Why do I need to do a writing
assignment in math class? What
core-ethical values relate to
these memos and the events they
represent?
THE BABCOCK AND WILCOX COMPANY
POWER GENERATION GROUP
To: Jim Taylor, Manager, Licensing
From: Bert M. Dunn, Manager ECCS Analysis (2138)
Subj: Operator Interruption of High Pressure Injection
Date: February 9, 1978
This memo addresses a serious concern within ECCS Analysis about the potential for operator action to terminate high pressure injection following the initial
stage of a LOCA [loss-of-coolant accident]. Successful ECCS operation during small breaks depends on the accumulated reactor coolant system inventory as well
as the ECCS injection rate. As such, it is mandatory that full injection flow be maintained from the point of emergency safety features actuation system (ESFAS)
actuation until the high pressure injection rate can fully compensate for the reactor heat load. As the injection rate depends on the reactor coolant system
pressure, the time at which a compensating match-up occurs is variable and cannot be specified as a fixed number. It is quite possible, for example, that the high
pressure injection may successfully match up with all heat sources at time t and that due to system pressurization be inadequate at some later time t2.
The direct concern here rose out of the recent incident at Toledo. During the accident the operator terminated high pressure injection due to an apparent system
recovery indicated by high level within the pressurizer. This action would have been acceptable only after the primary system had been in a subcooled state.
Analysis of the data from the transient currently indicates that the system was in a two-phase state and as such did not contain sufficient capacity to allow high
pressure injection termination. This became evident at some 20 to 30 minutes following termination of injection when the pressurizer level again collapsed and
injection had to be reinitiated. During the 20 to 30 minutes of noninjection flow they were continuously losing important fluid inventory even though the
pressurizer indicated high level. I believe it fortunate that Toledo was at an extremely low power and extremely low burnup. Had this event occurred in a reactor
at full power with other than insignificant burnup it is quite possible, perhaps probable, that core uncovery and possible fuel damage would have resulted.
The incident points out that we have not supplied sufficient information to reactor operators in the area of recovery from LOCA. The following rule is based on an
attempt to allow termination of high pressure injection only at a time when the reactor coolant system is in a subcooled state and the pressurizer is indicating at
least a normal level for small breaks. Such conditions guarantee full system capacity and thus assure that during any follow on transient would be no worse than
the initial accident. I, therefore, recommend that operating procedures be written to allow for termination of high pressure injection under the following two
conditions only:
1. Low pressure injection has been actuated and is flowing at a rate in excess of the high pressure injection capability and that situation has been stable for a
period of time (10 minutes).
2. System pressure has recovered to normal operating pressure (2200 or 2250 psig) and system temperature within the hot leg is less than or equal to the normal
operating conditions (605 or 630 F).
I believe this is a very serious matter and deserves our prompt attention and correction.
BMD/lc
Cc: E.W. Swanson
D.H. Roy
B.A. Karrasch
H.A. Bailey
J. Kelly
E.R. Kane
J.D. Agar
R.L. Pittman
J.D. Phinny
T. Scott
[Source: United States. (1979, October). Staff report to the President's Commission on the accident at Three Mile Island. The role of the managing utility and its
suppliers (pp. 224-225). Washington, DC: U.S. Government Printing Office]
Memo from Roger Boisjoly on O-Ring Erosion
Morton Thiokol, Inc
Wasatch Division
Interoffice Memo
31 July 1985
2870:FY86:073
Cite this page: "Memo from Roger Boisjoly on O-Ring
Erosion"Online Ethics Center for Engineering8/29/2006National
Academy of EngineeringAccessed: Thursday, December 06,
2012<www.onlineethics.org/Topics/ProfPractice/Exemplars/Beha
vingWell/RB-intro/Erosion.aspx>
TO: R. K. Lund
Vice President, Engineering
CC: B. C. Brinton, A. J. McDonald, L. H. Sayer, J. R. Kapp
FROM: R. M. Boisjoly
Applied Mechanics - Ext. 3525
SUBJECT: SRM O-Ring Erosion/Potential Failure Criticality
This letter is written to insure that management is fully aware of the seriousness of the current O-ring erosion problem in the SRM joints from an
engineering standpoint.
The mistakenly accepted position on the joint problem was to fly without fear of failure and to run a series of design evaluations which would ultimately
lead to a solution or at least a significant reduction of the erosion problem. This position is now drastically changed as a result of the SRM 16A nozzle joint
erosion which eroded a secondary O-ring with the primary O-ring never sealing.
If the same scenario should occur in a field joint (and it could), then it is a jump ball as to the success or failure of the joint because the secondary O-ring
cannot respond to the clevis opening rate and may not be capable of pressurization. The result would be a catastrophe of the highest order - loss of human
life.
An unofficial team (a memo defining the team and its purpose was never published) with leader was formed on 19 July 1985 and was tasked with solving
the problem for both the short and long term. This unofficial team is essentially nonexistent at this time. In my opinion, the team must be officially given the
responsibility and the authority to execute the work that needs to be done on a non-interference basis (full time assignment until completed.)
It is my honest and very real fear that if we do not take immediate action to dedicate a team to solve the problem with the field joint having the number
one priority, then we stand in jeopardy of losing a flight along with all the launch pad facilities.
R. M. Boisjoly
Concurred by:
J. R. Kapp, Manager
Applied Mechanics
https://www.youtube.com/watch?v=eGI7VymjSho
https://www.youtube.com/watch?v=AfnvFnzs91s
Summary of the Challenger Episode
Morton Thiokol, Inc., an aerospace company, manufactures the solid
propellant rocket motors for the Peacekeeper missile and the missiles on
Trident nuclear submarines. Thiokol also worked closely with the National
Aeronautics and Space Administration (NASA) in developing
the Challenger, one of NASA's reusable space shuttles.
Specifically, Morton Thiokol manufactured the booster rockets used to
launch the Challenger. For January of 1986, NASA had scheduled a special
launch of the Challenger. The launch was highly publicized because NASA
had conducted a nationwide search for a teacher to send on the flight. On
this, NASA's twenty-fifth shuttle mission, teacher Christa McAuliffe would
be on board.
On the scheduled launch day, January 28, 1986, the weather was cloudy and
cold at the John F. Kennedy Space Center in Cape Canaveral, Florida. The
launch had already been delayed several times, but NASA officials still
contacted Thiokol engineers in Utah to discuss whether the shuttle should
be launched in such cold weather. The temperature range for the boosters,
as specified in Thiokol's contract with NASA, was between 40 degrees F
and 90 degrees F.
However, the temperature at Cape Canaveral that January morning was below 30
degrees F. The launch of the Challenger proceeded nevertheless. A presidential
commission later concluded, "Thiokol management reversed its position and
recommended the launch of [the Challenger] at the urging of [NASA] and contrary
to the views of its engineers in order to accommodate a major customer."
Two of the Thiokol engineers involved in the launch, Allan McDonald and Roger
Boisjoly later testified that they had opposed the launch. Boisjoly had done work on
the shuttle's booster rockets at the Marshall Space Flight Center in Utah in February
1985, at which time he noted that at low temperatures, an O-ring assembly in the
rockets eroded and, consequently, failed to seal properly. Though Boisjoly gave a
presentation on the issue, little action was taken over the course of the year. Boisjoly
conveyed his frustration in his activity reports. Finally, in July 1985, Boisjoly wrote
a confidential memo to R. K. (Bob) Lund, Thiokol's vice president for engineering.
An excerpt follows:
This letter is written to insure that management is fully aware of the
seriousness of the current O-ring erosion problem.... The mistakenly
accepted position on the joint problem was to fly without fear of
failure.... [This position] is now drastically changed as a result of the
SRM [shuttle recovery mission] 16A nozzle joint erosion which eroded a
secondary O-ring with the primary O-ring never sealing. If the same
scenario should occur in a field joint (and it could), then it is a jump ball
as to the success or failure of the joint....The result would be a
catastrophe of the highest order--loss of human life.... It is my honest
and real fear that if we do not take immediate action to dedicate a team
to solve the problem, with the field joint having the number one priority,
then we stand in jeopardy of losing a flight along with all the launch pad
facilities.
In October of 1985, Boisjoly presented the O-ring issue at a conference of the Society of
Automotive Engineers and requested suggestions for resolution.
On January 27, 1986, the day before the launch, Boisjoly attempted to halt the launch.
However, four Thiokol managers, including Lund, voted unanimously to recommend the
launch. One manager had urged Lund to "take off his engineering hat and put on his
management hat." The managers then developed the following revised recommendations.
Engineers were excluded from the final decision and the development of these findings.
•Calculations show that SRM-25 [the designation for the Challenger's January 28 flight]
O-rings will be 20 degrees colder than SRM-15 O-rings
•Temperature data not conclusive on predicting primary O-ring blow-by
•Engineering assessment is that: Colder O-rings will have increased effective durometer
[that is, they will be harder]
•"Harder" O-rings will take longer to seat. More gas may pass primary [SRM-25] O-ring
before the primary seal seats (relative to SRM-15). Demonstrated sealing threshold [on
SRM-25 O-ring] is 3 times greater than 0.038" erosion experienced on SRM-15
•If the primary seal does not seat, the secondary seal will seat. Pressure will get to
secondary seal before the metal parts rotate; O-ring pressure leak check places secondary
seal in outboard position which minimizes sealing time
•MTI recommends STS-51L launch proceeds on 28 January 1986. SRM-25 will not be
significantly different from SRM-15.
After the decision was made, Boisjoly returned to his office and wrote in his journal:
I sincerely hope this launch does not result in a catastrophe. I personally do not
agree with some of the statements made in Joe Kilminster's [Kilminster was one of
the four Thiokol managers who voted to recommend the launch] written summary
stating that SRM-25 is okay to fly.
Seventy-four seconds into the Challenger launch, the low temperature caused the seals at the
booster rocket joints to fail. The Challenger exploded, killing Christa McAuliffe and the six
astronauts who were on board.
The subsequent investigation by the presidential commission placed the blame for the faulty
O-rings squarely with Thiokol. Charles S. Locke, Thiokol's CEO, maintained, "I take the
position that we never agreed to the launch at the temperature at the time of the launch.
The Challenger incident resulted more from human error than mechanical error. The
decision to launch should have been referred to headquarters. If we'd been consulted here,
we'd never have given clearance, because the temperature was not within the contracted
specs."
Both Boisjoly and McDonald testified before the presidential panel regarding their
opposition to the launch and the decision of their managers (who were also engineers) to
override their recommendation. Both Boisjoly and McDonald also testified that following
their expressed opposition to the launch and their willingness to come forward, they had
been isolated from NASA and subsequently demoted. Since testifying, McDonald has been
assigned to "special projects." Boisjoly, who took medical leave for post-traumatic stress
disorder, has left Thiokol, but he does receive disability pay from the company. Currently,
Mr. Boisjoly operates a consulting firm in Mesa, Arizona. He speaks frequently on business
ethics to professional organizations and companies.
In May 1986, then-CEO Locke stated, in an interview with the Wall Street Journal, "This
shuttle thing will cost us this year 10 cents a share." Locke later protested that his statement
had been taken out of context.
In 1989, Morton Norwich separated from Thiokol Chemical Corporation. The two
companies had previously merged to become Morton Thiokol. Following the separation,
Thiokol Chemical became Thiokol Corporation. Morton returned to the salt business, and
Thiokol, which will remain under contract with NASA through 1999, redesigned its space
shuttle rocket motor to correct the deficiencies. No one at Thiokol was fired following
the Challenger accident. Because of this incident and defense contractor indictments, the
Government Accountability Project was established in Washington, D. C. The office
provides a staff, legal assistance, and pamphlets to help whistle-blowers working on
government projects.