cmh-issc-lessons (1049403), страница 3
Текст из файла (страница 3)
This seemsespecially true when one realizes that the bridgewith the next biggest span to width ratio, theGolden Gate Bridge, was at that time showing fargreater flexibility than had been calculated.Theodore Condron seems to have been one ofthe few engineers of the time who had learnedthis lesson. His advice to widen the bridge to 52feet was a prudent, incremental step.Lesson 3: In studying existing experience, morethan just the recent past should be included.The University of Washington’s ProfessorFarquharson continued to study suspensionbridges after escaping from Galloping Gertie. In a1949 report, he gave a historical review of thedynamic behavior of suspension bridges (ref.17). In this review, he listed ten suspensionbridges that were destroyed by wind between1818 and 1889; nine of these occurred before1865.
He wrote that the failure of the TacomaNarrows Bridge “came as such a shock to theengineering profession that it is surprising tomost to learn that failure under the action of thewind was not without precedent” (ref. 18).Had Moisseiff and other engineers of his timebeen aware of this history, and if they hadstudied the works and writings of such engineersas John Roebling (the designer of the BrooklynBridge), they might have been less inclined todismiss the dynamic effects of wind in the waythat they did.relevant lessons. Unless otherwise indicated,the factual information in this section is based onreferences 19 and 20.Background:Challenger was one of fourvehicles that made up the National Aeronauticsand Space Administration's (NASA's) spaceshuttle fleet; the other three were namedColumbia, Discovery, and Atlantis.
Before theaccident, these four vehicles had flown to spacea total of twenty-four times, with Challengerflying the most (nine times) and Atlantis the least(two times).The basic configuration of all four vehicles wasthe same. As shown in figure 1, three maincomponents make up the shuttle system: theOrbiter, which houses the crew and payload, andincludes the three main engines and the orbitalmaneuvering system; the External Tank, whichholds fuel for the main engines; and two SolidRocket Boosters (SRBs), which provide about80% of the thrust for launch.
The Solid RocketBoosters are jettisoned about 2 minutes afterliftoff; they are recovered and reused. TheseBoosters are composed of several sectionsjoined together; one of these joints is labeled inthe figure. The External Tank is jettisoned about8.5 minutes after liftoff; it is not reused.Lesson 4: When safety is concerned, misgivingson the part of competent engineers should begiven strong consideration, even if the engineerscan not fully substantiate these misgivings.No one can deny that Theodore Condron’smisgivings about the Tacoma Narrows Bridgeturned out to be correct, despite his ownadmission that he could not prove that thedesign was faulty.
As the Challenger accidentdiscussion will show, this was not an isolatedcase.Challenger AccidentThe discussion of this accident will be brieferthan that of the Tacoma Narrows Bridge collapse.In particular, details of the causes of the accidentwill be discussed only in the context of theFigure 1 - Space Shuttle ConfigurationThe Accident: On 28 January 1986, Challengerwas scheduled to make its tenth flight into space.The mission had several objectives. Theseincluded deploying a Tracking and Data RelaySatellite to support communication with theshuttle and other spacecraft, and deploying theSpartan-Halley satellite, which was designed tostudy Halley’s comet.
The part of the missionthat made it the subject of more publicity thanmost previous shuttle missions was that itcarried the first “Teacher-in-Space.”NewHamp shire schoolteacher Christa McAuliffe waspart of the crew.She was scheduled tobroadcast a series of lessons to school childrenacross the country during the planned seven dayflight.The launch had originally been scheduled forJanuary 22. Various delays caused successivepostponements, until finally Challenger lifted offat 11:38 a.m. on January 28.To spectatorswatching the launch in person or on TV,everything appeared to be normal.Theappearance of a normal flight continued untilabout 73 seconds after liftoff, when a fireballappeared and the single column of flame andwhite smoke split into a Y shape, and the orbiteritself seemed to disappear.
For nearly an hourafterwards, debris fell into the Atlantic Oceanabout 20 miles from the launch site. All sevencrew members (commander Francis Scobee; pilotMichael Smith; mission specialists EllisonOnizuka, Ronald McNair, and Judith Resnick;and payload specialists Gregory Jarvis andChrista McAuliffe) died in the accident.Investigation: A few days after the disaster,President Ronald Reagan established aPresidential Commission to investigate theaccident, and charged it with delivering a reportto him within 180 days. Former Secretary of StateWilliam B. Rogers was appointed as chair of theCommission.The Commission released their report in June1986. The Commission “concluded that thecause of the Challenger accident was the failureof the pressure seal in the aft field joint of theright Solid Rocket Motor.
The failure was dueto a faulty design unacceptably sensitive to anumber of factors. These factors were the effectsof temperature, physical dimensions, thecharacter of materials, the effects of reusability,processing, and the reaction of the joint todynamic loading.” The Commission alsoconcluded, “the decision to launch theChallenger was flawed” (ref. 19, italics inoriginal).Reinforced Lessons: Three of the four lessonsmentioned previously are reinforced by theChallenger accident.
One is reinforced by thehistory of the design of the joint that failed; theother two are reinforced by the events leading upto the decision to launch.Recall that the second lesson from the TacomaNarrows Bridge was this: going well beyondexisting experience is unwise. At a quick glance,it appears that the designers of the SRB fieldjoints heeded this lesson.In 1973, NASA Administrator James Fletcherannounced that Thiokol Inc. (later to becomeMorton-Thiokol Inc.) had been selected todesign and build the solid fuel rocket motor forthe shuttle. In an effort to ensure reliability,while at the same time reducing costs, Thiokolbased the design of their segmented booster onthat of the Air Force’s Titan III rocket.
Thisrocket, which was built by United Technologies,was generally considered as one of the mostreliable rockets ever built.Like the Titan III, Thiokol’s design for the fieldjoints had a tang on the rim of one segmentslipping into a clevis on the rim of anothersegment, with the two segments fastenedtogether by pins. While the Titan III had a singleO-ring in each joint to seal the joint against thehigh pressure from the propellant burning insidethe booster, Thiokol used two O-rings in the SRBjoints (ref.
21). So, Thiokol appeared to becautiously building on existing experience.Figure 2 shows an outline of the Titan III andSRB joints next to one another.Figure 2 - Joint ComparisonAlthough this figure does not show all thedifferences between the joints, it does show animportant one: in the Titan III joint, the clevispoints downward, but in the SRB joint it pointsupward.Other differences included thefollowing: to accommodate the second O-ring,the SRB tang was longer than the Titan’s,making it more susceptible to bending undercombustion pressure; on the Titan the insulationof the segments fit tightly together, while on theSRB they did not and putty filled the gaps; asingle Titan rocket was used only once, but theSRB segments were intended to be reused; andthe combustion pressure within the booster wassignificantly less for the Titan than for theshuttle (ref.
21).When the details of the joints are compared, itbecomes clear that the design was actually justas much a departure from existing experience asthe Tacoma Narrows Bridge had been. Theresulting failure of the joint reinforces lesson 2.Lesson 3 (in studying existing experience, morethan just the recent past should be included) isalso reinforced by the Challenger disaster. Inretrospect, it is not difficult to see parallelsbetween some attitudes within the shuttleprogram before Challenger and some attitudeswithin the Apollo program before the Apollo 1fire.The attitude of great confidence inaccomplishments and the concern about meetingthe planned schedules are especially apparent.Finally, the Challenger accident also stronglyreinforces the fourth lesson: when safety isconcerned, misgivings on the part of competentengineers should be given strong consideration,even if the engineers can not fully substantiatethese misgivings.Probably everyone whoknows anything about the accident knows thaton the night before the launch several engineersat Morton-Thiokol argued against launching thenext day.
In a teleconference with the NASAofficials responsible for the SRBs, Thiokolinitially recommended against launching until thetemperature was above that of the previouscoldest launch. After conversations with NASArepresentatives, and a private caucus among theThiokol managers and engineers, Thiokolchanged their position and recommended launch.Although other factors may have played a role,one important reason Thiokol managers endedup recommending launch is that their engineerswere not able to prove by the available data andtheories that the launch would be unsafe.
Theexisting data showed that the worst case to dateof damage to an O-ring had occurred at thelowest temperature in which a launch hadoccurred. But the data also showed that the nextworst case occurred at a temperature that wasone of the highest of all the launches, and thattest firings at low temperatures had shown no O-ring damage. The accepted theory at the timealso predicted that an O-ring could sustaindamage three times worse than any previouslyexperienced and still seal a joint.Given an equal burden of proof on those whofavored launch and those who opposed launch,the decision to launch, although shown byevents to have been wrong, was notunreasonable (ref.
22). As lesson 4 implies, theburden of proof ought not to be equal.A New Lesson: There is at least one more lessonthat the Challenger disaster teaches. This lessonis essentially the mirror image of lesson one.Lesson 5: Relying heavily on data, without anadequate explanatory theory, is unwise.Many different aspects of the history of the SRBjoints could be used to illustrate this lesson, butonly one will be discussed here. The boosterjoints were originally designed with theexpectation that the propellant pressure atignition would cause the inner flanges of thetang and clevis to bend towards each other.This, in turn, would increase the compression onthe O-rings and further ensure that they sealedthe joint.In 1977 Thiokol conducted a hydroburst test toassess the strength of the steel case segments.In this test a segment of the booster was filledwith oil and put in a chamber.
![](https://s.studizba.com/z.php?f=/templates/si/i/noavatar.png&w=100&h=100&t=1"){kind=avatar}
