September 16, 2020
This review of leadership and management has been a challenge in discovery and a painful self-analysis for the writer just as it will be for many readers. My objective in writing this article has been to understand and to learn. I share these results with the hope of sparking new insight in others as it has done for me.
by Dan Harrison
On 28 January 1986, a high school teacher, Christa McAuliffe, one of seven crewmembers on the Space Shuttle Challenger, went down with the rest of her flight team on Space Transportation System Mission STS-51-L. The disaster would be attributed to the failure of rubber O-rings that provided a pressure seal in the aft field joint of the shuttle’s right solid rocket booster[1]. What had gone wrong?
Months earlier in November of 1985, the Peacekeeper flight test program[2] at Vandenberg Air Force Base (VAFB), California, was readying another flight test for the coming winter, a winter that was expected to be unseasonably cold. As the 6595th Missile Test Group Launch Operations Manager, I noted that the projected temperatures would likely drop to the low end of, or below, the temperature range for components designed to operate in an underground temperature-controlled silo. But our next test launch would be from an above ground test pad.
I spoke with my TRW advisor about the expected winter temperatures, and he encouraged me to proceed with direction to all supporting contractors to evaluate the risks to a successful mission if we launched in projected unseasonably cold temperatures. I gave this direction to our supporting contractors. Several of them had already responded before my immediate supervisor countermanded my direction.
The few early responses we’d already received had recommended against launch. But my supervisor, a non-technical business officer rotating through my unit for an opportunity to gain hands-on experience in an engineering unit, was adamant. “A few degrees in temperature will not have any effect.”
The reaction of my TRW advisor’s management was uncharacteristically livid. TRW immediately reissued my directive on their authority, with some additional specificity. By early January, the Peacekeeper flight test program announced that we would not launch the next mission at environmental temperatures below a specified level.
In deference to my supervisor, most anyone with a non-technical background thrust into an engineering management position could easily have concluded as he did that the unseasonably low temperatures expected this winter would still be well within the capability of this military system. He was relying on common knowledge that military specifications generally required certification to a much broader range of temperatures than commercial equipment, and the unseasonably cold temperatures expected at VAFB, California, that winter were not even “cold” by the standards across the country at latitudes a little above VAFB.
Unfortunately, he had not discussed this with me, or our TRW advisors, before countermanding my direction. “After all, even commercial hardware is often designed with a little extra margin for conditions exceeding what was expected in the environment in which it would be used,” he had said. He had missed, or ignored, the fact that this missile was designed to be launched from a temperature-controlled silo but would not be for this test.
On 28 January, a distraught Lieutenant appeared suddenly, running toward my desk almost out of breath. He said hesitantly that there had been a disaster and implored me to follow him to our Mission Control Room. The VAFB Western Test Range (WTR) had access to NASA’s net controlling their space launches, and we sometimes followed a mission live from the vantage point of their Mission Control Center. When I arrived, a small group had already keyed up a replay of the Space Shuttle Challenger’s launch. By then, putting two and two together, I suspected the result, but could not accept it.
That evening on the national news, my wife would not be able to detect the puff of smoke when the booster O-rings failed at lunch. But with my team in our control room earlier that day, having previously reviewed training videos of historic test launches including (unmanned) launch failures, we had immediately identified an anomalous puff of smoke at launch, and we knew unequivocally what it meant. Although we knew the result, in disbelief, we started counting the seconds toward a ghost nominal booster burnout.
For me this hit especially hard. Over the Christmas holidays an executive of the Carroon and Black insurance brokerage had spoken with me about the upcoming space shuttle mission. He had made a decision to provide a fully paid $1,000,000 life insurance policy for Sharon Christa McAuliffe, a high school teacher from Concord High School, New Hampshire, who was selected from more than 11,000 applicants to participate in the NASA Teacher in Space Project.
This executive knew the U.S. Air Force and NASA projections for the probability of failure of a shuttle mission. They differed, and he asked my opinion of which figure was more valid. This, and our team’s decision not to launch our Peacekeeper mission in the same timeframe in unseasonably cold temperatures, had made this disaster personal for me, and it would be just as personal to many others all over our country and throughout much of the world.
“There are few times in a person’s life when they can answer the question, ‘Where were you when…?’ The launch of Challenger flight STS-51-L was one such time.”[3]
After more than 30 years, the memories are still poignantly painful. The failure was not someone else’s. I felt that it was as much mine as anyone’s—even though I was not working on the Space Transportation System—because I felt that my engineering profession had failed. This could not be allowed to happen.
Haunted for years, I have not been able to write about this until now when I have gained enough experience to understand important differences between the roles of manager and leader as applied to System(s) of Systems as all space programs are viewed.
Launch in Conditions Outside of the Designed Capabilities
My supervisor’s conduct on the Peacekeeper program was not unusual for a non-technical manager making a management decision. He was not reacting to pressure, but was applying what he thought was “common knowledge” in a reasonable way. A technical manager—which he wasn’t—should not make this mistake. But at the higher levels of any large technical organization, leaders are often faced with this type of technical decision, and even for leaders with a technical background, these decisions invariably involve technical disciplines outside of their own.
Both technically trained and non-technical managers are promoted to higher levels because of their leadership potential. Leadership—versus management—skills come with many years of experience evaluating and relying upon the opinions and judgments of others, both inside and outside of the organization. But these opinions and judgments often are not consistent and are sometimes in direct opposition. How does a leader make the right decision?
The Space Transportation System incorporated a fusion of new technologies, each with its own set of potential risks that had to be dealt with in design. However, after this STS-51-L mission’s launch was scrubbed on 27 January and rescheduled for the following day, a new concern was raised about the weather forecast for high winds aloft coupled with a huge drop in temperature due to a cold front moving in. This forecast for a precipitous drop in temperature raised a new concern that would be discussed as a potential safety of flight risk of catastrophic failure for this mission.
After a shuttle mission a year earlier, the solid rocket boosters, recovered for refurbishment and reuse, were found to have heavy thick black soot trapped on the primary O-ring that had lost its seal. The secondary O-ring was not damaged on this mission; however, it was later determined that the cause of the damage to the primary O-ring was due to the low temperature of the coldest shuttle launch as of that launch date that had been approximately 53°F. Following the next shuttle mission in April 1985, there were near failures identified on the nozzle O-rings of the boosters with the primary O-ring eroded completely through in three places.
After a meeting convened about 8 p.m. on the evening of 27 January 1986, at which presentations were made about this new concern due to the expected drop in temperature, the Vice President of Engineering for the booster design recommended not launching if the outside temperature was below 53°F. After further discussions, this recommendation was reversed over the objection of engineering. Refusing to sign off on this launch recommendation, the contractor’s Solid Booster Program manager pointed out that they were being asked to fly these boosters in conditions outside of the environmental conditions in which they were qualified to fly, a violation of protocol.
The push back had been severe. NASA was expecting to fly two missions per month, well below the 60 per year that the program had originally been planned to fly, and it was only January. “Are you asking us to wait until April to launch?” “The eve of launch is a hell of a time to be changing the launch criteria.” These objections will prove to have been bogus. The engineering problem for this shuttle launch was really the same as for the Peacekeeper program. How should a leader go about determining the best way for his team to proceed in this situation?
A key to this conundrum may be found in another statement made during this pushback, “The eve of launch is a hell of a time to be changing the launch criteria.” Launch criteria are set well in advance as a set of restrictions that are required to be met before proceeding with a launch. This set of restrictions begins with the specified requirements for the design. These requirements include the operating environmental conditions that the final design is expected to experience during missions.
In the design process, analysis and/or testing will have been performed to verify that the booster O-rings will perform as designed in the temperature range in which they are expected to operate. If the launch criteria extend outside of the temperature range for which the hardware has been designed and tested, then the launch criteria are in error and must be revised.
An error in the launch criteria is not a basis for proceeding with a launch in conditions outside of the design capabilities of the system.
Launch in Reliance on a Backup System Expecting Primary System Degradation
Evidence had been presented from prior missions that appeared to show vulnerability at lower temperatures within the system specifications. Compounding this vulnerability, high winds aloft were projected with the cold front moving in on 28 January. High winds aloft produce torsional stresses on the O-ring joint.
In addition, environmental icing conditions at the lowest projected temperature on 28 January near 18°F introduced another unknown for this launch[4].
“13. There is a possibility that there was water in the clevis of the STS 51-L joints since water was found in the STS-9 joints during a destack operation after exposure to less rainfall than STS 51-L. At time of launch, it was cold enough that water present in the joint would freeze. Tests show that ice in the joint can inhibit proper secondary seal performance.”
Clear evidence from two prior missions showed compromise of the primary O-rings at 53°F. The fact that a secondary O-ring is present to serve as a backup is not a basis for proceeding with the launch even at 53°F. Once the primary O-ring is destroyed, the secondary O-ring becomes primary for operation of the system at temperatures below which the primary has failed, and there will be no backup for other compounding conditions, such as torsional stresses due to high winds aloft and the potential for icing due to an environmental temperature below freezing.
It is incumbent upon the leadership in situations like this to draw this out so that the whole team can address these engineering concerns. If the leadership of these organizations wish to argue among themselves about who is to blame for a launch delay, or cost impacts, that is a different matter and should be taken up in a separate meeting.
Instead, leadership chose to challenge engineering. While this is a common technique at the executive level, it is the wrong technique to use when a safety of flight concern has been raised. Insisting that a high level manager or executive “prove his case” is a valid technique when, if the risk is limited to an acceptable risk of a schedule slip or cost overrun, this technique is used to develop professionalism in subordinates. However, when safety of flight or a catastrophic failure is at risk, an entirely different approach is called for.
This is where many years of experience separate a leader from a manager. A leader may sit in a meeting for 20 minutes or more saying nothing, and then make a quiet observation that changes the course of the meeting entirely. A leader has a breath of knowledge and experience with a focus on bigger issues that may be adversely impacted by decisions at a tactical level. The loss of life, or an enormously expensive piece of equipment such as the Space Shuttle, fits this to a tee. This is when a leader will use his skills to draw out a concern that may have a catastrophic impact.
Unlike our situation on the Peacekeeper flight test program, The Space Transportation System was under enormous pressure to launch. This pressure was a factor in the decision to proceed with the launch on 28 January 1986. But this pressure, beyond the engineering concerns, was not just limited to cost and schedule.
We are all human, including the executive who finds his or her own position at risk due, for example, to the potential loss of a major customer and their programs. To fully understand decision making at the executive level, it is incumbent upon us to understand these pressures, some of which for this flight-test failure, may not have not been readily comprehensible until decades later.
Over-specification Leads to Unrealistic Program Objectives
The Space Transportation System was originally envisioned to handle all military and commercial low earth orbit launch, and other mission, requirements. This major Systems of Systems program would be designed to handle all of the United States’ space needs for the near future. This would include transportation of astronauts to and from the International Space Station requiring in-space docking. The Solid Rocket Boosters, and possibly the large External Tank, would have to be reusable to reduce cost enough to make this launch capability financially viable for both military and commercial use.
At the time this program was envisioned, specifications were often designed to stretch the capabilities of bidders to see what they could do. The implications of this objective for the Space Transportation System (STS) would be adeptly summarized in the INCOSE Systems of Systems (SoS) Primer launched at the INCOSE International Symposium in July 2018[5].
| Systems tend to… | Systems of systems tend to… |
|---|---|
| Have a clear set of stakeholders | Have multiple levels of stakeholders with mixed and possibly competing interests |
| Have clear objectives and purpose | Have multiple, and possibly contradictory, objectives and purpose |
| Have clear operational priorities, with escalation to resolve priorities | Have multiple, and sometimes different, operational priorities with no clear escalation routes |
| Have a single lifecycle | Have multiple lifecycles with elements being implemented asynchronously |
| Have clear ownership with the ability to move resources between elements | Have multiple owners making independent resourcing decisions |
The STS was well ahead of its time as a stunning technological achievement. Multiple new technologies were advanced to develop a single system for both military and commercial use. However, the result was heavy over-specification for what proves today to be easily separable classes of missions such as (1) military versus commercial and (2) heavy versus lightweight payloads. This Systems of Systems approach suffered large cost overruns and schedule delays resulting in a much lower launch rate than the originally specified objective of 60 launches per year. The STS also suffered two catastrophic failures with the loss of Challenger in 1986 and Columbia in 2003.
The Future
The Obama administration’s subsequent decision to deemphasize space exploration and to reduce development of new launch systems by the U.S. Government has encouraged private industry to step up, and they are doing so. But note that private industry is free to develop its own set of requirements in pursuit of profitable enterprises. An Obama administration committee had concluded that launching a vehicle such as the SpaceX Falcon Heavy would take 12 years and cost $36 billion. SpaceX did this in half the time for less than $1 billion[6].
We are entering a new space race now with China for control of the high ground above our planet, for a return to the moon and on to Mars and beyond. Private industry will play key roles in these new adventures as a visible testament to our democracy.
Dan Harrison is an SMA Principal Associate in our Technical Management & Engineering Services Practice, and has over 35 years of experience in aerospace engineering.
If you’re building a team and you have positions you can’t fill, you need to use SMA Talent on Demand (TOD®)! With TOD®, you can find experienced talent, such as Dan, matched to your exact needs:
[1] The Roger’s Commission Report of the PRESIDENTIAL COMMISSION on the Space Shuttle Challenger Accident concluded at page 45/49: “In view of the findings, the Commission concluded that the cause of the Challenger accident was the failure of the pressure seal in the aft field joint of the right Solid Rocket Motor. The failure was due to a faulty design unacceptably sensitive to a number of factors. These factors were the effects of temperature, physical dimensions, the character of materials, the effects of reusability, processing, and the reaction of the joint to dynamic loading.” https://history.nasa.gov/rogersrep/v1ch4.htm
[2] This was the LGM-118 Peacekeeper (MX) Combined Developmental Test and Evaluation (DT&E)/Operational Test & Evaluation (OT&E) Flight Test Program. The last Peacekeeper was taken out of operational service on 19 September 2005.
[3] Payne, Jason. Challenger: A Rush To Launch (Documentary), YouTube, 28 January 2016. https://www.youtube.com/watch?v=2FehGJQlOf0. An Emmy Award winning documentary about flight STS-51-L and what led up to the Challenger explosion and the loss of seven astronauts.
[4] The Roger’s Commission Report, [70] Findings, p. 44/49, Ibid.
[5] The INCOSE SoS Primer is available for free download from the INCOSE Store at their website: https://www.incose.org/products-and-publications/sos-primer
[6] Stossel, John. “The Private Space Race”. Capitalism Magazine, 29 July 2020, https://www.capitalismmagazine.com/2020/07/the-private-space-race/