The Columbia disaster is usually told as a piece of foam that nobody could have known about. The Board's own volumes say something harder.
On the first of February, 2003, the Space Shuttle Columbia broke apart over Texas, sixteen minutes from the runway, with seven people on board. Almost every account of what happened begins with a piece of foam that nobody could have known about. The Board that investigated the accident wrote something harder than that, and it wrote it in its own report, which is public, and which is where every fact in this film comes from. The strike was on film.
Tracking cameras caught it during the launch, and a report describing it went out across the agency the following morning, while Columbia was still in orbit with fifteen days of its mission left to fly. Engineers asked three separate times for somebody to photograph the wing while the vehicle was in space. All three requests were closed. The Board counted at least eight further points at which the damage could still have been found.
And the cause was not worked out by deduction afterwards either. The Board took a wing, loaded a nitrogen gun with a piece of the same foam, fired it at a flight panel taken off the shuttle Atlantis, and made a hole sixteen inches by seventeen. There is one question people ask about Columbia more than any other. Could the crew have been saved.
That question has an answer, in section six point four of the report, and the answer has dates in it. A QUARTER OF AN INCH
WHAT THE WING IS MADE OF To follow any of this you need to know what the front edge of a shuttle wing actually is, because it is not what most people picture. It is not metal. Coming back from orbit, the leading edge of the wing runs at around three thousand degrees Fahrenheit, and there is no aluminium alloy that survives that. So the leading edge is built from a material called reinforced carbon-carbon: carbon fibres in a carbon matrix, grey, matte, and only about a quarter of an inch thick.
It is not a coating on top of the wing. It is the structure, and it is bolted on in sections. There are twenty-two of those panels on each wing, numbered from the fuselage outwards, with a narrow filler piece called a T-seal between each pair. Panel one sits near the body.
Panel twenty-two is out at the tip. Behind the panels is insulation, and behind the insulation is the aluminium the wing is actually made of. Aluminium melts a little over one thousand degrees Fahrenheit. So the whole arrangement depends on the carbon panels being continuous.
They are not there to be strong. They are there to keep the outside air outside. Which raises the obvious question of how much damage one of them can take. NASA had studied that.
The analysis predicted that the orbiter could survive re-entry with a quarter-inch diameter hole in the lower surface of panels eight through ten, or with a one-inch hole in the rest of the panels. A quarter of an inch. Hold on to that number. IT HAD COME OFF SEVEN TIMES BEFORE
EIGHTY-ONE POINT NINE SECONDS Columbia launched on the sixteenth of January, 2003. Bolted to the belly of the orbiter is the external tank, the big orange cylinder, and the tank is orange because that is the colour of the insulating foam sprayed onto it. The foam is there because the tank holds liquid hydrogen and liquid oxygen at hundreds of degrees below zero, and without insulation the outside of it would ice over. At the front, where the orbiter attaches to the tank, there is a fitting called the bipod, and the foam over that fitting is shaped into a ramp.
Eighty-one point seven seconds after launch, a piece of foam separated from the left bipod ramp. Two-tenths of a second later, at eighty-one point nine seconds, it struck the left wing. Both of those numbers are in the report, and the film uses both, because they describe two different events: when the foam came off, and when it arrived. At that moment the vehicle was travelling at about one and a half times the speed of sound.
The foam was not travelling at that speed. It had come off the tank and slowed down almost instantly in the airstream, so the wing ran into it. The closing speed was something on the order of five hundred miles an hour. Cameras on the ground filmed it.
The imagery is poor, because the vehicle was already high and moving fast, but a working group of photo analysts had it the next day, and they wrote it up in a report that went out across NASA and its contractors on the seventeenth of January. At that point the mission had fifteen days left to run. And this had happened before. Not foam in general - foam came off every flight, in showers, and the underside of the orbiter came home pockmarked as a matter of routine.
This specific piece. The bipod ramp. The Board found seven known cases where the left bipod ramp foam had come off in flight. The first was STS-7, in June 1983.
The second was Columbia's own ninth flight, in January 1990: review of the photography afterwards found five divots in the tank insulation, between six and twenty-eight inches across, the largest of them reaching into the left bipod ramp. Inspection of the orbiter's underside found a hundred and eleven hits, thirteen of them an inch or more across. The problem was written up as an in-flight anomaly, assigned to the external tank project, and closed out at the flight readiness review for the next mission on the theory that there might have been voids in the foam. Engineers poked vent holes in the insulation to let trapped gas escape.
The most recent case was STS-112, on the seventh of October, 2002. That was three months before Columbia's last launch. THREE REQUESTS. ALL THREE CLOSED
THREE REQUESTS TO LOOK What happens next is the part of the record this film exists for, and it is worth being careful about, because it is very easy to tell it as a story about villains. The Board did not tell it that way, and neither will this. The first request came from the man who chairs the photo working group, Bob Page. He called Wayne Hale, the shuttle programme manager for launch integration at Kennedy Space Center, and asked whether Columbia's left wing could be photographed while it was in orbit.
That means a ground-based telescope or a satellite belonging to the Department of Defense. Hale agreed to look into it. The Board notes, at that point in its report, that this was the first of three discrete requests for imagery by a NASA engineer or manager, and that in addition to those three requests there were, by the Board's count, at least eight missed opportunities where actions may have resulted in the discovery of debris damage. The second request came on flight day six.
A United Space Alliance manager named Bob White, hearing from his own employees who were working on the damage assessment, called a NASA manager named Lambert Austin to ask what it would take to get pictures of Columbia on orbit. Austin telephoned the Department of Defense liaison. He was careful to say that he was only gathering information, not asking for anything. The Department of Defense began arranging it anyway.
On the twenty-second of January a lieutenant colonel wrote to a NASA manager: Lambert Austin called me yesterday requesting Department of Defense photo support for STS-107. Specifically, he is asking us if we have a ground or satellite asset that can take a high resolution photo of the shuttle while on-orbit, to see if there is any damage on the wing. We are working his request. At half past eight that morning, the NASA liaison officer called United States Strategic Command - USSTRATCOM - and cancelled it.
The reason given was that NASA had identified its own in-house resources and no longer needed the military's help. The Board's sentence about this is one line long. The NASA request to the Department of Defense to prepare to image Columbia on-orbit was both made and rescinded within ninety minutes. The third request came from the engineers themselves.
The Debris Assessment Team had spent two hours going through the results of the damage model, and every member of the team supported asking for pictures. They gave the job to their NASA co-chair, Rodney Rocha. Rather than send it up the mission chain of command, they routed it through Rocha's own engineering directorate, because mission management had not been taking part in their meetings. That request was refused too.
Rocha then wrote an email that he did not send. He printed it out and showed it to a colleague instead. In my humble technical opinion, this is the wrong, and bordering on irresponsible, answer from the shuttle programme and orbiter not to request additional imaging help from any outside source. I must emphasise, again, that severe enough damage, combined with the heating and resulting damage to the underlying structure at the most critical location, could present potentially grave hazards.
The engineering team will admit it might not achieve definitive high confidence answers without additional images, but, without action to request help to clarify the damage visually, we will guarantee it will not. Remember the NASA safety posters everywhere around stating, if it's not safe, say so? Yes, it's that serious. Asked afterwards why he never sent it, Rocha told the Board that he did not want to jump the chain of command.
He had already raised it with his manager. He would defer to management's judgement. FIFTEEN DAYS STILL TO FLY
INSIDE THE CREW MODULE While that was going on, Columbia was flying a science mission, and the crew were working. STS-107 was not a station flight. Columbia did not go to the International Space Station on this mission and could not have reached it - the orbit was wrong, and the vehicle did not have the fuel to change it. That matters later, and it is why the rescue in chapter nine has to be a second shuttle rather than a docking.
What Columbia carried instead was a laboratory module in the payload bay and roughly eighty experiments, run around the clock by two shifts, so that somebody was working every hour of the sixteen days. There were seven of them. Rick Husband, the commander. William McCool, the pilot.
Michael Anderson, the payload commander. David Brown, Kalpana Chawla and Laurel Clark, mission specialists. And Ilan Ramon, a payload specialist, the first Israeli in space. There is video of them from re-entry morning, because one of them was holding a camera, and the tape was found afterwards in the debris field in Texas and it was readable.
NASA has released it. There is nothing dramatic on it. They are in their suits, in their seats, doing the things a crew does on the way down. Laurel Clark films the plasma building up outside the window and says it is really neat, and that it is a bright orange and yellow glow.
Somebody comments that you do not want to be outside now. The tape stops about four minutes before anything went wrong. Nobody on board is aware of anything at all. OFF-SCALE LOW
WHAT THE GROUND COULD SEE Re-entry begins at a fixed point called entry interface: four hundred thousand feet, the altitude at which the air starts to matter. Everything after it is counted in seconds from that moment. EI plus six hundred and thirteen means six hundred and thirteen seconds after entry interface. In Mission Control, the morning looked normal until fifty-four minutes and twenty-four seconds past eight, which is EI plus six hundred and thirteen.
At that moment the officer responsible for mechanical systems told the flight director that four hydraulic sensors in the left wing were reading off-scale low. Off-scale low means the sensor is reporting a value below the lowest number it is built to report. It is what a gauge says when its wire has been cut. The room discussed it.
Columbia crossed from Nevada into Utah at Mach twenty-one point eight, 223,400 feet. Twenty seconds later it crossed into Arizona. At EI plus seven hundred and forty-one it rolled from right to left over Arizona, which was a planned manoeuvre. It passed north of Albuquerque.
At EI plus eight hundred and fifty-one it crossed from New Mexico into Texas at 209,800 feet and Mach nineteen point five, and somewhere about there it shed a thermal protection tile. That tile was later found in a field at Littlefield, Texas, north-west of Lubbock. It is the westernmost piece of Columbia anyone recovered. At EI plus nine hundred and six, mechanical systems reported that pressure readings had been lost on both left main landing gear tires.
The flight director asked whether it was instrumentation. Got to be, he said. Mechanical systems answered that those were off-scale low as well. The capsule communicator called up: and Columbia, Houston, we see your tire pressure messages and we did not copy your last call.
At eight fifty-nine and thirty-two seconds - EI plus nine hundred and twenty-three - Columbia was approaching Dallas at 200,700 feet and Mach eighteen point one, and a broken reply from the commander came onto the air-to-ground loop. The transcript records it as: Roger, and then it is cut off in mid-word. That was the last communication from the crew and the last telemetry received in Mission Control. Forty-six seconds later, at nine hundred hours and eighteen seconds, videos made by people standing on the ground in Texas show the orbiter coming apart.
THE SENSORS IN THE WING That is what the ground had. What the wing had was different, and nobody would read it for another seven weeks. Columbia was carrying an instrumentation package no other orbiter still had, left over from its days as the test vehicle: a set of sensors inside the wing structure itself, wired to a recorder in the crew module. Strain gauges.
Temperature sensors on the spar, the clevis fittings, the panels. Not flight instruments. Engineering instruments, recording onto tape for later. Sensor one gave the first anomalous reading.
From EI plus two hundred and seventy to EI plus three hundred and sixty, the strain on the left wing was higher than it had been on previous Columbia flights. At EI plus four hundred and fifty the strain reversed direction. At EI plus four hundred and seventy-five it peaked in the negative direction. Then it dropped slightly, and stayed constant and negative, until EI plus four hundred and ninety-five, when the sensor pattern became unreliable.
That is a description of a structure being eaten from the inside by superheated air, written down in a language of microstrain and degrees, by instruments that were only there because Columbia was the oldest one. None of it was on the ground. It was not telemetered. It went onto a tape, in a box, inside the vehicle.
NOTHING ABOUT IT WAS BUILT TO SURVIVE
A FIELD NEAR HEMPHILL The box is called the Modular Auxiliary Data System recorder, and it is worth being exact about what it is, because the word people reach for is black box, and it was not one. A black box on an airliner is built to survive: armoured, fireproofed, tested to impact standards and fitted with a locator beacon. This recorder was none of those things. It was a tape machine for engineering data.
Nothing about it was designed to withstand a crash, because nothing anybody imagined would leave it in a position to need to. It came down from an orbiter that broke up at about two hundred thousand feet at eighteen times the speed of sound, and it landed in the pine woods of east Texas. It was found on the nineteenth of March, 2003, near Hemphill. The report's caption on the photograph of it reads: while not designed to withstand impact damage, the recorder was in near-perfect condition when recovered.
The tape inside was readable. The wing had kept its own record of being destroyed, and somebody picked it up off the ground seven weeks later.
TWO THOUSAND SQUARE MILES Getting to that point took the largest ground search in American history. Columbia came apart across east Texas and Louisiana. The debris field spread over two thousand square miles. Eventually more than seven hundred thousand acres were searched, mostly on foot, in lines, by crews walking through forest and pasture and swamp.
At the peak, recovery rates exceeded one thousand pieces of debris per day. Searchers found over eighty-four thousand pieces, weighing eighty-four thousand nine hundred pounds. The report puts that at thirty-eight per cent of the orbiter's dry weight - the vehicle with nothing in it. The other sixty-two per cent was never recovered.
Everything recovered was catalogued, barcoded, and taken to a hangar at Kennedy Space Center, where a grid was marked out on the floor in the plan shape of an orbiter and each piece was laid down in the position it had occupied on the vehicle. That is what made the analysis possible: once the left wing panels were laid out in order, the pattern of what had been eroded, and from which direction, was visible on a concrete floor. Two people died doing it. On the twenty-seventh of March a Bell 407 helicopter working the search crashed in the Angelina National Forest.
Jules Mier, the debris search pilot, and Charles Krenek, a debris search aviation specialist, were killed. The Board's report has a dedication page at the front, before anything else. There are nine names on it. The seven from Columbia, and then Jules Mier and Charles Krenek.
SIXTEEN INCHES BY SEVENTEEN
THE TEST By the spring of 2003 the Board had a theory, and it had a problem with it, which is that the theory was one a great many people at NASA did not believe. Foam is light. The bipod ramp piece weighed about one and two-thirds pounds. The wing is a spacecraft.
The institutional instinct, built up over more than a hundred flights of foam coming off and nothing happening, was that foam does not do this. So the Board did not argue. It contracted the Southwest Research Institute in San Antonio to shoot foam at a wing and find out. The gun was a nitrogen gas gun that had been used for evaluating bird strikes on aircraft fuselages.
They fitted it with a thirty-five foot rectangular barrel. The target was a test structure that could hold real leading edge panels in the positions of panels five through ten, carrying some two hundred sensors: strain gauges, deflection gauges, accelerometers, load cells, and high-speed cameras photographing at two thousand to seven thousand frames per second, lit by theatre spotlights and the sun. The projectile was made from the same foam by the same process, cut to nineteen inches by eleven and a half by five and a half, and trimmed until it weighed one point six seven pounds, which is what the image analysis said the real piece had weighed. They fired at panel six first.
Panel six cracked five and a half inches, and the T-seal beside it cracked through. That established the thing that mattered: a foam impact like the one on Columbia could damage a leading edge panel. Then they mounted panel eight. It was a real flight panel, taken off the shuttle Atlantis, which had flown twenty-six missions.
Forensic evidence and sensor data both pointed at panel eight as the place Columbia had been hit. On the seventh of July, 2003, they fired the foam at it at seven hundred and seventy-seven feet per second. The impact created a hole roughly sixteen inches by seventeen inches. Remember the number from earlier.
The analysis said the orbiter could survive re-entry with a quarter-inch hole in that region of the wing. The test made a hole you could put a chair through.
SECTION SIX POINT FOUR Which brings us to the question everybody actually asks. The Board asked it too, and it did not treat it as unanswerable. Section six point four of the report is titled Possibility of Rescue or Repair, and it works both options out. The repair option was a patch.
Astronauts would go outside, get to the underside of the left wing, and fill the hole with something: metal cut out of the crew compartment, water bags that would freeze into ice, whatever could be improvised. The report includes a drawing of two astronauts hanging over the edge of the open payload bay doors, reaching down towards the wing using a ladder scavenged from inside the vehicle. The Board's judgement on it is plain. Because the NASA team could not verify that the repairs would survive even a modified re-entry, the rescue option had a considerably higher chance of bringing Columbia's crew back alive.
So: the rescue. The rescue meant launching Atlantis. On Columbia's flight day four, Atlantis was sitting in the Orbiter Processing Facility at Kennedy Space Center with its main engines already installed, forty- one days from its scheduled launch on the first of March. Its solid rocket boosters were already stacked on their external tank in the Vehicle Assembly Building.
The Board worked the schedule. By working three around-the-clock shifts, seven days a week, with no necessary testing skipped, Atlantis could have been ready for launch by the tenth of February. Columbia's consumables - the oxygen, the lithium hydroxide that scrubs carbon dioxide out of the air - gave a window from the tenth to the fifteenth of February in which the two vehicles could meet. The Board checked the weather records for those days.
Launch was possible on all of them. Atlantis would have flown with a crew of four: a commander, a pilot, and two astronauts trained for spacewalks. In January there were seven qualified commanders, seven pilots, and nine spacewalk- trained astronauts available. The Board's conclusion is two words long.
Challenging, but feasible. And now the condition, which has to travel with that sentence every single time it is repeated, because without it the sentence is a lie. All of this depended on knowing. The Board says so directly: had the damage been discovered early enough, these repair and rescue plans would most likely have been developed, and a rescue would have been conceivable.
Nobody at NASA had a rescue mission ready and turned it down. What happened is that the question of whether there was anything to rescue from was closed before it was answered - three times.
WHAT THE SUIT WAS FOR There is a second report, published five years later, and this chapter comes from it and from nothing else. The Columbia Crew Survival Investigation Report is a hundred-and-some findings long and it opens by saying the thing plainly. The Columbia accident was not survivable. The team framed its work by identifying every event during the accident that had lethal potential, including events that occurred after the crew were already dead, because the point of the exercise was not to assign a moment.
It was to find each separate thing that a future spacecraft could be designed against. They identified five such events. The first was depressurisation of the crew module, which began at or shortly after the orbiter broke up. Most of what the team found about that first event has to do with the suit.
The crew were wearing the advanced crew escape suit - the orange one. And the report says something about that suit that belongs in this film in particular: the launch and entry suit was added in response to the Challenger accident, rather than as a part of the original vehicle design. The suit exists because of 1986. It was added to a vehicle that had not been built around it, seventeen years before this flight, and the report's findings are largely about the places where that shows: gloves off, visors up, helmets that do not restrain a head, integration problems between a suit and an orbiter that were never fully resolved because the suit arrived second.
The report is careful about what it does not know, and this film will be too. Its own summary of that first event says it was not survivable by any currently existing capability.
THE ORGANIZATIONAL CAUSES The Board did something in its report that accident investigations do not usually do. Having named the physical cause, it named a second cause, and gave it the same weight. The organizational causes of this accident are rooted in the Space Shuttle Program's history and culture, including the original compromises that were required to gain approval for the shuttle programme, subsequent years of resource constraints, fluctuating priorities, schedule pressures, mischaracterisations of the shuttle as operational rather than developmental, and lack of an agreed national vision. Then it lists what it calls cultural traits and organisational practices detrimental to safety.
Four of them. Reliance on past success as a substitute for sound engineering practice - testing to understand why systems were not performing the way the specification said they should. Organisational barriers which prevented effective communication of critical safety information and stifled professional differences of opinion. Lack of integrated management across programme elements.
And the evolution of an informal chain of command and decision-making process that operated outside the organisation's own rules. Read that last one again, and then read Rodney Rocha's explanation of why he printed his email instead of sending it. He did not want to jump the chain of command.
The foam came off the tank at eighty-one point seven seconds and hit the wing at eighty-one point nine, and cameras on the ground recorded it happening. The report describing it was circulated the next morning, with fifteen days of the mission left. Three people asked, separately, for somebody to point a camera at the wing. One request was explored.
One was made to the Department of Defense and cancelled ninety minutes later. One was refused, and the engineer who made it wrote down what he thought about that, and did not send it. A recorder that nothing was designed to survive came down in the pine woods and was found in near-perfect condition, with the whole sequence written on the tape inside it. Eighty-four thousand pieces were carried out of east Texas on foot, and two people died doing it.
A gun in San Antonio put a hole sixteen inches by seventeen in a wing that was rated for a quarter-inch one. And the rescue that was never attempted had a launch date on it: the tenth of February, with a window to the fifteenth. Challenging, but feasible - had anyone known there was something to be rescued from. NONE OF IT WAS WORKED OUT AFTERWARDS
Wonder Minute