As Columbia re-entered Earths atmosphere, sensors in the Orbiter relayed streams of data both to entry controllers on the ground at Johnson Space Center and to the Modular Auxiliary Data System recorder, which survived the breakup of the Orbiter and was recovered by ground search teams. This data ｭ temperatures, pressures, and stresses ｭ came from sensors located throughout the Orbiter. Entry control- lers were unaware of any problems with re-entry until telem- etry data indicated errant readings. During the investigation data from these two sources was used to make aerodynamic, aerothermal, and mechanical reconstructions of re-entry that showed how these stresses affected the Orbiter.

The re-entry analysis and testing focused on eight areas:

1. Analysis of the Modular Auxiliary Data System re- corder information and the pattern of wire runs and sensor failures throughout the Orbiter.
2. Physical and chemical analysis of the recovered de- bris to determine where the breach in the RCC panels likely occurred.
3. Analysis of videos and photography provided by the general public.
4. Abnormal heating on the outside of the Orbiter body. Sensors showed lower heating and then higher heating than is usually seen on the left Orbital Maneuvering System pod and the left side of the fuselage.
5. Early heating inside the wing leading edge. Initially, heating occurred inside the left wing RCC panels be- fore the wing leading edge spar was breached.
6. Laterheatinginsidetheleftwingstructure.Thisanaly- sis focused on the inside of the left wing after the wing leading edge spar had been breached.
7. Early changes in aerodynamic performance. The Or- biterbeganreactingtoincreasingleftyawandleftroll, consistent with developing drag and loss of lift on the left wing.
8. Later changes in aerodynamic performance. Almost 600 seconds after Entry Interface, the left-rolling ten- dency of the Orbiter changes to a right roll, indicating an increase in lift on the left wing. The left yaw also increased, showing increasing drag on the left wing.

For a complete compilation of all re-entry data, see the CAIB/NAIT Working Scenario (Appendix D.7) and the Re- entry Timeline (Appendix D.9). The extensive aerothermal calculations and wind tunnel tests performed to investigate the observed re-entry phenomenon are documented in NASAreport NSTS-37398.

Re-Entry Environment

In the demanding environment of re-entry, the Orbiter must withstand the high temperatures generated by its movement through the increasingly dense atmosphere as it deceler- ates from orbital speeds to land safely. At these velocities, shock waves form at the nose and along the leading edges of the wing, intersecting near RCC panel 9. The interac- tion between these two shock waves generates extremely high temperatures, especially around RCC panel 9, which experiences the highest surface temperatures of all the RCC panels. The flow behind these shock waves is at such a high temperature that air molecules are torn apart, or "dissoci- ated." The air immediately around the leading edge surface can reach 10,000 degrees Fahrenheit; however, the boundary layer shields the Orbiter so that the actual temperature is only approximately 3,000 degrees Fahrenheit at the leading edge. The RCC panels and internal insulation protect the alumi- num wing leading edge spar.A breach in one of the leading- edge RCC panels would expose the internal wing structure to temperatures well above 3,000 degrees Fahrenheit.

In contrast to the aerothermal environment, the aerodynamic environment during Columbias re-entry was relatively benign, especially early in re-entry.The re-entry dynamic pres- sure ranged from zero at Entry Interface to 80 pounds per square foot when the Orbiter went out of control, compared with a dynamic pressure during launch and ascent of nearly 700 pounds per square foot. However, the aerodynamic forces were increasing quickly during the final minutes of Columbias flight, and played an important role in the loss of control.

Orbiter Sensors

The Operational Flight Instrumentation monitors physical sensors and logic signals that report the status of various Orbiter functions. These sensor readings and signals are telemetered via a 128 kilobit-per-second data stream to the Mission Control Center, where engineers ascertain the real- time health of key Orbiter systems. An extensive review of this data has been key to understanding what happened to STS-107 during ascent, orbit, and re-entry.

The Modular Auxiliary Data System is a supplemental instrumentation system that gathers Orbiter data for pro- cessing after the mission is completed. Inputs are almost exclusively physical sensor readings of temperatures, pres- sures, mechanical strains, accelerations, and vibrations. The Modular Auxiliary Data System usually records only the missions first and last two hours (see Figure 3.6-1).

The Orbiter Experiment instrumentation is an expanded suite of sensors for the Modular Auxiliary Data System that was installed on Columbia for engineering development purposes. Because Columbia was the first Orbiter launched, engineering teams needed a means to gather more detailed flight data to validate their calculations of conditions the vehicle would experience during critical flight phases. The instrumentation remained on Columbia as a legacy of the development process, and was still providing valuable flight data from ascent, de-orbit, and re-entry for ongoing flight analysis and vehicle engineering. Nearly all of Columbias sensors were specified to have only a 10-year shelf life, and in some cases an even shorter service life.

At 22 years old, the majority of the Orbiter Experiment in- strumentation had been in service twice as long as its speci- fied service life, and in fact, many sensors were already failing. Engineers planned to stop collecting and analyzing data once most of the sensors had failed, so failed sensors and wiring were not repaired. For instance, of the 181 sensors in Columbias wings, 55 had already failed or were producing questionable readings before STS-107 was launched.

Re-Entry Timeline

Times in the following section are noted in seconds elapsed from the time Columbia crossed Entry Interface (EI) over the Pacific Ocean at 8:44:09 a.m. EST. Columbias destruc- tion occurred in the period from Entry Interface at 400,000 feet (EI+000) to about 200,000 feet (EI+970) over Texas. The Modular Auxiliary Data System recorded the first indications of problems at EI plus 270 seconds (EI+270). Because data from this system is retained onboard, Mission Control did not notice any troubling indications from telem- etry data until 8:54:24 a.m. (EI+613), some 10 minutes after Entry Interface.

Left Wing Leading Edge Spar Breach (EI+270 through EI+515)

At EI+270, the Modular Auxiliary Data System recorded the first unusual condition while the Orbiter was still over the Pacific Ocean. Four sensors, which were all either inside or outside the wing leading edge spar near Reinforced Car- bon-Carbon (RCC) panel 9-left, helped tell the story of what happened on the left wing of the Orbiter early in the re-entry. These four sensors were: strain gauge V12G9921A (Sensor 1), resistance temperature detector V09T9910Aon the RCC clevis between panel 9 and 10 (Sensor 2), thermocouple V07T9666A, within a Thermal Protection System tile (Sen- sor 3), and resistance temperature detector V09T9895A (Sensor 4), located on the back side of the wing leading edge spar behind RCC panels 8 and 9 (see Figure 3.6-2).

Sensor 1 provided the first anomalous reading (see Figure 3.6-3). From EI+270 to EI+360, the strain is higher than that on previous Columbia flights.At EI+450, the strain reverses, and then peaks again in a negative direction at EI+475. The strain then drops slightly, and remains constant and negative until EI+495, when the sensor pattern becomes unreliable, probably due to a propagating soft short, or "burn-through" of the insulation between cable conductors caused by heating or combustion.This strain likely indicates significant damage to the aluminum honeycomb spar. In particular, strain reversals, which are unusual, likely mean there was significant high-temperature damage to the spar during this time.

At EI+290, 20 seconds after Sensor 1 gave its first anoma- lous reading, Sensor 2, the only sensor in the front of the left wing leading edge spar, recorded the beginning of a gradual and abnormal rise in temperature from an expected 30 degrees Fahrenheit to 65 degrees at EI+493, when it then dropped to "off-scale low," a reading that drops off the scale at the low end of the sensors range (see Figure 3.6-4). Sen- sor 2, one of the first to fail, did so abruptly. It had indicated only a mild warming of the RCC attachment clevis before the signal was lost.

A series of thermal analyses were performed for different sized holes in RCC panel 8 to compute the time required to heat Sensor 2 to the temperature recorded by the Modular Auxiliary Data System. To heat the clevis, various insulators would have to be bypassed with a small amount of leakage, or "sneak flow." Figure 3.6-5 shows the results of these calculations for, as an example, a 10-inch hole, and demonstrates that with sneak flow around the insulation, the temperature profile of the clevis sensor was closely matched by the engineering calculations. This is consistent with the same sneak flow required to match a similar but abnormal ascent temperature rise of the same sensor, which further supports the premise that the breach in the leading edge of the wing occurred during ascent. While the exact size of the breach will never be known, and may have been smaller or larger than 10 inches, these analyses do provide a plausible explanation for the observed rises in temperature sensor data during re-entry.

Investigators initially theorized that the foam might have broken a T-seal and allowed superheated air to enter the wing between the RCC panels. However, the amount of T-seal debris from this area and subsequent aerothermal analysis showing this type of breach did not match the observed damage to the wing, led investigators to eliminate a missing T-seal as the source of the breach.

Although abnormal, the re-entry temperature rise was slow and small compared to what would be expected if Sensor 2 were exposed to a blast of superheated air from an assumed breach in the RCC panels. The slow temperature rise is attributed to the presence of a relatively modest breach in the RCC, the thick insulation that surrounds the sensor, and the distance from the site of the breach in RCC panel 8 to the clevis sensor.

The readings of Sensor 3, which was in a thermal tile, began rising abnormally high and somewhat erratically as early as EI+370, with several brief spikes to 2,500 degrees Fahrenheit, significantly higher than the 2,000-degree peak temperature on a normal re-entry (Figure 3.6-6).At EI+496, this reading became unreliable, indicating a failure of the wire or the sensor. Because this thermocouple was on the wing lower surface, directly behind the junction of RCC panel 9 and 10, the high temperatures it initially recorded were almost certainly a result of air jetting through the dam- aged area of RCC panel 8, or of the normal airflow being disturbed by the damage. Note that Sensor 3 provided an external temperature measurement, while Sensors 2 and 4 provided internal temperature measurements.

Sensor 4 also recorded a rise in temperature that ended in an abrupt fall to off-scale low. Figure 3.6-7 shows that an ab- normal temperature rise began at EI+425 and abruptly fell at EI+525. Unlike Sensor 2, this temperature rise was extreme, from an expected 20 degrees Fahrenheit at EI+425 to 40 de- grees at EI+485, and then rising much faster to 120 degrees at EI+515, then to an off-scale high (a reading that climbs off the scale at the high end of the range) of 450 degrees at EI+522. The failure pattern of this sensor likely indicates destruction by extreme heat.

The timing of the failures of these four sensors and the path of their cable routing enables a determination of both the timing and location of the breach of the leading edge spar, and indirectly, the breach of the RCC panels. All the cables from these sensors, and many others, were routed into wir- ing harnesses that ran forward along the back side of the leading edge spar up to a cross spar (see Figure 3.6-8), where they passed through the service opening in the cross spar and then ran in front of the left wheel well before reaching interconnect panel 65P, where they entered the fuselage. All sensors with wiring in this set of harnesses failed between EI+487 to EI+497, except Sensor 4, which survived until EI+522. The diversity of sensor types (temperature, pres- sure, and strains) and their locations in the left wing indi- cates that they failed because their wiring was destroyed at spar burn-through, as opposed to destruction of each individual sensor by direct heating.

Examination of wiring installation close out photographs (pictures that document the state of the area that are normally taken just before access is closed) and engineering drawings show five main wiring harness bundles running forward along the spar, labeled top to bottom as A through E (see Figure 3.6-8). The top four, A through D, are spaced 3 inches apart, while the fifth, E, is 6 inches beneath them.The separation between bundle E and the other four is consistent with the later fail- ure time of Sensor 4 by 25 to 29 seconds, and indicates that the breach was in the upper two-thirds of the spar, causing all but one of the cables in this area to fail between EI+487 to EI+497. The breach then expanded vertically, toward the underside of the wing, causing Sensor 4 to fail 25 seconds later. Because the distance between bundle A and bundle E is 9 inches, the failure of all these wires indicates that the breach in the wing leading edge spar was at least 9 inches from top to bottom by EI+522 seconds.

Also directly behind RCC panel 8 were pressure sensors V07P8010A (Sensor 5), on the upper interior surface of the wing, and V07P8058A (Sensor 6), on the lower interior surface of the wing. Sensor 5 failed abruptly at EI+497. Sensor 6, which was slightly more protected, began falling at EI+495, and failed completely at EI+505. Closeout pho- tographs show that the wiring from Sensor 5 travels down from the top of the wing to join the uppermost harness, A, which then travels along the leading edge spar. Similarly, wiring from Sensor6 travels up from the bottom of the wing, joins harnessA, and continues along the spar. It appears that Sensor 5' s wiring, on the upper wing surface, was damaged at EI+497, right after Sensor 1 failed. Noting the times of the sensor failures, and the locations of Sensors 5 and 6 forward of Sensors 1 through 4, spar burn-through must have oc- curred near where these wires came together.

Two of the 45 left wing strain gauges also recorded an anom- aly around EI+500 to EI+580, but their readings were not erratic or off-scale until late in the re-entry, at EI+930. Strain gauge V12G9048A was far forward on a cross spar in the front of the wheel well on the lower spar cap, and strain gauge V12G9049A was on the upper spar cap. Their responses appear to be the actual strain at that location until their failure at EI+935. The exposed wiring for most of the left wing sensors runs along the front of the spar that crosses in front of the left wheel well. The very late failure times of these two sensors indicate that the damage did not spread into the wing cavity forward of the wheel well until at least EI+935, which implies that the breach was aft of the cross spar. Because the cross spar attaches to the transition spar behind RCC panel 6, the breach must have been aft (outboard) of panel 6. The superheated air likely burned through the outboard wall of the wheel well, rather than snaking forward and then back through the vent at the front of the wheel well. Had the gases flowed through the access opening in the cross spar and then through the vent into the wheel well, it is unlikely that the lower strain gauge wiring would have survived. Finally, the rapid rise in Sensor 4 at EI+425, before the other sensors began to fail, indicates that high temperatures were responsible. Comparisons of sensors on the outside of the wing leading edge spar, those inside of the spar, and those in the wing and left wheel well indicate that abnormal heating first began on the outside of the spar behind the RCC panels and worked through the spar. Since the aluminum spar must have burned through before any cable harnesses attached to it failed, the breach through the wing leading edge spar must have occurred at or before EI+487.

Other abnormalities also occurred during re-entry. Early in re-entry, the heating normally seen on the left Orbital Maneuvering System pod was much lower than usual for this point in the flight (see Figure 3.6-9). Wind tunnel testing demonstrated that airflow into a breach in an RCC panel would then escape through the wing leading edge vents behind the upper part of the panel and interrupt the weak aerodynamic flow field on top of the wing. During re-entry, air normally flows into these vents to equalize air pressure across the RCC panels. The interruption in the flow field behind the wing caused a displacement of the vortices that normally hit the leading edge of the left pod, and resulted in a slowing of pod heating. Heating of the side fuselage slowed, which wind tunnel testing also predicted.

To match this scenario, investigators had to postulate damage to the tiles on the upper carrier panel 9, in order to allow sufficient mass flow through the vent to cause the observed decrease in sidewall heating. No upper carrier panels were found from panels 9, 10, and 11, which supports this hypothesis. Although this can account for the abnormal temperatures on the body of the Orbiter and at the Orbital Maneuvering System pod, flight data and wind tunnel tests confirmed that this venting was not strong enough to alter the aerodynamic force on the Orbiter, and the aerodynamic analysis of mission data showed no change in Orbiter flight control parameters during this time.

During re-entry, a change was noted in the rate of the temperature rise around the RCC chin panel clevis temperature sensor and two water supply nozzles on the left side of the fuselage, just aft of the main bulkhead that divides the crew cabin from the payload bay. Because these sensors were well forward of the damage in the left wing leading edge, it is still unclear how their indications fit into the failure scenario.

Sensor Loss and the Onset of Unusual Aerodynamic Effects (EI+500 through EI+611)

Fourteen seconds after the loss of the first sensor wire on the wing leading edge spar at EI+487, a sensor wire in a bundle of some 150 wires that ran along the upper outside corner of the left wheel well showed a burn-through. In the next 50 seconds, more than 70 percent of the sensor wires in three cables in this area also burned through (see Figure 3.6-10). Investigators plotted the wiring run for every left-wing sen- sor, looking for a relationship between their location and time of failure.

Only two sensor wires of 169 remained intact when the Modular Auxiliary Data System recorder stopped, indicating that the burn-throughs had to occur in an area that nearly every wire ran through. To sustain this type of damage, the wires had to be close enough to the breach for the gas plume to hit them. Arc jet testing (in a wind tunnel with an electri- cal arc that provides up to a 2,800-degree Fahrenheit air- flow) on a simulated wing leading edge spar and simulated wire bundles showed how the leading edge spar would burn through in a few seconds. It also showed that wire bundles would burn through in a timeframe consistent with those seen in the ModularAuxiliary Data System information and the telemetered data.

Later computational fluid dynamics analysis of the mid- wing area behind the spar showed that superheated air flowing into a breached RCC panel 8 and then interacting with the internal structure behind the RCC cavity (RCC ribs and spar insulation) would have continued through the wing leading edge spar as a jet, and would have easily allowed superheated air to traverse the 56.5 inches from the spar to the outside of the wheel well and destroy the cables (Figure 3.6-11). Controllers on the ground saw these first anomalies in the telemetry data at EI+613, when four hydraulic sensor cables that ran from the aft part of the left wing through the wiring bundles outside the wheel well failed.

Aerodynamic roll and yaw forces began to differ from those on previous flights at about EI+500 (see Figure 3.6-12). Investigators used flight data to reconstruct the aerodynamic forces acting on the Orbiter.This reconstructed data was then compared to forces seen on other similar flights of Columbia and to the forces predicted for STS-107. In the early phase of fight, these abnormal aerodynamic forces indicated that Columbias flight control system was reacting to a change in the external shape of the wing, which was caused by progressive RCC damage that caused a continuing decrease in lift and a continuing increase in drag on the left wing.

Between EI+530 and EI+562, four sensors on the left in- board elevon failed. These sensor readings were part of the data telemetered to the ground. Noting the system failures, the Maintenance, Mechanical, and Crew Systems officer notified the Flight Director of the failures. (See sidebar in Chapter 2 for a complete version of the Mission Control Center conversation about this data.)

At EI+555, Columbia crossed the California coast. People on the ground now saw the damage developing on the Or- biter in the form of debris being shed, and documented this with video cameras. In the next 15 seconds, temperatures on the fuselage sidewall and the left Orbital Maneuvering System pod began to rise. Hypersonic wind tunnel tests indi- cated that the increased heating on the Orbital Maneuvering System pod and the roll and yaw changes were caused by substantial leading edge damage around RCC panel 9. Data on Orbiter temperature distribution as well as aerodynamic forces for various damage scenarios were obtained from wind tunnel testing.

Figure 3.6-13 shows the comparison of surface temperature distribution with an undamaged Orbiter and one with an en- tire panel 9 removed. With panel 9 removed, a strong vortex flow structure is positioned to increase the temperature on the leading edge of the Orbital Maneuvering System pod. The aim is not to demonstrate that all of panel 9 was miss- ing at this point, but rather to indicate that major damage to panels near panel 9 can shift the strong vortex flow pattern and change the Orbiters temperature distribution to match the Modular Auxiliary Data System information. Wind tun- nel tests also demonstrated that increasing damage to lead- ing edge RCC panels would result in increasing drag and decreasing lift on the left wing.

Recovered debris showed that Inconel 718, which is only found in wing leading edge spanner beams and attachment fittings, was deposited on the left Orbital Maneuvering System pod, verifying that airflow through the breach and out of the upper slot carried molten wing leading edge material back to the pod. Temperatures far exceeded those seen on previous re-entries and further confirmed that the wing lead- ing-edge damage was increasing.

By this time, superheated air had been entering the wing since EI+487, and significant internal damage had probably occurred. The major internal support structure in the mid- wing consists of aluminum trusses with a melting point of 1,200 degrees Fahrenheit. Because the ingested air may have been as hot as 8,000 degrees near the breach, it is likely that the internal support structure that maintains the shape of the wing was severely compromised.

As the Orbiter flew east, people on the ground continued to record the major shedding of debris. Investigators later scrutinized these videos to compare Columbias re-entry with recordings of other re-entries and to identify the debris. The video analysis was also used to determine additional search areas on the ground and to estimate the size of various pieces of debris as they fell from the Orbiter.

Temperatures in the wheel well began to rise rapidly at EI+601, which indicated that the superheated air coming through the wing leading edge spar had breached the wheel well wall. At the same time, observers on the ground noted additional significant shedding of debris. Analysis of one of these "debris events" showed that the photographed object could have weighed nearly 190 pounds, which would have significantly altered Columbias physical condition.

At EI+602, the tendency of the Orbiter to roll to the left in response to a loss of lift on the left wing transitioned to a right-rolling tendency, now in response to increased lift on the left wing. Observers on the ground noted additional sig- nificant shedding of debris in the next 30 seconds. Left yaw continued to increase, consistent with increasing drag on the left wing. Further damage to the RCC panels explains the increased drag on the left wing, but it does not explain the sudden increase in lift, which can be explained only by some other type of wing damage.

Investigators ran multiple analyses and wind tunnel tests to understand this significant aerodynamic event. Analysis showed that by EI+850, the temperatures inside the wing were high enough to substantially damage the wing skins, wing leading edge spar, and the wheel well wall, and melt the wings support struts. Once structural support was lost, the wing likely deformed, effectively changing shape and re- sulting in increased lift and a corresponding increase in drag on the left wing. The increased drag on the left wing further increased the Orbiters tendency to yaw left.

Loss of Vehicle Control (EI+612 through EI+970)

A rise in hydraulic line temperatures inside the left wheel well indicated that superheated air had penetrated the wheel well wall by EI+727. This temperature rise, telemetered to Mission Control, was noted by the Maintenance, Mechani- cal, and Crew Systems officer. The Orbiter initiated and completed its roll reversal by EI+766 and was positioned left-wing-down for this portion of re-entry. The Guidance and Flight Control Systems performed normally, although the aero-control surfaces (aileron trim) continued to counter- act the additional drag and lift from the left wing.

At EI+790, two left main gear outboard tire pressure sen- sors began trending slightly upward, followed very shortly by going off-scale low, which indicated extreme heating of both the left inboard and outboard tires. The tires, with their large mass, would require substantial heating to produce the sensors slight temperature rise. Another sharp change in the rolling tendency of the Orbiter occurred at EI+834, along with additional shedding of debris. In an attempt to maintain attitude control, the Orbiter responded with a sharp change in aileron trim, which indicated there was another significant change to the left wing configuration, likely due to wing de- formation. By EI+887, all left main gear inboard and out- board tire pressure and wheel temperature measurements were lost, indicating burning wires and a rapid progression of damage in the wheel well.

At EI+897, the left main landing gear downlock position indicator reported that the gear was now down and locked. At the same time, a sensor indicated the landing gear door was still closed, while another sensor indicated that the main landing gear was still locked in the up position. Wire burn-through testing showed that a burn-induced short in the downlock sensor wiring could produce these same contradictions in gear status indication. Several measurements on the strut produced valid data until the final loss of telemetry data. This suggests that the gear-down-and locked indica- tion was the result of a wire burn-through, not a result of the landing gear actually deploying. All four corresponding proximity switch sensors for the right main landing gear re- mained normal throughout re-entry until telemetry was lost.

Post-accident analysis of flight data that was generated af- ter telemetry information was lost showed another abrupt change in the Orbiters aerodynamics caused by a contin- ued progression of left wing damage at EI+917. The data showed a significant increase in positive roll and negative yaw, again indicating another increase in drag on and lift from the damaged left wing. Columbias flight control sys- tem attempted to compensate for this increased left yaw by firing all four right yaw jets. Even with all thrusters firing, combined with a maximum rate of change of aileron trim, the flight control system was unable to control the left yaw, and control of the Orbiter was lost at EI+970 seconds. Mission Control lost all telemetry data from the Orbiter at EI+923 (8:59:32 a.m.). Civilian and military video cameras on the ground documented the final breakup. The Modular Auxil- iary Data System stopped recording at EI+970 seconds.

Findings:

F3.6-1
The de-orbit burn and re-entry flight path were normal until just before Loss of Signal.

F3.6-2
Columbia re-entered the atmosphere with a pre- existing breach in the left wing.

F3.6-3
Data from the Modular Auxiliary Data System recorder indicates the location of the breach was in the RCC panels on the left wing leading edge.

F3.6-4
Abnormal heating events preceded abnormal aerodynamic events by several minutes.

F3.6-5
By the time data indicating problems was teleme- tered to Mission Control Center, the Orbiter had already suffered damage from which it could not recover.

Recommendations:

R3.6-1
The Modular Auxiliary Data System instrumen- tation and sensor suite on each Orbiter should be maintained and updated to include current sensor and data acquisition technologies.

R3.6-2
The Modular Auxiliary Data System should be redesigned to include engineering performance and vehicle health information, and have the ability to be reconfigured during flight in order to allow certain data to be recorded, telemetered, or both, as needs change.