CHAIRMAN ROGERS: The Commission will come to order, please.
Today the Commission will focus on the events leading to the decision to launch the Challenger. The Commission has already reviewed a good deal of information about the seals and the O-rings on the solid rocket boosters. It should be noted, however, that it is not yet clear that the joint area was the originating problem.
Therefore, it is important that all potential causes of the accident, including the external tank, be actively pursued.
In our sessions today and tomorrow, we want to present in a thoughtful and orderly manner the facts relating to the decision to launch the Challenger. Because of its importance I will ask witnesses to identify the time and place of any event that they are addressing and the names and positions of persons who participated.
[710] The Commission wants to be fair in the presentation of the facts because the subject matter may involve possible human error, as distinguished from equipment failure. The Commission will attempt to give a right of reply as soon as possible to any person who
believes he has been unfairly criticized or whose actions may have been inaccurately portrayed. During the last two weeks, the Commission has encouraged NASA to disclose a large number of facts and documents relating to the launch, which has been done. As a result, we believe the public is better able to understand and assess many aspects of the accident. We hope that this process will continue until all the facts are fully known and as much as possible fully understood.
While the Commission has the responsibility under its mandate from the President to investigate the accident and report its findings, the media plays a key role in the process by keeping the public informed. We believe it has performed this role well and with a high sense of responsibility.
If the Commission effectively performs its duties and the media performs its role of accurately reporting the facts as they develop, the public will be well served.
Witnesses who appear today will be able to comment on or clarify their testimony, as long as the substance is not altered. Of course, any additional evidence or additional material that might assist the Commission in the performance of its duties and
responsibilities will be welcome.
The first witness this morning will be Allen McDonald. Following Mr. McDonald and at the request of Morton Thiokol, the Commission will next hear Jerry Mason, who is executive vice president of Morton Thiokol.
Now I would like to call upon our Executive Director, Dr. Keel, who will make a few comments before we hear Mr. McDonald.
DR. KEEL: Mr. Chairman, for the benefit of the Commission we have put together a chronology of events relating to the period when the first temperature concerns were raised with respect to the Challenger, indicating the activities and also the participants as the Commission understands them, based upon testimony and documentation provided to the Commission.
This chronology has been provided to all of the witnesses, Mr. Chairman, so they will have an opportunity to understand our reconstruction of those events and to clarify them, and also, as appropriate, to identify the nature of the discussions at each of these meetings and activities, starting approximately from the scrub of the originally planned launch of Challenger for January 27th at 9:38 a.m., ranging up to the launch of the Challenger on January 28th at 11:38 a.m.
CHAIRMAN ROGERS: And if there are corrections
that have to be made on this document, we will make them as we go along. It is as accurate as we can make it at the present time.
Now I would like to call on Mr. McDonald, please. Mr. McDonald, I think probably if you take the middle chair it might be best. And I think to be consistent, let's swear all the witnesses in again.
(Witness sworn.)
CHAIRMAN ROGERS: Mr. McDonald, you're now employed by Morton Thiokol, Inc.?
MR. McDONALD: That is correct.
CHAIRMAN ROGERS: And how long have you been employed by them?
MR. McDONALD: I've been with Morton Thiokol a little over 26 years.
CHAIRMAN ROGERS: And you're an engineer?
MR. McDONALD: Yes. I have a bachelor's degree in chemical engineering from Montana State University and a master's degree in engineering administration from the University of Utah.
CHAIRMAN ROGERS: And can you give us some history of your employment with Thiokol?
MR. McDONALD: I am currently the director of the space shuttle solid rocket motor project. My responsibilities are for technical, cost, and schedule performance of the steel case motors that are flown out of Kennedy, and also the development and qualification of the filament wound case solid rocket motor to be flown out on Vandenberg Air Force Base.
I have had this position for a little less than two years. I started as director in March of 1984
of the shuttle SRM project. Prior to that, I was the manager of the project engineering division at Morton Thiokol, at which I had technical responsibility from a project engineering standpoint for all of the programs in the plant, with the exception of the space shuttle.
That included the Peacekeeper, the MX stage one, Trident 1 C-4 production, Trident 2 development, the HAARM Mark 104 standard missile, MD-2, the improved performance space motor 2. I finished a contract on qualification of a long life motor for SHRAM. I had all of the independent research and development, advanced technology programs with the rocket propulsion laboratory, and also some work on air bag, air cushion restraint systems.
I had that job I guess for about three, four years prior to coming into the shuttle program, and prior to that I was the manager of the propellant development department for a few years. And prior to that I was the manager of the project engineering group for advanced development and development projects.
I started with Thiokol in 1959, after graduating from Montana State University, and my first job was involved in designing the external insulation for the stage one of the Minuteman. I did that design and I was then chosen as a group leader for flight test
of the Minuteman, and participated in the flight tests, about the first 20 flights of the Minuteman, out of the Cape.
Subsequent to that, I spent considerable time working as the chief engineer on development of some controllable solid rocket motor concepts for several years, and worked on a lot of advanced development programs, before I became involved in the Trident program in the early seventies.
CHAIRMAN ROGERS: For the last three or four years, where have you spent your time?
MR. McDONALD: The last couple of years, of course, I spent my time as director of the solid rocket motor project, which involves a considerable amount of coordination relative to production of the shuttle solid rocket motors, assessment of the flight readiness reviews for the space shuttle solid rocket motors.
I am the chairman of the senior material review board for the SRM. That senior material review board has to review all of the discrepancies on any of the hardware that's considered as criticality one or any that is outside the experience base of our previous experience.
As chairman of that board, there are members from our quality group, our engineering group, NASA
Marshall representatives, but I have to sign every one of those that they're ready for flight.
And I am also a co-chairman of the problem review board with Marshall Space Flight Center, relative to any problems that are identified from returned hardware that come back to the Cape and what actions are taken to understand those problems and provide fixes for those and prevent them from occurring.
My activities in the past year to a large extent have been involved with design certification of the filament wound case solid rocket motor. I am also the co-chairman of the design certification team, represented by Thiokol and Marshall at the SRM level for that, and that has taken a considerable amount of my time this past summer in a series of reviews for certifying the graphite composite case for Vandenberg.
CHAIRMAN ROGERS: Now, how much time did you spend in the performance of those duties at Kennedy Space Center?
MR. McDONALD: Well, I have been alternating with my supervisor, the vice president, space booster programs, Mr. Joe Kilminster.
CHAIRMAN ROGERS: Mister who?
MR. McDONALD: Joe Kilminster.
CHAIRMAN ROGERS: And what is his title?
MR. McDONALD: He is the vice president of the space booster programs. And he and I have been alternating going to the Cape, supporting the launches of the SRM's.
CHAIRMAN ROGERS: Is he your immediate supervisor?
MR. McDONALD: He is my immediate supervisor, yes.
CHAIRMAN ROGERS: And you alternated going to the Cape?
MR. McDONALD: Yes.
CHAIRMAN ROGERS: Now, how did that work?
MR. McDONALD: That works out fairly well. We both, of course, have a fairly heavy demand on our time, with all of the reviews in the shuttle process, primarily with the trips to Huntsville and the Marshall Space Flight Center.
[713] I attended, of course, the STS 51-L. He was at the prior flight. And our charter is to attend the L minus one meeting.
CHAIRMAN ROGERS: 51-L is the Challenger launch?
MR. McDONALD: That is correct.
CHAIRMAN ROGERS: And you were there at that time. Was he, Mr. Kilminster, there at the previous launch?
MR. McDONALD: He was at the previous launch, yes.
CHAIRMAN ROGERS: What about the one before that?
MR. McDONALD: The one before that I was at, and he was at the one, I think, before that. We have been fairly well alternating.
CHAIRMAN ROGERS: And what were your responsibilities when you were there at the Cape at the time of the launch?
MR. McDONALD: Well, at the time of the launch I was in the firing room two launch control center. There are seats there for the monitors of many of the functions on the solid rocket boosters, as well as a TV monitor.
The Marshall Space Flight Center has a group at their console that involves the primary contractors for all of the subsystems. The SRB has one monitor, and they have people from USBI who provide part of the hardware for the SRB and for the shuttle.
We also have a monitor from our support to the space shuttle processing contractor, that is right next to that monitor, and Mr. Carver Kennedy, our vice president of our space operations at the Cape, was at
that monitor that's right next to the Marshall monitor, and I was sitting with him at the time of the launch.
CHAIRMAN ROGERS: I wasn't speaking so much about the Challenger launch as I was generally speaking. Generally speaking, when you or Mr. Kilminster are at Kennedy, you speak for the company, is that it?
MR. McDONALD: Yes. Generally, the process is, before launch there is an L minus one meeting the day before the launch, at which time all of the problems that were still open prior to the L minus one review are reviewed with Jess Moore and his board, and are assured that they are all closed out and we are ready for the launch.
Subsequent to that meeting, there is a poll that is taken. He takes an oral poll of everyone that is involved in the launch, including, as well as the propulsion systems, but the payload and everyone else. And every contractor that is involved in that has to answer to the poll as to whether they are ready to go ahead and launch.
I attended that meeting. As you know, the L minus one meeting was conducted, I believe, on Saturday or something.
CHAIRMAN ROGERS: Yes. I would like to, if you don't mind, come to that chronologically in just a
moment.
But, so at those meetings when you were there, you spoke for Thiokol?
MR. McDONALD: Yes, I spoke for Thiokol.
[714] CHAIRMAN ROGERS: And how long had you been there prior to the launch of the Challenger, physically located at Kennedy?
MR. McDONALD: I was at Marshall Space Flight Center earlier in the week on some negotiations for a subsequent contract, and had went down to Kennedy on, I believe it was, the Thursday before the launch.
CHAIRMAN ROGERS: Could you give some explanation of the relationship between yourself and Marshall before you went to Kennedy?
MR. McDONALD: I'm not sure what you mean by "relationship."
CHAIRMAN ROGERS: Well, what function was Marshall performing at that time, and what were you doing in representing Thiokol?
MR. McDONALD: Well, Marshall has overall responsibility for all of the propulsion subsystems on the shuttle, and we are part of the SRB team. I work directly with Larry Weir, who is the project manager for Marshall on the solid rocket motor, and he works for Larry Mulloy, who is the project manager on the SRB,
which includes the solid rocket motor and the aft skirt, TVA system, and the parachute recovery system that makes up the whole SRB.
And I always attend or Joe Kilminster attends the launches with Mr. Mulloy, and he has the representatives also from the other subcontractors for USBI, and in case there's any questions that come up, that we can either resolve there or get resolution to prior to launch.
CHAIRMAN ROGERS: Just for the record, where is Marshall located?
MR. McDONALD: Marshall is located in Huntsville, Alabama.
CHAIRMAN ROGERS: And when did you leave Huntsville, Alabama, to go to Cape Kennedy on this occasion?
MR. McDONALD: I think it was Wednesday or Thursday afternoon before the launch.
CHAIRMAN ROGERS: Did you go by yourself or with someone?
MR. McDONALD: I went by myself.
CHAIRMAN ROGERS: Now, I want to give you an opportunity to give a full description of the events the day before, the 27th, and the day of the launch. But before I do that, I understand that you made some notes after the accident which put on paper some of your
recollections of the events preceding the accident. Is that correct?
MR. McDONALD: That is correct.
CHAIRMAN ROGERS: And you have those notes now?
MR. McDONALD: Yes, I have those notes. [Ref. 2/25-1]
CHAIRMAN ROGERS: I would like to explain to you that you are at liberty to refer to those notes in any way you want to.
And now, beginning with the first recollection you have of the weather problem and how it came to your attention, give us a full account of the events of that day and the following day, the 27th and the 28th. And we will try not to interrupt you, except possibly for clarification.
And I want you to feel free to tell everything you recall about it, and then after that we may ask some questions to try to amplify any answers that you may give.
MR. McDONALD: Well, I had first become aware of the concern of the low temperatures that were projected for the Cape, it was late in the afternoon of the 27th. I was at Carver Kennedy's house. He is a vice president of, as I mentioned, our space operations center at the Cape, and supports the stocking of the
SRM's.
And I had a call from Bob Ebeling. He is the manager of our ignition system and final assembly, and he works for me as program manager at Thiokol in Utah. And he called me and said that they had just received some word earlier that the weatherman was projecting temperatures as low as 18 degrees Fahrenheit some time in the early morning hours of the 28th, and that they had some meetings with some of the engineering people and had some concerns about the O-rings getting to those kinds of temperatures.
And he wanted to make me aware of that and also wanted to get some more updated and better information on what the actual temperature history was going to be predicted, so that they could make some calculations on what they expected the real temperature the O-rings may see.
CHAIRMAN ROGERS: He was calling from Utah?
MR. McDONALD: He was calling from Utah.
I told him that I would get that temperature data for him and call him back. Carver Kennedy then, when I hung up, called the launch operations center to get the predicted temperatures from pad B, as well as what the temperature history had been during the day up until that time.
CHAIRMAN ROGERS: And pad B was the area where the launch was going to take place?
MR. McDONALD: Pad B was the pad the Challenger was to fly off of, and this was the first time it would fly off of that pad.
He obtained those temperatures from the launch operations center, and they basically said that they felt it was going to get near freezing or freezing before midnight. It could get as low as 22 degrees as a minimum in the early morning hours, probably around 6:00 o'clock, and that they were predicting a temperature of about 26 degrees at the intended launch time, about 9:38 the next morning.
I took that data and called back to the plant and sent it to Bob Ebeling and relayed that to him, and told him he ought to use this temperature data for his predictions, and that I thought this was very serious and to make sure that he had the vice president of engineering involved in this and all of his people; that I wanted them to put together some calculations and a presentation of material.
CHAIRMAN ROGERS: Who's the vice president of engineering?
MR. McDONALD: Mr. Bob Lung is our vice president of engineering at our Morton Thiokol facility in
Utah.
To make sure he was involved in this, and that this decision should be an engineering decision, not a program management decision. And I told him that I would like him to make sure they prepared some charts and were in a position to recommend a launch temperature, just don't recommend a launch, but recommend a launch temperature, and to have the rationale for supporting that launch temperature.
I then hung up and I called Mr. Mulloy. He was staying at the Holiday Inn in Merritt Island and they couldn't reach him, and so I called Cecil Houston - Cecil Houston is the resident manager for the Marshall Space Flight Center office at KSC - and told him about our concerns with the low temperatures and the potential problem with the O-rings.
[716] And he said that he would set up a teleconference. He had a four-wire system next to his office. His office is right across from the VAB in the trailer complex C over there. And he would set up a four-wire teleconference involving the engineering people at Marshall Space Flight Center at Huntsville, our people back at Thiokol in Utah; and that I should come down to his office and participate at Kennedy from there, and that he would get back with me and let me know when that time would be.
I waited for a short period of time, I don't know exactly how long. It wasn't very long, and he called back and told me that he had contacted the parties and it was all set up for 8:15 p.m. eastern time for that teleconference.
I relayed that message on back to the plant and told them that we have to have charts at that time faxed out to Kennedy as well as Marshall that we could discuss for that teleconference.
CHAIRMAN ROGERS: Could you explain what "charts" means?
MR. McDONALD: Well, their charts, any data that we had for showing why we had concerns on the O-rings at low temperatures, what our history has been, what, any calculations we might be able to make relative to their performance, supporting rationale for what is an acceptable temperature, what might not be an acceptable temperature, and to review that. IR'~ '/t t-:~1
And these would all be on charts that we would send by a fax machine so that people could read those and we could discuss those as the rationale for either recommending a launch or not.
I arrived at the Kennedy Space Center at about 8:15, and when I arrived there at the Kennedy Space Center the others that had already arrived were Larry
Mulloy, who was there - he is the manager, the project manager for the SRB for Marshall. Stan Reinartz was there and he is the manager of the shuttle project office. He's Larry Mulloy's boss.
Cecil Houston was there, the resident manager for Marshall. And Jack Buchanan was there. He happens to be our manager, Morton Thiokol's manager of our launch support services office at Kennedy.
The telecon hadn't started yet. It came on the network shortly after I got there. But I was told to hold on because the charts had not been received either at Marshall or at Kennedy at that time, and we waited I guess for probably another half-hour before those charts finally came through and we could reproduce them.
In fact, they hadn't all even been received yet. There were some conclusion and recommendation charts that didn't come for about a half hour or even later than that.
CHAIRMAN ROGERS: Was it essentially a telephone conference, or was there actually a network of pictures?
MR. McDONALD: It was a telephone conference, just telephone. You could hear the voices from the other two places as well as our own. However, the way those
teleconferences work, there are buttons that you can push and that will mute out you speaking if someone else is speaking, and you can usually hear it better when you don't have your own mikes open. So there is a lot of conversations, I am sure, at all of the facilities at one time which you can't hear.
But I will relay on what I heard on the conference as best I can. The teleconference started I guess close to 9:00 o'clock and, even though all the charts weren't there, we were told to begin [717] and that Morton Thiokol should take the lead and go through the charts that they had sent to both centers.
The charts were presented by the engineering people from Thiokol, in fact by the people that had made those particular charts. Some of them were typed. some of them were handwritten. And they discussed their concerns with the low temperatures relative to the possible effects on the O-rings, primarily the timing function to seal the O-rings.
They presented a history of some of the data that we had accumulated both in static test and in flight tests relative to temperatures and the performance of the O-rings, and reviewed the history of all of our erosion with any O-rings in the field joints, any blow-by of the primary O-ring with soot or
products of combustion or decomposition that we had noted, and the performance of the secondary O-rings.
And there was an exchange amongst the technical people on that data as to what it meant and discussions. But the real exchange never really came until the conclusions and recommendations came in.
At that point in time, our vice president, Mr. Bob Lund, presented those charts and he presented the charts on the conclusions and recommendations. And the bottom line was that the engineering people would not recommend a launch below 53 degrees Fahrenheit. The basis for that recommendation was primarily our concern with a launch that had occurred about a year earlier, in January of 1985, I believe it was 51-C.
It was our motor number SRM-15, and that particular motor had a couple of field joints that not only had some erosion, but they had some fairly severe blow-by of the primary seals, fairly heavy soot over a fairly large arc, very deep and black.
And even though we could see no measureable erosion on the secondary O-ring, it was a heat effect, and by that, the sheen was gone off of the O-ring seal. That was, you couldn't measure any, but the sheen was gone, and because of that we were concerned with launching beyond our experience base, below that
temperature.
Well, that temperature brought a lot of strong comments and reaction from several of the NASA officials. I believe it was Mr. Mulloy made some comments about when we will ever fly if we have to live with that some time in the future; and also commented that, we are trying to establish new launch commit criteria and we can't do that, you don't do that the night before a launch, that is a predetermined set of constraints and we can't do that.
And other comments were made about whether we could ever fly out of Vandenberg 24 flights a year, because it wasn't uncommon to have 53 degrees in the early morning hours where a lot of the launches occur.
One of the comments that came - and this is by voice recognition; I believe it was from Mr. Hardy at Marshall Space Flight Center - was that he was appalled at that recommendation. However, he also said that he certainly wouldn't fly without Thiokol's concurrence.
CHAIRMAN ROGERS: He said he would not fly - -
Mr. McDONALD: He would not fly without Thiokol's concurrence, even though he was appalled at that recommendation.
I believe it was Stan Reinartz made a comment that he was under the impression that the solid rocket motors were qualified from 40 to 90
degrees, and that 53 degree recommendation certainly was inconsistent with that.
Some place in the conversation about the impact of 53 degrees, I believe Cecil Houston at some time commented that it wouldn't be until about Thursday that we would have morning temperatures probably in the fifties. So he didn't seem to be as alarmed about when we could get to that temperature.
There were several challenges relative to, it was felt how conclusive the effect of temperature was on this whole problem of O-ring erosion or soot blow-by. And the challenge came from looking at the total data, because even though we were as concerned about this flight, which was the coldest ever at that time, from Florida a year earlier there was a flight back in the late fall of '85, I think it was probably October, 61-A, was our SRM-22 set, that had some blow-by of the O-rings, no erosion of the primary O-rings, in fact a couple of them.
And, this happened to be a launch that had the highest temperature, and so there was some concern that the data was inconclusive; and also that we had some motors that were static tested as low as 36 degrees Fahrenheit, DM-4 I believe, and it showed not only no O-ring erosion, but no blow-by.
Well, some of the comments that came back from that, and I believe it was Roger Boisjoly commented that he felt that there was a significant difference in the observation of the actual soot that passed the primary O-ring on the SRM-15 set, that was the cold one, versus the one that was warm; that there was a much larger arc between the two O-rings from the effect of the soot, it was much blacker. It penetrated all the way up to the secondary O-ring, and of course we had some heat effect there.
And he thought there was a significant difference, and that well could be the difference just due to temperature.
I commented at that time about the static test history. I told him I did not feel that that was a valid data, for a couple of reasons. One, on the static test motors, we keep the static test motors in an environmental building essentially during the buildup, assembly, and checkout of all the instrumentation, and that environmental building is kept at 70 to 72 degrees, and that building is then rolled back on a track about six hours before the static test. So it wasn't exposed very long to the cold temperatures.
Secondly, in the static test motors we went in and actually repaired and filled holes in the putty.
These holes are formed by the assembly of the rocket motor. As you form the tang and clevis, there's air trapped in there, and that air has got to go someplace. And sometimes that air will go up through the putty. We have seen this.
And also, when you run the leak check on the two seals, if you get any blow-by during the leak check it may tend to propagate those. And in the static test motors, some of these were observed and they went in and filled those inside the motor prior to static test.
So I told him I didn't feel that that data was conclusive and they shouldn't use that for deciding what the O-ring performance was.
At that time there was other discussion on some of the charts that we had that was somewhat inconclusive. We had a chart that had some sub-scale data, where we had run some tests on blow-by with some sub-scale O-rings that actually had the full-scale diameter, 280 [719] thousandths, but they were smaller. That was the cross-section of the O-ring, they are smaller diameter hardware.
And they were cold gas tests, and we were attempting to try to measure what kind of blowby one might get with the pressurization rates you see in the motor. And we were using argon as the working fluid and
also some freon, and we had run some tests at around ambient 30 degrees in those and did not see any difference.
And so there was some conflicting data that said that it wouldn't make any difference. But that, I want to remind everyone, was a cold test.
At that time, I commented at the time that I felt that lower temperatures were in the direction of badness for both O-rings, because it slows down the timing function for both of those, but the effect is much worse for the primary O-ring compared to the secondary O-ring, because the leak check forces the primary O-ring in the wrong side of the O-ring groove, while it forces the secondary O-ring in the proper direction; and this fact should be weighed and considered in making an evaluation as to what the recommended temperature should be.
I was looking at a chart at that time that we had. In fact, it is a chart that I had made with some help of our engineering people back last summer, in a presentation I had made here in Washington to the headquarters people on August 19th.
And it was a chart that showed that there is really three phases or three regions of concern during the ignition transient relative to the performance of
the O-ring. The first phase of that is a condition where the O-ring, the primary O-ring, is pressurized and starts the energizing process and actually has to move from the forward face of the O-ring groove, because that is where it's at as a result of the leak check, and then it has to move back and seal on the back face.
And this process we felt took place in the early part of the ignition transient, someplace before it got to 200 psi. And in cold weather what's going to affect that, of course, is the grease that is in that area also is very viscous and stiff. The O-ring itself is stiff.
We knew that the cold temperature shrank the O-ring some, and from our resiliency tests, which are tests that basically show how the O-ring responds when you have it under some compression and release that load, it shows that it gets cold and stiff, it doesn't want to respond very well.
And I looked at it something like a flat tire on the bottom. I remember when we used to drive nylon tires; when it was cold I would get out and there was a flat spot on them.
And that O-ring having to move, it either has got to slide or it has got to roll somewhat. It is not a very big dimension it moves in. It is 20 or 30
thousandths. But certainly it can't be as good as when you don't have that.
Also, being hard, it then has to extrude into the gap between the two O-ring seals, and the harder it is I'm sure it's harder to extrude in the gap, which means it may take a higher pressure to do that, which also takes a longer time.
I felt that, based upon what we had done in the past, we had concluded that this blow-by phenomenon had really occurred in this first part of the pressurization cycle, and I think there was good evidence that it had because the soot that appeared between the two O-rings was exactly that, it was soot; and we analyzed it, but it didn't see any heat effect on the metal at all.
[720] In some cases it discolored the grease, but didn't really burn it. Some of it was the products of the grease. You could not see any real effect on the secondary O-ring. So it couldn't have happened very long and it couldn't happen under very severe conditions.
But at the same time, the temperature effects were concerning, that maybe we were going into another timing regime. However, if we felt that we had a good margin there and we felt that we do have a good
secondary seal during this time - I think there has been some misconception about the redundancy of the secondary seal. The secondary seal is indeed redundant until the metal parts between the tang and the clevis actually rotate. It is a full redundant seal and during this time period it is redundant, and that is important.
But once those metal parts rotate and you have a problem of resiliency, it may not be. And so that is why I was concerned about that area. But if we could convince ourselves that the data said it wouldn't make that much difference in that part of the phase, then it would be a reasonable recommendation to say that we wouldn't expect much different performance.
Shortly thereafter, Thiokol was asked about their recommendation. I believe Joe Kilminster was asked himself what his recommendation would be, since it was engineering that recommended not flying at 53. And he said that he would not go against our recommendation, he couldn't go against it.
But based upon the controversy relative to how conclusive the effects of temperature actually were on this phenomenon, we were asked to reassess and re-evaluate that data, and we decided we would do that. And the people at Utah said that, well, they would like
to have a caucus for about five minutes and go off the line.
CHAIRMAN ROGERS: Could I ask you to stop there just for a moment and go back. We will come to the caucus in a minute, but go back and explain what was said to convey the decision of no launch? I gather at that point the decision by Thiokol was to recommend against a launch?
MR. McDONALD: That is correct, that it was at that point, the recommendation was not to launch below 53 degrees.
CHAIRMAN ROGERS: Who did the talking on that subject?
MR. McDONALD: That was Bob Lund, vice president of engineering, who presented that position.
CHAIRMAN :ROGERS: Were you able to ascertain from that conversation how the engineers as a group stood on that?
MR. McDONALD: Well, the engineers as a group, I can't speak for the group. I was not there, but I did hear the engineers that presented the charts, that they actually presented as part of that. that supported the 53 degree recommendation. And I felt they were very strong in their conviction as to why they felt uncomfortable to go outside that experience base.
CHAIRMAN ROGERS: And who were they?
MR. McDONALD: Roger Boisjoly I think was one of the strongest ones, and Arnie Thompson, that presented those positions and presented the charts.
CHAIRMAN ROGERS: And Mr. Lund himself at the time?
[721] MR. McDONALD: Yes. Mr. Lund himself at the time didn't present the detailed technical charts, but he did present the conclusions and recommendations, and that was his recommendation as vice president of engineering.
CHAIRMAN ROGERS: Was anyone who was on the telecon from Thiokol's side recommending launch?
MR. McDONALD: At that time, no, there was no one that recommended launch. And I don't recall there was anyone at either Marshall or Thiokol from NASA that didn't agree that cold temperatures went in the wrong direction, didn't help anything. But no one from Thiokol at that time recommended launch.
CHAIRMAN ROGERS: And what were the comments by NASA officials about that recommendation. as you recall?
MR. McDONALD: Well, as I recall, there were some fairly strong comments about being appalled by the recommendation, about trying to institute new launch
commit criteria at the last minute, about when we will ever get this launch off.
I thought those were fairly strong comments.
CHAIRMAN ROGERS: And those are comments, according to your recollection, that were made by whom?
MR. McDONALD: Well, the comments relative to the launch commit criteria and when we will ever get this off was made by Mr. Larry Mulloy. The comment about being appalled was George Hardy, who was at Marshall. I think I recognized his voice, but that was by voice recognition.
CHAIRMAN ROGERS: And so it was decided - and are there any other questions that any other member of the Commission has up to that point?
GENERAL KUTYNA: Mr. McDonald, I have one question. Before you went off the net, did you ask or make a comment about the secondary O-ring seal seating?
MR. McDONALD: Was I asked to make one?
GENERAL KUTYNA: No, did you make a comment?
MR. McDONALD: I did make a comment, yes.
GENERAL KUTYNA: Could you recall that comment, please?
MR. McDONALD: Yes. I think I read it to you, and I would be glad to do that again. I made the comment that lower temperatures are in the direction of
badness for both O-rings, because it slows down the timing function, but the effect is much worse for the primary O-ring compared to the secondary O-ring because the leak check forces the primary O-ring into the wrong side of the groove, while the secondary O-ring goes in the right direction; and this condition should be evaluated in making the final decision for recommending the lowest acceptable temperature for launch.
That was the comment I made.
GENERAL KUTYNA: That confused some people. Some of the witnesses I spoke to thought that that was a comment in support of the launch, the fact that the secondary O-ring seal would seat.
MR. McDONALD: Well, that comment is a good news-bad news comment. There is good news and there is bad news. The good news is that the secondary seal is in the right position, but that is not unique to temperature. It is always that way.
[722] The bad news is that the primary seal is the one we are depending on for the full ignition transient, and it is going to be a lot worse than it was. But even the secondary, as I mentioned, wouldn't be as good cold as it would be normally.
GENERAL KUTYNA: But by this comment you were not supporting the launch?
MR. McDONALD: No, not by that comment I wasn't supporting the launch. I was just saying it is an important consideration and I felt that if we could run some calculations to show that the temperature did not affect the timing, then that would be supportive of the launch.
If it did - and that was a concern, if we push that timing out long enough, we had a chart in there that said if that timing goes beyond that 200 psi regime while you're still eroding the primary O-ring, that for whatever reason if you ever bypass it at that time you can't depend on the secondary, and that is what is important.
GENERAL KUTYNA: Thank you.
CHAIRMAN ROGERS: So at the time of the caucus, then, you never favored launch?
MR. McDONALD: No.
CHAIRMAN ROGERS: And you made it clear that you were opposed to launch?
MR. McDONALD: Well, I never said I was opposed to the launch. I just made a few comments about why I thought some of the data was not appropriate, like the static tests, for saying the O-rings were good to 36 degrees. I made this comment about the lower temperatures affecting both O-rings, but it affects them
a little bit differently because one of them, it is a dynamic O-ring, it moves. One of them has a lot more movement and effects on it than the other one does, because it has to move across the groove.
I made those comments.
CHAIRMAN ROGERS: But you accepted the recommendation?
MR. McDONALD: I accepted the recommendation, yes. I thought it was the appropriate recommendation.
CHAIRMAN ROGERS: In other words, you accepted the recommendation of no launch that was made by your company?
MR. McDONALD: That is correct.
CHAIRMAN ROGERS: Mr. Armstrong.
VICE CHAIRMAN ARMSTRONG: Would you be surprised if your comments were interpret-ed by both your own company personnel and Marshall personnel as being supportive of the Marshall position?
MR. McDONALD: Yes, I would be surprised at that, yes. I wouldn't be surprised that that would be evaluated as the effect of that, but I would be surprised that it was interpreted as supporting.
VICE CHAIRMAN ARMSTRONG: Thank you.
MR. RUMMEL: Mr. McDonald, you mentioned a 40 to 90 degree qualification limit. Was that referring to
ambient air temperatures?
MR. McDONALD: Well, I had a discussion about that later. It was my impression that the motor itself was qualified from 40 to 90 degrees for operating, and we got into a discussion in [723] fact during the caucus, that was supposed to last for five minutes, that lasted for about a half an hour, on that very subject.
I told the people that were there from NASA that I, first of all, didn't agree that the motor was even qualified for 40 to 90 relative to all of its elements and subsystems. I wasn't there in the qualification of the steel case motor, but I just recently went through that process in the filament wound case SRM, and I am not aware of the testing or analysis that the O-rings were good to those temperatures, and that therefore it is part of the elements.
And the way I interpreted the spec is that all of the components and elements that make up the SRM should be qualified to those temperatures. Larry Mulloy at that time told me: Well, no, the 40 degrees refers to a propellant mean bulk temperature, and the propellant mean bulk temperature was being predicted to be 55 degrees for that launch; and that as long as the propellant mean bulk temperature wasn't below 40 degrees that you could expose the other parts of the motor to
lower temperatures, as long as you didn't drop the propellant mean bulk temperature outside of the 40 degrees.
I responded, I told him I thought that was absolutely ridiculous, because you could expose that motor to very severe cold temperatures, subzero temperatures, for a fairly long period of time, and you wouldn't change the propellant mean bulk temperature at all. It is just such a massive amount of propellant and insulator there that it takes a long time to do that, and I'm sure that the spec really didn't mean that.
And so my interpretation was certainly different than his.
MR. RUMMEL: Was there in fact a minimum temperature established by specification or by rote or in some manner that related to the O-rings or the joint at that time?
MR. McDONALD: Well, I wasn't aware of one for the O-rings. I found out later that there was - our specification refers to a higher level specification, which is level two at Johnson. I think that's the 07700 spec, that says that the shuttle vehicle has to be capable of launching in 31 to 99 degrees, or something like that; and therefore, since it is a higher level spec, that we should be able to comply with that.
But I'm not aware that all of the elements and subsystems were ever qualified to that.
MR. RUMMEL: What do you mean by "higher level spec"? Could you explain that?
MR. McDONALD: That specification comes down from the Johnson Space Center, who is responsible for the overall preparation of the vehicle, the shuttle vehicle, and what it is capable of operating in, the environments, both pre-flight and flight. And that specification for the overall vehicle gets incorporated as part of the lower level specifications that go through level three, which is Marshall Space Flight Center, to the various elements.
And they refer to that, and when they refer to that the way the system is supposed to work is, you're supposed to comply with your own specification plus any higher level specifications that may involve the entire shuttle system.
And I was unaware of that, frankly, that that criteria was in there. I'm still a little puzzled about it, because it doesn't have any timing limitation on it, either, whether it's 31 degrees for five minutes or 40 days.
MR. RUMMEL: Was there a Thiokol design temperature limit at the time this motor was designed
with respect to low temperatures?
MR. McDONALD: I really can't answer that, because I wasn't involved in the original design qualification.
CHAIRMAN ROGERS: If I may, I would like to continue, and we can come to some of these other questions. I would like to continue the chronology, because we were going fine and you stopped about the caucus.
Mr. Armstrong has a question.
VICE CHAIRMAN ARMSTRONG: One question, involving your answer that you just gave. Had Morton Thiokol to your knowledge ever informed NASA that the launch commit criteria were inadequate or did not in fact cover the kinds of conditions that you were concerned about?
MR. McDONALD: I am not aware that they ever did, not to my knowledge.
VICE CHAIRMAN ARMSTRONG: And so we're really talking about an event that was within the launch commit criteria, but outside what your experience base was?
MR. McDONALD: Well, I guess I don't even - I'm not convinced of that, either. I didn't learn about the 31 degree thing until some time afterwards.
But we were told to make this evaluation on
the basis of launching at 0938 in the morning, where the predicted temperature was 26 degrees Fahrenheit. That was the predicted temperature, and that was the decision that was made, whether we could launch at that time. So I'm not sure where that came from either.
CHAIRMAN ROGERS: Dr. Ride.
DR. RIDE: Yes, just one follow-up to Neil's question. Are you aware of NASA ever asking Thiokol to qualify the SRM or the SRB to 31 degrees?
MR. McDONALD: I'm not aware of it, but again, I wasn't in that part of the program. They may have. I can't say.
CHAIRMAN ROGERS: If we may now, let's go back. You said that a suggestion was made that you have a recess for five minutes. Who made that suggestion?
MR. McDONALD: That suggestion was made from someone at Thiokol. I can't recall whether that was Joe. I think it was probably Joe Kilminster, but I'm not sure.
CHAIRMAN ROGERS: Okay. Now what happened? You said that that lasted almost a half an hour instead of five minutes?
MR. McDONALD: That is correct.
CHAIRMAN ROGERS: And during that time what did you do and who were you with?
MR. McDONALD: Well, I was in the conference
room at Kennedy with Mr. Reinartz and Mr. Mulloy and Mr. Houston and Jack Buchanan still. And I gave you my conversation about interpretation of the qualification temperature there.
I also commented at that time that, I suggested that maybe we consider a late afternoon launch. I didn't feel good about the low temperature launch, because when I had first come down to Kennedy the original schedule was to launch that in the late afternoon, I think quarter to 4:00 or something like that. And based upon the weather report I heard, the temperatures would be 48 to 50 degrees in the late afternoon.
So I said, why don't we go to a late afternoon launch, and I was told that was considered, but it was rejected because of some problem either with visibility or weather at one of the transAtlantic abort sites. I think it was Dakar or Casablanca, one of those.
[725] I really expected - and the reason it was taking so long for this five minute caucus is that we were either trying to find some more information to support our recommendation or that we were trying to run some kind of calculations to determine how far away from that we could go, because clearly 26 degrees is a long way from 53.
I personally felt we certainly wouldn't go below 40, because I thought my interpretation of the qualification was correct and we wouldn't do that. But the reason it took so long was the engineers were reassessing all of the data they had and finding any more that they may have, and trying to quantify more. A lot of that data was very qualitative.
And finally, the people from Thiokol in Utah did come back on the line, after about a half an hour, and I believe it was Joe Kilminster who came on the line and said that, even though we had some concerns about the lower temperatures, that we would recommend that they proceed with the launch, based on the fact that we felt the temperature data that we had was not totally conclusive.
And he outlined several concerns still that we had relative to the effect of temperature, but also some rationales why we felt it was safe to proceed.
CHAIRMAN ROGERS: Can you relate what he said?
MR. McDONALD: Well, it was the information basically that ended up finally on the faxed statement relative to our concerns about the O-rings being colder and harder, but that we also had some data that was inconclusive relative to temperature, and I'm sure it
was the warmer temperature launch when we had some blow-by.
I didn't see anything that I recognized that was new information, but maybe they had some. And I felt all the engineers were certainly there that had generated the original data and evaluated it, and maybe they had reconsidered or re-evaluated the data they had and tried to quantify it and felt it was probably okay.
When he completed that he was asked, I believe it was by Mr. Hardy, I'm not sure, to put that rationale in writing and to sign it, make sure they get it down to the Cape, I think by morning, early morning.
And I was sitting across the table from Larry Mulloy at the time and I said I felt that I was the one who was going to have to sign it, because I was at the Cape; and I said I wouldn't sign it. I couldn't; it would have to come from the plant.
Joe Kilminster said that he would draft a letter or a statement and send it down, and he would do it tonight. He wouldn't wait until the morning. And I was instructed to stay there until that came down; and that he would also send it out to Marshall, and it would be a few minutes before that would come down. [Ref. 2/25-2]
He went off line at that time, and I asked Cecil Houston where the fax was, and he told me it was
at the other end of the building. I had a conversation with people at Thiokol just before they went off the line: Would they send that information in to Jack Buchanan's office, which was the fax machine right next to that we had, or were they going to send it in to the Marshall office, they had a Pitney-Bowes machine or something?
And they said: We will send it on the same one we sent all this other material, because they had the right number, and it happened to be the Marshall one, which was at the other end of the building. And so I said, fine, I would wait.
[726] Again, it took some time for that fax to get there, and so all of the parties who were in the meeting were still sitting there. And we started to talk about some things.
I told them I didn't feel very good about this recommendation, and I recognized it is very difficult to quantify at which temperature these seals may be acceptable and where they aren't acceptable based upon that data. Some of it certainly was inconclusive, there was no doubt in my mind, and that is a difficult thing to quantify.
But even though I didn't agree with the 40 degree qualification of the motor, that all elements
were qualified to that, it was my understanding that there were a lot of people at both NASA and Thiokol signed up to that, the design certification process, the critical design reviews, and I was absolutely surprised that NASA would accept any recommendation below 40 degrees Fahrenheit, especially when the predicted temperature was as low as 26 degrees Fahrenheit.
I told them: I may be naive about what generates launch commit criteria, but I was under the impression that that was generated based upon the qualification of all elements or subsystems of the space shuttle, and that anything that was outside that qualification was a launch commit criteria, and we never went outside that envelope, and I don't know why NASA would ever launch below 40 degrees Fahrenheit if that is what the SRM was qualified to.
In fact, I made the direct statement that if anything happened to this launch, I told them I sure wouldn't want to be the person that had to stand in front of a board of inquiry to explain why we launched this outside of the qualification of the solid rocket motor or any shuttle system.
When I made that statement, no one commented on that. I was still very upset, and so I asked that they reconsider this decision, for three reasons not one
but for three. And I said, if I were the launch director I would cancel this launch, for three reasons, not just one:
The first one being the concern of the cold O-rings that we just discussed, but there were two others. I had just left Carver Kennedy's house in Titusville, Florida, and he's responsible not only for stacking of the SRM's, he's responsible for the retrieval operations.
And he had been in communication with someone that was at hangar AF, I believe, that contacts the booster recovery ships at sea, and they had told him that the booster recovery ships were in an absolute survival mode, was how they put it; that they were in seas that were as high as 30 feet. There were winds at 50 knots sustained, gusting to 70 knots, pitching the boat as much as 30 degrees.
They even felt the rough seas may have damaged some of the retrieval equipment on the back of the ship. They were steering directly into the wind, heading for shore at about three knots, and they had been doing that for some time. There was no way that they would be able to support an early morning launch, because they wouldn't be in the recovery area.
I then reminded everyone in the room that
there are some firsts on this launch. This was the first time that we were going to use the new electronic control system for separating the nozzle extension cone on the SRB's at apogee, rather than just before water impact, while it is under full main parachute, and we were going to separate the parachutes at water impact for the very first time on this launch; and that, based on [727] the sea states that I had just heard, it appeared to me that it was going to be nearly impossible to recover that hardware, either the parachutes or the thrustums.
That there was also, I felt that they were putting the boosters at some risk as far as recovery was concerned, because the ships were steering away.
I also said that the third reason for not launching is the formation of ice. I knew that the sound suppression system was a water system, and I felt there was probably a lot of ice around there. And I'm no expert on all these matters, but I do feel that there may be a chance that that changing acoustics may be a problem with debris. It may have some effect on the structures. I didn't know, but I didn't think it was prudent to launch under that kind of a condition.
I was told that you know, there really weren't my problems and I really shouldn't concern myself with
these. But I said, you know, all three of these together should be more than sufficient to cancel the launch, if the one we had discussed earlier wasn't.
The NASA people who were there said that, well, they would pass these on, and they could tell I was disturbed and they would pass those on as concerns, and that they would do it in an advisory capacity.
I was then asked by Mr. Mulloy where the signed fax was, because some time had transpired since the teleconference had ended and it still wasn't there. And so I said, okay, I will go check on that, and I went down to the other end of the building, to this fax machine.
And there was nothing there that had come out yet, and I really wondered if it was working. And it was getting kind of late, and so I stayed down there I guess for about ten minutes. And it finally came in.
I brought the fax back - it was a single sheet of paper - to Jack Buchanan's office, where we reproduced copies for everyone. And I walked into, I think it was, Cecil Houston's office there and there was a telecon being conducted, and I believe it was with Arnie Aldrich.
And they were in the middle of this telecon and they were discussing the conditions of the booster
recovery ships and the high sea states and the fact that they were in a survival mode. And I recall that Arnie Aldrich asked Larry Mulloy if he felt there was any risk to recovering the boosters because of this. And he said, no, he didn't think there was any significant risk in recovering the boosters, because they had beacons and monitors, and they were going to have aircraft in the area also; but that there was a high probability that they would not recover the parachutes or the thrustums.
And the conclusion was that, I guess, they would have to make a decision to launch on the basis that they would have a high probability of not recovering that hardware.
But they weren't compromising the recovery of the boosters significantly. And I remember Arnie asking Larry the value of that hardware, and I think he gave some number close to a million dollars and asked him if he could afford to lose it and support the schedules of the program. And he said that he had sufficient inventory to do that.
But Arnie also told him that in no way have those ships attempt to turn around in those kinds of conditions, and the safety of the ships was important, to try to support that launch, and to turn around too soon, so to tell them to continue on towards shore until
it was really safe to turn around.
[728] They then briefly discussed the ice issue, about the ice, and there was a concern raised there. And Arnie, I believe it was Arnie, responded that they had discussed that issue earlier in the day. So it was a fairly brief conversation.
CHAIRMAN ROGERS: Arnie is Mr. Aldrich?
MR. McDONALD: Yes, Mr. Aldrich. They also made it clear that they were acting in advisory capacity only they weren't making some recommendations, they were acting in advisory capacity, but they wanted to be aware of this information. I didn't hear anything discussed about the O-ring seal problem. I presume that was done while I was down waiting for that fax, because that was the first concern.
CHAIRMAN ROGERS: But you're not sure of that?
MR. McDONALD: I'm not sure, I presumed it was because I got in on the middle of the conversation on the boosters and heard the ice. So I don't know. And finally the conversation concluded and the recommendation was to proceed on with the launch.
I stayed around a few more minutes and talked to Jack Buchanan for a few minutes, and then went back to Carver's house in Titusville, where I stayed, and got in there, I guess, a little before 1:00 sometime. And I guess that's all I have to say.
CHAIRMAN ROGERS: A couple of questions.
One, when you first appeared before the Commission I remember your explaining the fact that the company originally had recommended against the launch. And then you testified that after the caucus they came back and changed their mind and said go ahead with the launch. You said it was based upon inconclusive data.
I remember asking you how could they have changed their mind based upon inconclusive data. Can you explain that?
MR. McDONALD: Well, I can't explain that. That was the comment that was made, that the data was inconclusive relative to the effects of the temperature, and I prefer you ask those questions of those that made that decision. I don't know. I wasn't there. I wasn't there when all of that data was reassessed and evaluated and what the conclusions were drawn.
CHAIRMAN ROGERS: One other question. Dr. Keel asked at the conclusion of your testimony in executive session whether you felt that you were under pressure or had been under pressure or the company had been under pressure to reverse its decision, and I think your answer was yes. Do you remember that?
MR. McDONALD: Yes, definitely. There was no doubt in my mind I felt some pressure. I feel that I have a responsible management position, and I felt pressure.
CHAIRMAN ROGERS: Would you explain the reasons for feeling pressure?
MR. McDONALD: Well, I have been in many flight readiness reviews, probably as many as anyone, in the past year and a half at Thiokol, and I have had to
get up and stand before, I think, a very critical audience at Marshall, and a very good one, justifying why our hardware was ready to fly. I have to get up and explain every major defect and why we can fly with that defect.
And for the most part they are very minor - very, very minor. And I have been hassled about how I'm sure that that is okay to fly with. You know, such things as losing vacuum in a carbon cloth part in the nozzle while the part is basically cured. It is a critical process.
[729] There is a lot of those critical processes, and I have to address every one of those in great detail as to why I am sure that that part has not been compromised. And it has been that way through all of the reviews I've ever had, and that is the way it should be. And it is not pleasant, but that is the way it should be.
And I was surprised here at this particular meeting that the tone of the meeting was just the opposite of that. I didn't have to prove that I was ready to fly. In fact, I think Bob Crippen made the most accurate statement I ever heard. His conclusion from that meeting was the philosophy seemed to have changed because he had the same impression I did, that
the contractor always had to get up and stand up and prove that his hardware was ready to fly. In this case, we had to prove it wasn't, and that is a big difference. I felt that was pressure.
CHAIRMAN ROGERS: And can you explain a little more what source the pressure came from in your mind?
MR. McDONALD: Well, I think the strong statements that were made by Mr. Mulloy, and even some of those, the people at Marshall that were on there - Mr. Hardy - were I think fairly strong statements that I took as pressure about when we will ever fly this thing and the launch-commit criteria that we can't generate at the last minute, and appalled by our recommendation to fly at temperatures as high as 53 degrees. And that, to me, that was pressure to me.
It may not have been interpreted by others, but it was pressure to me.
CHAIRMAN ROGERS: Any other pressure that you want to refer to at this time or at any time?
MR. McDONALD: No. I just felt that the way the comments were made, as strong as they were made, and the fact that the conditions for justifying this launch were so much different than anything I'd been involved with before.
CHAIRMAN ROGERS: As far as the Telefax was
concerned, would you normally have signed that Telefax, or was the procedure that was followed the normal procedure?
MR. McDONALD: Well, I'm not sure, I guess, what the normal procedure is. I felt that since I was there representing the senior official at the Cape that I'm the one that usually is responsible for that. I know at the L-1, when we have a normal launch, there is a poll that is conducted by Jess Moore of all the contractors, whether they are ready to fly, and I am the guy there that has to get up and say yeah, Thiokol's hardware is ready to fly.
I felt that was my responsibility. That's why I'm there. I can't recall whether we were asked to sign anything like that before. We have a presentation that is given at every flight readiness review that is signed off by the principal parties. Joe Kilminster usually signs all of those on the formal review, but if anything comes up afterwards it has been done on an oral basis.
But I don't know. I've never been put in that position, and I don't know if Joe has. I don't believe he has.
CHAIRMAN ROGERS: So, the fact that a written decision was requested, as far as you were concerned, was not a normal way to do it?
MR. McDONALD: It was not normal as far as I was concerned.
CHAIRMAN ROGERS: And, as I recall your testimony, you testified that you made it clear that you would not sign a written statement approving the launch. Am I correct?
[730] MR. McDONALD: Yes, that is correct. And I think that has been misinterpreted, at least by the press. They said that I was overruled by my supervisor. That is not true at all. I chose not to sign that. He didn't overrule me. I felt that that decision, when I started, was an engineering decision by the people that understood the problem the best, that had all of the data and facts, and they are the ones who should recommend it. And that is why I made that.
It wasn't that I was overruled.
CHAIRMAN ROGERS: Thank you very much. I am sure other Commission members will have questions.
Mr. Armstrong?
VICE CHAIRMAN ARMSTRONG: You were talking about the 40-degree qualification of various components of the solid rocket booster, and I was aware of the 40-degree limit on the mean bulk temperature. But was there anything else that the 40 degrees referred to?
MR. McDONALD: Well, in the spec, going back
after the fact and looking at it, that is what it had. What it refers to is the propellant mean bulk temperature.
I guess that is, in my opinion, it's an oversight, maybe, in the spec, or the launch temperature of 31 to 99 should be stronger in there to apply to all components, and by qualification it either has to be qualified by test or some analysis, and that means every element. And I'm not aware that all of those elements were qualified to that temperature.
I know we bought O-rings that said they are good to minus-30, but I never saw the analysis, and the application that we used them in that says that they are good to that, and that is a difference. It is a material problem versus a design problem.
VICE CHAIRMAN ARMSTRONG: I understand that, and I understand the 40 degrees was intended to protect against grain cracking and the consequences of that. But what I didn't quite understand is why you said you wouldn't recommend any time launching below 40 degrees.
MR. McDONALD: Well, the reason I said that is I felt that is what everyone had signed up to, as what this thing was really qualified from an operating standpoint. Now the motor does get exposed to much lower temperatures. We have a criteria in our
specification to expose that to much lower temperatures, sub-zero temperatures in the 60-mile winds coming across Wyoming, because we ship these things from Utah down to the Cape. So in the transportation mode they are subjected to some very severe temperatures for some periods of time.
And there has been analysis to show that they will withstand those temperatures as long as you don't operate them at those temperatures. The 40 degrees, they won't crack. There is no problem there. That is a, primarily a performance standpoint. You lost total impulse and performance the lower the temperatures go. If you get below 40 you start losing performance out of the shuttle and that is why that number came about.
As far as the capability of - grain structural capability, it can withstand a lot colder temperatures than that, and we have analysis where the transportation and storage shows that, and it has good margins of safety, very high margins of safety for exposure to lower temperatures.
It is just that things like the O-rings and some of these other components, I am not aware that we have really analyzed or tested those well enough to understand how they would operate in that kind of a temperature. There is a difference between exposing
them and storing them versus operating them.
VICE CHAIRMAN ARMSTRONG: Thank you.
DR. WALKER: I have a question just referring back to the static test that you mentioned at 36 degrees which was used as a justification. Was there analysis to indicate what the O-ring temperature during the test was?
MR. McDONALD: Well, it was done after the fact, and I believe in the presentation that was made on the night before the launch they calculated like 47 degrees is what they presented as what they expected the O-ring temperature to have really been when that was static tested.
DR. WALKER: I have a couple of other questions regarding the conference. Was there a specific request by NASA to reconsider, or was the reconsideration as a result of the implications of the remarks made by the NASA people in the conference?
MR. McDONALD: Do you mean the reconsideration of what?
DR. WALKER: Of the initial decision not to launch. The initial recommendation of Thiokol was not to launch, and then that was reconsidered. Did anyone from NASA explicitly ask for reconsideration, or did the reconsideration occur because of the negative remarks
and comments on that decision?
MR. McDONALD: Well, I think it was the latter. I can't fully recall whether they directed us to do that or not, but they had concluded that the temperature data was inconclusive, and I don't know whether we volunteered to reassess it or they said we need to. It is not clear to me on that. I'm not sure.
DR. WALKER: One further question in regard to the signature on the sheet which was faxed from Mr. Kilminster. Was there a specific request for that to be signed, and who made that request?
MR. McDONALD: Yes, there was a specific request for that to be signed. I believe it was George Hardy. It may have been Larry Mulloy. But I think it was George Hardy had requested that.
MR. ACHESON: Mr. McDonald, did you consider bringing your concerns about the final recommendation to the personal attention of Mr. Moore or Mr. Aldrich or Dr. Lucas?
MR. McDONALD: Well, I'm very familiar with the process by which these things are reviewed, and I was absolutely positive and sure that they were brought to their attention, because that is the way things go. I talked to the SRB project manager. I talked to his boss, the shuttle project manager, the shuttle project
office, and I was assured that those all went through those reviews.
I had no doubt in my mind that they had.
MR. ACHESON: Thank you.
DR. FEYNMAN: You indicated that NASA folk indicated that they would pass your concerns along, and I presume that you thought that - there were three concerns that you were talking about - the O-rings, the ocean, sea and the ice. But could they have simply meant the last two concerns, the sea and the ice? That is one question.
And the other is who were the NASA folk that promised to pass your concerns along?
MR. McDONALD: I guess you could maybe interpret that I thought it would be all three, but the people were Mr. Mulloy and Mr. Reinartz that would pass those on, and I presume they passed them all on. I didn't see any reason why they wouldn't.
[732] MR. HOTZ: Mr. McDonald, you mentioned earlier that you thought this decision on launching should be an engineering decision and not a program management decision. How would you characterize the final decision to launch from Thiokol? Was it engineering or was it management?
MR. McDONALD: I guess I would have to
characterize it as a management decision, the final decision.
MR. HOTZ: Thank you.
DR. RIDE: I have got a couple of questions on Criticality 1s. Did I understand you to say that you chair the board on Criticality 1s on the SRM from Thiokol?
MR. McDONALD: Yes, on all defects that are affected by that, yes.
DR. RIDE: Could you give us your understanding of the meaning of Criticality 1 and just an estimate of how many parts in the SRM system are classified as Crit 1?
MR. McDONALD: I don't have the number for you, but there is a tremendous amount of Crit 1s on the SRM, primarily because the motor doesn't have very many redundant features. The solid rocket motors don't. And, of course, a lot of it is structure and structure all becomes Crit 1 if it fails.
DR. RIDE: Could you define a Crit 1?
MR. McDONALD: Crit 1 is a single point failure that if that element fails there is no recovery. You lose the hardware and it is catastrophic. There is a lot of elements in the SRM that are under that category. Relative to the O-ring
seals, the redundancy was built in, because that was a critical element, as the pressure seal, in order to provide that redundancy.
I think there is some confusion of late as to what that Crit 1 and 1R was relative to the seals and how it was removed. I wasn't involved at the time, but it was found that because this joint rotated that if you took all of the worst engineering tolerances and dimensions that were allowed by the prints - and that means the maximum clevis opening you could have to start with, the smallest and thinnest tang that you could put into that clevis opening, the minimum O-ring that you could put in there with the maximum size of the grooves you could possibly put in there - that you put all of those combinations together, you could show that you would actually lose squeeze on the secondary O-ring once you pressurized the system and the joint rotated.
And, therefore, if you ever had to call upon that O-ring as a redundant system during that time period, you couldn't depend on it.
Now I went back and had an assessment made of have we flown any hardware in that condition, because I was a bit shocked about that, as much as anyone, when I first found that out, which was, by the way, last August
when I made that presentation here at NASA headquarters. I was unaware of it myself, that we had such condition, that we were flying with a Crit 1 on that part of the hardware.
Based on the information that I have received on all of the joints ever flown on the shuttle, there was only one time where we had a tolerance stackup of a joint that would have fallen from a Criticality 1R to a 1, and that was on STS 4. We had never had one since. We didn't have one before that. We always had adequate squeeze from the hardware when it rotates to maintain it as a Criticality 1R.
[733] DR. RIDE: I'm not quite sure I understand that, because I thought that the piece of paper in the critical items list specifically lists the primary O-ring as a Criticality 1.
MR. McDONALD: Yes, it does. and the reason it does that is because the drawing tolerances allow you to install hardware that may come together on a worst case basis that cannot guarantee a secondary seal. And, therefore, if you use all of the hardware that is in the inventory or you could possibly have in the inventory and build to acceptable prints, you could end up with a very small fraction.
It is a very small fraction that could go
together that way, and therefore that document was written to cover all that. But in reality other than that one case we never assembled hardware that way. We haven't had the thinnest tangs with the widest open clevises with the minimum O-rings ever put together. That is a concern, and the seal is a very serious concern, in my opinion, because that decision was made at the time based upon what we knew about joint rotation.
Since that time, we're getting this information on resiliency and the effects of temperature, which were never put into that at that time, that brings that question back out in front. I told you we didn't fly from a Criticality 1R and 1. Well, that is true, based upon the decisions and the information that was known that changed it from a 1R to a 1 just upon the tolerances and dimensions.
As far as the resiliency thing, I can't assess that yet well enough to know, but I do know we never stacked hardware together that had tolerances so bad that we didn't have contact of the secondary O-ring other than one joint.
DR. RIDE: But, just to be clear, I guess, you don't on a joint-by-joint basis go back to the NASA board and kind of reclamma the Crit 1 and turn it back into a 1R, do you? It is always classified as a
Criticality 1 on the primary seal?
MR. McDONALD: That's absolutely right. You are correct. Now we do, as part of our flight readiness review, present those joints that we are mating and what those O-ring squeezes are on every flight.
DR. RIDE: Did any discussion of the primary seal as a Criticality 1 come up during your meetings on L-1?
MR. McDONALD: No, they didn't.
DR. RIDE: Thank you.
DR. FEYNMAN: You suggested that the secondary seal would not be much affected by the temperature, but now you are telling us that because of the complete or nearly complete loss of resilience - that is, the tendency to spring back - the secondary seal would require very little rotation to open. Do I understand that correctly?
MR. McDONALD: I said it wouldn't be as affected as much as the primary seal because it doesn't have to move from one end of the slot to the other. But as far as the effect of resilience, you are absolutely correct. It still has the same problem. As far as extruding in the gap, it has still got the same problem.
DR. FEYNMAN: We were talking about- -
somewhere there was a discussion about the secondary seal being redundant until the metal parts rotate. When the pressure starts to build up, it can't move the primary seal until there is some pressure, and then there's a very small pressure, perhaps, and a very small rotation.
Isn't it true that the rotation is more or less proportional to the pressure, or is there some delay of some sort? Why is there a time delay between the two?
MR. McDONALD: There is some delay because the joint is stiff enough that under certain pressures you just don't move it at all until you have to build up some pressure to make any rotation. So there is a delay in that time period. But at some point in time it becomes a direct function of the pressure.
DR. FEYNMAN: Isn't the laws of elasticity such that everything is proportionate to the force and all of the spaces are proportional to the force? Wouldn't it be true that at every pressure there is some rotation and the rotation is more or less proportional to the pressure?
MR. McDONALD: Well, I think when you are down to a few psi or 50 psi, I don't think you are rotating anything.
DR. FEYNMAN: You are rotating it one-tenth as much as you rotate it at 500 psi; is that right?
MR. McDONALD: Well, the structure is so stiff that I can't believe you rotate it at all at 50 psi. You are moving the O-ring seal back into the groove, however.
CHAIRMAN ROGERS: Just to go back to the Criticality 1 so that I can understand it a little better, in, what, 1985, a change was made?
DR. RIDE: 1983.
CHAIRMAN ROGERS: I guess it was 1982 or 1983. At that point, it was listed as Criticality 1 with an R. Is that right?
MR. McDONALD: That is correct.
CHAIRMAN ROGERS: Now, does that mean that it was decided that if there was a failure in that seam, O-ring, that the mission and the crew would be destroyed, the whole thing would be a catastrophe? But at that point the R meant that there was a redundancy there, that you had two rings and each at that point was considered to support the other, or at least one was a backup for the other?
MR. McDONALD: That is correct.
CHAIRMAN ROGERS: That is what "R" meant?
MR. McDONALD: That is correct. The "R"
means redundant.
CHAIRMAN ROGERS: Now at that time experience merely demonstrated that the analysis which you had been using up to that point may not have been correct, so that instead of having both a primary and a secondary seal which provided redundancy, you came to the conclusion you didn't have a redundancy. Therefore, it was changed to Criticality 1; the "R" was removed. Is that correct?
MR. McDONALD: That is correct.
CHAIRMAN ROGERS: And so from that point on, I believe it was in - what is the date - December 1982, those shuttles have been flown on the basis of Criticality 1, so if there was a failure of that seal a catastrophe could result because there was no redundancy; is that correct?
[735] MR. McDONALD: Well, I guess that is the interpretation of that. But recognizing the actual hardware that was put together and what we knew at that time, I don't believe that that was true.
But what was true was that the drawings, as I mentioned, allowed the condition where that, you could fly that hardware in that condition.
DR. RIDE: But, just to be clear, what the CIL says is that the primary O-ring is a Criticality 1 and
you're not allowed to consider the secondary O-ring as a backup to that?
MR. McDONALD: That is true, Sally. That's absolutely correct. That is what is meant.
CHAIRMAN ROGERS: And that was known by everyone, I assume, who was working on the program - or most of the top people working on the program. Would that be true?
MR. McDONALD: Well, I kind of thought I was one of the top people working on the program, and I didn't know that until August of 1985 when I put that presentation together. I presume it was. I did find out that there was some disagreement between both Thiokol and Marshall in interpreting that relative to the joint rotation.
The joint rotation that was used for concluding that was obtained from two different sources. One of those sources was from the structural test article 1, the first structural test article - and this was way before my time. But where this test article was taken to Marshall and it is basically a forward segment - it is unloaded - and an aft segment. And where they input both the prelaunch loads and they put flight loads and all that business into the test article.
And this test is run horizontally and they measure through the leak check port, I understand, or some places, the actual rotation of these parts. And they got some fairly high numbers, up around 60/1,OOOths, I believe, is what they said it rotated. We had run some tests ourselves in a vertical assembly during the hydro test, and measured some of the rotations and got numbers like 30 to 40/1,OOOths. So there was some disagreement as to which numbers were correct.
Some of our people felt that the horizontal assembly may have made the structural test article numbers not representative and the vertical assembly was better. And in fact, because of that disagreement, we are in the process - and started early last summer at the direction of Marshall - to come up with what is called a referee test, to do some very careful instrumentation in a vertical assembly to get a better handle on the exact amount of joint rotation.
Those joint rotations that are used are those that are predicted for the maximum expected operating pressure, which, by the way, we have never obtained, fortunately - and I hope we never do. But that is a 3 sigma out there someplace. But that still is a point of controversy as to what that number really is, because
the CIL, I believe, the critical items list, that changed that from a 1 redundancy to a 1 not only assumed the MEOP but I believe it assumed the larger rotation, which is about 50 percent more than some of the data that we got from vertical.
So I still don't fully understand that. What I do understand is that it was made at the time when temperature effects were not known. And the resiliency problem, as Dr. Feynman brought up, I think is a more serious one.
CHAIRMAN ROGERS: Going back, though, beginning in 1985, when you realized that the Criticality 1 was on the critical items list, you knew from that point on that a single failure would be a catastrophe as far as the mission was concerned?
[736] MR. McDONALD: Well, as I mentioned earlier, you have to postulate what your failure mechanism is, and I felt very strongly that the blow-by that we had observed indeed was on the early part of the ignition transient. I think we all felt that way. We modeled that, by the way, I think fairly reasonably on the erosion.
And at that point in time, when the hardware really hasn't had a chance to rotate, taking the temperature effects out now, that we do indeed have a
good, redundant seal, because if we lose the primary O-ring at that time that secondary seal is in a better shape than the primary to really seal. It hasn't come off its land at all, if you ignore the resiliency problem.
DR. FEYNMAN: That is your opinion. In a different scenario, suppose the pressure is increasing for some reason in the primary seal. Just to understand what the situation is, the primary seal begins to erode, and by the time the pressure gets to some figure like 600 or 700 psi, which is I think just below the maximum operating pressure, it finally erodes all the way through so that the gas can pass through the primary seal.
Would you think there was a reasonable probability that the whole thing would fail because the rotation by that time was enough that the secondary seal can't hold it?
MR. McDONALD: Yes, I think there was, and that was our assessment in August - that there was a reasonable probability.
DR. FEYNMAN: Okay. That you first knew or thought of in August 1985?
MR. McDONALD: That is correct.
DR. FEYNMAN: Not before?
MR. McDONALD: That is correct.
CHAIRMAN ROGERS: Following up on that, wouldn't you assume that other people who had been working on the program and working on the seal and the O-rings would understand that, too?
MR. McDONALD: Yes. I think there is another important piece of information. Back in the end of April 1985 - I forget the exact flight, but it was the last one in April - we had a problem with the O-ring seal in the nozzle.
That flight, after it came back, the nozzle was still attached to the aft segment and we disassembled the segments when they were brought back to the port. And then they are put on rail cars and sent back to Utah and we never got the segment back until, I don't know, sometime in the latter part of June or something. This flight was at the very end of April.
We disassembled that nozzle and we found that we had violated the primary seal, in fact in three locations, and burned completely through. The secondary seal also had eroded like 32/ 1,000ths, but it held and it did its job. That was in a nozzle joint.
The primary seal in the nozzle joint is a bore seal quite similar to the field joint. Tolerances are a little different. But the secondary seal is a face
seal. They are both somewhat dynamic seals, but it is more of a static than the bore seals. The face seal is torqued down with bolts and it obviously did its job.
And our conclusion was, in that particular instance, was that even though we passed the leak check that the vacuum putty may have masked that leak check. We were using at that time a pressure, a stabilizing pressure, to run that leak check at 100 psi. We had had some data earlier that showed us that the consistency of that putty is quite variable, and you can actually [737] - the putty will become a good sealant in many cases and it can hold as much as 100 psi for a good period of time. Sometimes it will blow through and sometimes it won't.
And so our concern was that maybe we were not really checking the O-ring seals. We were checking the putty and we wanted to make sure we were checking the O-ring seals. We jacked the pressure up to 200 psi and that was the last flight where we were still under the 100 psi, which was the previous requirements, to stabilize at 100. And then once you have stabilized it for a period of time there, you drop the pressure completely again and you bring it up to 50 psi, and that is what you run the leak check out for about ten minutes. And we only allow a one psi drop.
In that particular set of hardware, since that was the last one we ran at 100 psi because the change hadn't gotten through with all of the paperwork system on what we understood about how putty behaves under pressure. as we went to 200 psi for the field joints at that time, we just hadn't gotten the nozzle, we concluded that the putty may well have masked that leak check, because it was at 100, and therefore we may have had some defect in that seal that we didn't detect.
And as a result, that seal leaked at ignition from time zero, and when that happens you get severe erosion in the O-ring, because you get the jet impingement that we have been calculating, which is directly onto the O-ring seal, like a flat plate. But when you bypass the O-ring in a leak like that, it actually chokes at that point, so you're forming a throat and it erodes very rapidly from underneath, as well as jet impingement, and you lose quite a bit of the seal.
We lost most of the seal, in fact. But the nozzle seal is very good, the secondary seal, because it is around the corner and it expands and goes down around the corner. And it eroded some of the secondary seal.
We ran a lot of analysis after that, because that was the first time that we had observed erosion of
a primary seal. We developed our models to predict erosion, what would happen in blow-by erosion, and it was because of that that we found that hardware.
And it was late in June and it was into July that we got all that data together. and we went down to Marshall and had very detailed reviews, because that was a serious concern to everyone that we had violated the primary seal that was in the nozzle joint.
But we were asked to come to Washington, to headquarters, and review that. It was a very serious concern. It was at that time that I got together with the engineering people and said, we need to put the whole story together on all the pressure seals, because I and several others still felt that, even though that problem happened