The Loss of Orbiter Columbia on Re-Entry

(01 Feb 03)

Columbia on Mission STS107 sustained a debris strike on its left wing at some point short of max Q (max dynamic pressure) on launch (it looked to be around 35,000 to 45,000ft up and the event was caught clearly on the launch pad cine). At that point the Shuttle would have still been accelerating at a rapid rate.

The Columbia crew, from left, front row, Rick Husband, Kalpana Chawla, William McCool, back row, David Brown, Laurel Clark, Michael Anderson and Ilan Ramon.

 

The piece of debris was either assumed (or known) to be ice-hardened external tank foam-covering and is visually identifiable on the imagery (so it must have been quite large – and it would have been dropping through 50ft with the additional impact of the Shuttle’s launch acceleration). I’m not so sure that, even without being ice-hardened, that it would be all that light-weight or whether it has a more substantial substrate and adhesive base. The material is (I think) supposed to be an insulation therefore it would be fairly dense and quite solid once ice-coated. So it was probably capable of giving the area of the Shuttle that it hit a quite decent clout (left under-wing leading edge about halfway out it appeared).  I cannot recall any earlier instances of such a large piece coming adrift, although early shuttle launches routinely lost tiles (but apparently only during re-entry). Unlike the external solid rocket boosters, the external tank is not recovered and refurbished by the United States Alliance (a conglomerate of contractors Boeing and Lockheed-Martin). On CNN it was being said that the Ground Control Mission Specialists had analyzed the available imagery and decided that the debris hit was not going to be significant. They may have misjudged that....or maybe that was just what was being released to the Press.

 

 NASA has already conceded that the wheel-well is a vulnerable area because it contains a lot of wiring (which they’ve already conceded had failed – as indicated by the sensor outages). It may well come down to an arcing/shorting event as wiring insulation was impacted by the rapid heat-rise. The sighting over California’s Owens Valley is being construed as the ongoing loss of tiles starting at atmosphere re-entry (i.e. once you’ve lost even one tile, particularly forward on the wing underside, the rest can start peeling like a zipper - is the comparison analogy being used). Understandable,iven that they are presented to that searing airflow at a 30 to 40 degree angle of attack.

 

So as the tile-loss continued and the temperatures rose, it was probably an attritive process. The underlying aluminium distorts locally under the heat and pressure and as it warps, so you lose the tiles’ bonding integrity. I feel confident that the additional 30 secs of data after comms loss will assist the investigators in determining the progress of the fire in the left wing. Supposedly there were some in-fuselage heat sensors that recorded a heat rise ultimately. Not sure where the fuel cells are located but their undumped residues may have ultimately come into the equation. Before loss of telemetry, NASA had data that indicated a greater anti-roll FCS input “than had ever before been recorded on re-entry”. Something besides tile-loss was apparently creating a great dissymmetry of lift (but then again at that sort of Mach Number you only need a sharp discontinuity on a wing for to create a critical shock-related drag-rise).

 

The external tank being used was one of the last two remaining older designs from  Martin Marietta (delivered in Nov 2000). Its foam cladding may have deteriorated in storage. The newer tanks weigh over 7000lbs less and have a different cladding and adhesive. However I believe that the different glues stem more from the strictures of the Kyoto Accords moreso than from any improvement in adhesive qualities (or so they were saying on Fox News Channel).

 

 

The Shuttle starts re-entry at an altitude of about 400,000ft and as the atmosphere thickens, maximum dynamic pressure occurs somewhere around 200,000ft at Mach 18– eighteen times the speed of sound or about 12,500mph. The breakup supposedly having occurred at 207,000ft, I would guess that it had to be related to that max q PEAK and one (or both) of two things. i.e. a weakening of the structure caused by that debris hit or a difficulty with roll-attitude control that quickly led to a loss of precise attitude control (which, at that high dynamic pressure, would mean an automatic catastrophic breakup).

 

 

As the atmosphere thickens during re-entry, there’s a later transition from attitude control thrusters (Reaction Control System or RCS) to conventional aerodynamic control using elevons (see further on) It may even be that both control systems are available together over some transitional period. But at the stage that Columbia broke up, the computer was in control.

 

 

Because the angle of attack (of about 30+degrees) for re-entry is so critical, the flight control computers and autopilot are needed to make the very sensitive fine adjustments so that the shuttle remains pointed precisely in the direction that it’s going and critically, so that the thermal tiles on the undersurfaces take all the frictional heat-blast. I would guess that this particular thermal emergency is not practiced in the simulator - as there would be no practical solution available.  More importantly, do they practice for computer and system failure scenarios only? There’s something unhealthy about conceding the inevitability of casualties in a very mature program. It indicates a perfidy of the spirit of pioneering (or just a downright mean-spiritedness that has no place in a modern culture this long after the expediencies of the Cold War).

 

 

Speculation exists that because temperature readings rose in the left-hand wheel well above what was normal, a landing-gear door may have come off.

 

Mr Dittemore would not be drawn into discussing this scenario, however.

 

"We certainly know that the wheel well is one of our sensitive areas thermally," he said. "I know what you're thinking and I'm thinking the same thing, but I can't go beyond what I have said because I don't want to jump to conclusions."

Certainly a possibility but all depends on the type of mechanism that latches and releases the door itself. I'd imagine that the gear release is a positive release type latch that's hyd-powered and that there's also a backup gear-uplock type door release (i.e. "the gear-leg, once released from uplocks, lever-arms the door open and failing that, will drop on the door anyway and smash it open")  They’d need a triply-redundant system to cover the possibility of the wheel-well door jamming on short finals). Because the tyre’s deflation was probably due to it burning, it is possible that the door’s release mechanism may have been triggered. However at any high angle-of-attack you’d need hyd pressure or a spring-loaded opening mechanism to overcome the airloads. But having said that, it would only require the door to present the merest lip to the airflow - and it’d be torn off.

 

At any high angle-of-attack there'd be no holding it if that door opened. I imagine it's somewhere in Central Texas west of Nacogdoches/Palestine.

Obviously a significant hit that dented (or pierced) the left wing could affect either/both Lift or supersonic Drag and could create an aerodynamic asymmetry. That situation might have given rise to the impossibility of maintaining their critical re-entry pitch attitude.

 

 

(i)                 Could the pilots have become alarmed to the extent that they might have assumed a computer failure and reverted to manual control (at which point the control difficulty would have transferred from the computer straight into their hands). That transition would be so unexpected a large dissymmetry (and lateral control issue) that they may have lost that critical angle-of-attack attitude. So that is probably just part of the reason why manual control is just not an option. The superfast reactions of computer control of the RCS are required.

 

(ii)               The Shuttle may have rapidly developed a re-entry roll/yaw couple because of the left wing damage (lift deficiency and drag increase). This may have been beyond the ability of the computer-controlled RCS to cope or, even if it was coping, the pilots (even though alarmed) had no option to “go manual” (despite perhaps assuming a computer/autopilot malfunction). The RCS system is in charge of the attitude until the airflow over the control surfaces are sufficient (see below). Why would the dissymmetry be so significant if the damage wasn’t that great? A tile may have been dislodged or the skin pierced or just a large drag increment caused. At 12,500 mph and mach 18, you only need a very small disparity in lift and/or drag for to generate a shockwave induced critical drag-rise - leading to a very large residual rolling moment.

 

 (iii)              Information released by NASA indicates that there was a roughly seven minute period during which a number of left wing sensors (including left main-gear tyre pressure and hydraulics) were of concern. It's not known whether tyre-burning deflation or a thermal interdiction of the sensor cabling was responsible (or a combination). However obviously the wheel-well doors and the underlying compartment is a weak-point and the tyres and hydraulic hoses within are very vulnerable to heat-stress.

Solutions

 

If the scenario is correct, perhaps:

 

1.        NASA should always decree a space-walk to examine, photograph and transmit any damaged section's imagery back to Mission Control for more precise evaluation. The expectation that things would always just "be OKAY" (post-launch) for re-entry seems to point to a significant gap in Mission Safety risk-management. And based on 100 odd flights only, dismissing the debris "hit" on launch as being inconsequential would also seem to be a little "fingers-crossed" cavalier. A 1997 Memo by a NASA Engineer forecast the very problem that Columbia had.

 

2.        In future, astronauts may be able to make boron-fiber putty-patch repairs during a space-walk (with an incorporated ablative outer skin - in order to one-time restore structural and aerodynamic integrity for re-entry).

 

3.        Perhaps a space-walk (EVA) walk-around should be a planned part of each mission before re-entry (to check for any launch damage necessitating ad hoc interim repair). Alternatively a  remote control camera might be suspended from the Shuttle’s robot arm (when carried) for an external inspection. Perhaps a "flying" camera. It need be no more than an attitude control system and fuel tank with a radio and camera attached. It could also take great publicity photos.

 

4.         Perhaps the Orbiter's heat-shield tile layer should be covered with an outer sacrificial spray-on cladding which may well burn away on re-entry BUT, prior to that, protect the tiles from any earlier debris hits.

 

 

Summary

No criticism intended here at all of the pilots.

 

The pilots were probably suddenly confronted with a situation/failure scenario that was not system-failure initiated (but, like all onboard fires, became system-related). It had probably NOT been included in their simulator syllabus (but perhaps should have been). In fact it was Pilot McCool’s first Shuttle Flight (and the Commander’s second). They were obviously trying for the best outcome. But in such a highly sensitive flight-control regime, they had no option but to let the computer work it out. However it is probable that the process of heat degradation of the left wing and its systems was ongoing and that, per any uncontrolled "thermal event" (i.e. fire) the Orbiter's structural integrity losses would have rapidly caused a loss of flight-control.

 

Once the Orbiter had suffered significant uncommanded roll and the autopilot had reached its control authority limit, it would have rolled but would have also deviated significantly from its critical angle of attack. At the high dynamic airspeeds, structural failure stemming from loss of attitude control or further loss of structural integrity would very rapidly lead to a catastrophic breakup in a matter of milliseconds. That is evident from the imagery of the contrail taken over Central to Texas. The seven astronauts would have perished instantly. From eventual control problem onset to breakup may have been as little as 5 seconds (even though the breakup had started much earlier over California). NASA will possibly get the answer from the earlier telemetry - as no onboard recorder could have survived intact. The many ground-shot videos will obviously assist greatly.

The main gear wheel wells would seem to be particularly vulnerable to heat build-up once their protective insulation is lost. There are rubber tyres, flammable fluids and flexible hydraulic hoses in there. Could the gear-door uplocks could function prematurely and allow a door or one main-gear to drop?

These points may prove to be amongst the lessons learnt - but they may also point to insufficient imagination being applied in NASA's Risk Management assessment scenarios. Heat-rise and attitude control loss is the main enemy. They must think in terms of contingency plans that will insulate crews against known risks and enable recovery from feasible external damage scenarios – and not just system failures. Simulator training beyond system loss scenarios is obviously called for.

 The 1997 NASA Engineer's Tile Safety Warning
 Shuttle Contractors under Scrutiny
A timeline of the final minutes of the shuttle flights and the hours following it (all times EST):

Additional data in italics from NASA press conference.

8:15 a.m.
Space shuttle Columbia fires its braking rockets and streaks toward touchdown.

8:53 a.m. (Over California)
Ground controllers lose data from four temperature indicators on the inboard and outboard hydraulic systems on the left side of the spacecraft. The shuttle is functioning normally otherwise, so the crew is not alerted.

08:53
20 to 30 degree rise in temperature in left wheel well over 5 minutes.

08:54 (Eastern California & Western Nevada)
Mid-fuselage bond line (bond between fuselage and top of wing on the port side) has a 60+ degree temperature rise over 5 minutes. Starboard side is nominal at 15+. Inside of fuselage wall the temperature is nominal.

8:56 a.m.
Sensors detect rise in temperature and pressure in tires on the shuttle's left-side landing gear.

8:58 a.m.
Data is lost from three temperature sensors embedded in the shuttle's left wing.

08:58 (New Mexico)
The FCS starts to add roll trim to the right. Implication is to counter increased drag on the port side.

8:59 a.m.
Data is lost from tire temperature and pressure sensors on the shuttle's left side. One of the sensors alerts the crew, which is acknowledging the alert when communication is lost.

08:59 (West Texas)
Wheel well temperatures lost. Roll trim continues to increase as the FCS continues to try to roll the shuttle to the right. Implication is that drag is continuing to increase on the port.

08:59 (East Texas)
Signal lost.

NASA have interviewed the astronomer in Owen's Valley (California) who reported debris coming from the shuttle. They have his statement and believe it is an important contribution.

Landing:
KSC February 1, 9:16 a.m. 2003 (Planned)

Deorbit burn occurred at 8:15 a.m. EST (1315 GMT) for a planned landing on KSC Runway 33. Shortly after Roll Reversal #1 (8:53 a.m. EST) at MET 15 days 22 hours 17 min 50 seconds while Columbia was traveling at Mach 20.9 and 224,390ft, flight directors saw a loss of sensor data (offscale low) from the hydraulic systems on the left wing. Initial indications were loss of sensor data near the left inboard part of the wing, followed by sensors on the left outboard area of the wing. At 8:59 a.m. there was a loss of sensor data (Tire pressure offscale low) which caused an onboard alert that was acknowledged by the crew. Communication with the crew and loss of data occurred shortly after while Columbia was at a Mission Elapsed Time (MET) of 15 days 22 hours 20 minutes 22 seconds. The vehicle broke up while traveling at 12,500 mph (Mach 18.3) at an altitude of 207,135ft over East Central Texas resulting in the loss of both vehicle and crew. (Reference: JSC Ron Dittemore Post flight Technical News Conference 2/1/2003 3:30pm EST).

  Shuttle Re-Entry Profile

 sci.space.shuttle newsgroup have put together the following FAQ link

Shuttle re-entries are normally under computer control until just before landing. There's an extensive sss thread on the subject here:

The following info on flight profile is taken from the FAQ above.

* Where and when did Columbia break up? (Altitude, speed, time, etc.)

Ground controllers lost communications with Columbia at 7:59:22am CST, at a mission elapsed time of 15 days, 22:20:22. At the time, the shuttle was at an altitude of 207,000 feet (63,000 m), traveling at Mach 18.3, approximately 37 miles (60 km) above the Dallas-Fort Worth Metroplex region of Texas.

* What was Columbia's status prior to breakup?

First, let's look at Columbia's reentry profile. The Shuttle has 3 distinct phases to the standard reentry profile:

1) Thermal Control Phase. This lasts from Entry Interface, when the first aerodynamic effects occur, until a speed of approximately 19,000 ft/sec (12,900 MPH, 11,200 kts, 20,900 km/hr) has been reached.

2) Equilibrium Glide Phase. This is flight at a constant attitude as the deceleration due to drag builds up to approximately 1G.

3) Constant Drag Phase. The 1G deceleration is held until the orbiter enters the Terminal Area Energy Management interface, after which it is flying as a conventional, but very heavy and fast, glider. This is usually 52 NM (59 SM, 94 km) from the landing site, at an altitude of 83,000', and a speed of Mach 2.5 (2500 ft/sec, 760 m/sec).  The orbiter slows to below Mach 1 at about 49,000', 22 NM (25 SM, 40 km) from the runway. Columbia was either at the end of the first phase, or the beginning of the second phase when she broke up. The first phase begins when the orbiter is oriented tail-first, and the OMS engines fire to reduce its speed by about 300 ft/second (90 m/sec). The reaction control system then orients the orbiter nose first to prepare for reentry. At roughly 400,000 ft altitude (122 km), Entry Interface is considered to occur. This normally takes place 4,400 NM (5063 statute miles/3160 km) from the landing site. The speed at this point is about 25,000 ft/second (7600 m/sec). At this point the orbiter is maneuvered to 0 degrees roll and yaw, and a 40 degree angle of attack. The flight control system at this point uses the Reaction Control System to keep things aligned. The forward RCS engines are turned off at the entry interface, and the aft RCS system is used to maneuver the spacecraft. The spacecraft must dissipate the tremendous amount of kinetic energy it has. It does this by varying the amount of aerodynamic drag that it presents on the way down. This generates a lot of heat because of the speed of the shuttle. This heating is controlled by changing the speed of the shuttle in small amounts. This is done by varying the aerodynamic drag of the shuttle. Most aircraft do this by changing the Angle of Attack. When you pull up the nose, an airplane tends to slow down, unless an engine is used to counteract the drag. For a re-entering shuttle, the angle of attack must be held constant to prevent the structure from overheating. The shuttle controls drag by rolling into a series of 'S' turns along the flight path. Increasing the roll angle of the orbiter moves the direction of its lift (perpendicular to its wings) away from the vertical, causing it to descend faster. These S-turns are used to fine tune the energy level (A fancy way of saying altitude and airspeed) of the orbiter, something like skiers turning while going downhill to control their speed. When a dynamic pressure of 10 psf is reached (EAS of 62 MPH (100 km/hr)), when the orbiter's ailerons become effective for roll control. At that point, the roll RCS engines are deactivated. At a dynamic pressure of 20 psf (EAS of 85 MPH(138 km/hr), roughly), the elevators on the orbiter become active, and the RCS pitch engines are deactivated. In the Equilibrium Glide Phase of the reentry, the spacecraft is flown to maintain a constant drag level, where the flight path angle remains constant. This is maintained until the deceleration of the orbiter due to drag is about 1G. In the last phase of the reentry, the 1G deceleration level is held, reducing the angle of attack as necessary, until the Terminal Area Energy Management interface. The RCS system continues to control Yaw until the rudder become effective at around Mach 3.5.

So Columbia was lost either at the tail end of the Thermal Control Phase, or the early stages of the Equilibrium Glide Phase. The ailerons and elevators were providing control, (the Q at that point was around 75-80 psf, or an EAS of about 170 mph (275 km/hr)), and yaw was being controlled by the RCS thrusters in the tail. Late reports before this writing this indicate that the Flight Control System reported that it was correcting a left yaw/roll just before breakup.

to Latest Additions