claiming the launch was a commercial effort under their control. There was an Air Force Test Director but he had far less control than someone with that position did for USAF launches.
The launch proceeded and the vehicle roared off the pad. At 48.4 seconds after liftoff a lightning bolt was seen to follow the path of the flight path of the vehicle to the ground. This phenomena was “triggered lightning” where the booster and its ionized exhaust trail acted like a gigantic lightning rod to discharge lightning to the ground.
The lightning reprogrammed the vehicle’s guidance software, changing a single word in the program. It was not much of a change but it was enough. Just over ten seconds after the lightning strike, at T+59 seconds, the vehicle entered a hard right turn. The range safety officer sent the destruct command at T+70.7 seconds. Telemetry data indicated that the destruct signal never was received by the vehicle, which nonetheless broke up.
| In both cases, the launch teams failed to manage the launch countdown process properly. |
The subsequent investigations focused on the weather officer’s “Go.” A sizeable science project on lightning restrictions was undertaken, and which resulted in increasing the restrictions substantially, a process that was continued in later years and produced further restrictions. But most people seemed to miss the fact that the failure did not occur because the previous restrictions were inadequate, but instead because they were ignored. In fact, the General Dynamics Launch Conductor reportedly walked out of the blockhouse after the failure, looked around at the angry clouds and said “What? I launched into this?”
Contrast the AC-67 failure with what occurred with an Air Force Atlas E launch attempt at Vandenberg AFB in November 1985, for the NOAA-F satellite. The T-3 hour balloon data indicated that winds aloft conditions were acceptable and the weather was otherwise fine. Normally, this would mean that the final, optional weather balloon, launched at T-100 minutes, would not be required.
But unlike the AC-67 launch, the Air Force meteorologist was right there in the launch control center. He leaned across the console to the Air Force Test Director, sketched a diagram on the back of his countdown manual, and explained succinctly “Look, the winds aloft are fine right now but are going to change radically over the next hour or so. I recommend you launch that last balloon.”
The Test Director gave the order to launch the balloon. Incredibly, this produced howls of protest. “Bad decision!” and “We have enough data to go now!” were typical remarks.
The balloon data came back, was processed, and the answer delivered to the Test Director a mere 15 minutes before the scheduled T-0 time. The computed Capability Ratio was 1.18. In other words, the winds aloft exceeded the vehicle’s maximum capability by 18%. The launch would have failed. Following the successful launch of the mission a couple of weeks later they awarded the weather officer a medal.
Although the causes of the failures were different, both the STS-51-L and the AC-67 mishaps were in reality due to the same type of problem. In both cases, the launch teams failed to manage the launch countdown process properly.
In the case of the Challenger the concept of a launch weather temperature restriction was alien to the launch team. The fact that the weather presented extraordinary circumstances and that they had also been presented with a newly identified unique vulnerability did not break through the mental shield of what was considered to be “normal.”
| As in all things for the launch decision process, neither willful ignorance nor the mere studious examination of available data are guaranteed to produce favorable results by themselves. |
In the case of AC-67, it had become something of tradition throughout the launch industry to collect data until you got an acceptable answer—and then stop right there. As the Atlas E NOAA-F mission incident had shown 18 months before, the typical inclination was to follow the established procedures and not consider the fact that the acceptable conditions might change. This was considered “normal”; to do otherwise would make the already highly challenging countdown process even more difficult.
But occasionally weather does indeed make the countdown process even more difficult. Weather cannot be managed but merely responded to. And assessing weather is not simply a checklist item but requires judgement, and above all, prudent management.
Both the NOAA-F success and the AC-67 failure led to changes in procedures for addressing weather issues, while the STS-51-L failure led to a whole host of changes. The current launch weather criteria is vastly more complex than that of 20 years ago; this reflects as much an increased appreciation of proper management of the countdown process as much as it does better science.
As in all things for the launch decision process, neither willful ignorance nor the mere studious examination of available data are guaranteed to produce favorable results by themselves. Human judgement is the most important factor.
