External Tank

The External Tank was a central part of the shuttle’s launch system and, in two disasters discussed in the book, figured in different ways in the chain connecting hardware, evidence, and organizational judgment. During the Columbia mission, foam broke away from the tank and struck the orbiter’s wing; the uncertainty over the resulting damage became a test of whether managers would seek better evidence or settle prematurely on reassurance. In the Challenger disaster, escaping booster exhaust burned into the tank and caused the explosion.

Construction and role in the shuttle system

The tank supplied the physical setting for a consequential failure during the launch of Columbia on mission STS-107, the shuttle’s twenty-eighth flight. As the spacecraft ascended, a large piece of foam broke off the tank’s left bipod area and hit the shuttle’s left wing. The cameras following the launch did not provide a clear image of the impact, leaving engineers unable to determine directly how much damage had been done.

That uncertainty made the tank more than background equipment in the account. The foam’s departure connected a visible part of the launch system to a hidden question about the orbiter’s ability to survive reentry. Engineers had to infer the possible consequences from an incomplete picture of the strike, rather than inspect the damage itself.

The Columbia foam strike and its assessment

For much of the five days after launch, the Debris Assessment Team evaluated the strike. Its members estimated the foam’s size and speed, then used an algorithm called Crater to predict how deeply debris of that size and speed might penetrate the thermal-protection tiles on the shuttle’s wings. The team reached no conclusion, but conveyed that there was reason for concern.

On January 21, 2003, Don McCormack briefed members of the Mission Management Team before its teleconference. A request for on-orbit photographs of Columbia had been made, but the images had not been approved. During the meeting, the foam strike was raised only after discussion of other matters, including a jammed camera, scientific experiments, and a leaky water separator. McCormack described the investigation but did not transmit the Debris Assessment Team’s sense of concern; he also noted that Columbia had suffered fairly significant damage from a similar strike five years earlier.

The next day, team leader Linda Ham framed a question about whether the density of External Tank foam meant that no foam loss could cause safety-of-flight damage to the orbiter. The question embedded the reassuring answer it sought. Lambert Austin replied emphatically that the possibility of serious tile damage could not be ruled out, but his caution received little attention. The episode shows the distinction between asking for information and genuinely leaving a decision open to what that information might show.

Evidence withheld and assumptions hardened

The photograph request was turned down in part on the grounds that image resolution would not reveal the small impact area. The managers making that judgment lacked the security clearances needed to know the images’ actual resolution, and none asked the Department of Defense, which would have taken the pictures. Their confidence about the limits of the evidence therefore rested on little or no knowledge of the imaging capability.

A second assumption reinforced the first: if the foam had caused serious damage, nothing could be done about it. Calvin Schomburg, who maintained that the foam could not seriously damage the tiles, told NASA engineer Rodney Rocha that nothing could be done if the tiles were badly damaged. The later investigation found that NASA engineers had devised two strategies that might have brought the crew back safely, although the shuttle itself was doomed from the moment of impact. The managers did not have reason to know those particular strategies, but the belief that no remedy was possible had already shaped how they approached the question of whether damage existed.

The tank’s detached foam thus became a test of the team’s decision process as much as of the orbiter’s physical condition. The concern was not simply that available information was incomplete: the team declined a way to improve it, while treating an uncertain judgment about image quality and a mistaken assumption about possible remedies as grounds for moving on.

A second disaster and the tank’s place in the causal chain

The External Tank also appears in the account of the Challenger explosion on January 28, 1986. The book explains that hot gases escaped through gaps in the booster’s O-ring seals, which had become less resilient in cold weather, and burned into the main fuel tank. That damage caused the catastrophic explosion. The tank was therefore the point at which a failure in the solid-fuel booster’s seals became a disaster for the shuttle as a whole.

The contrast between Challenger and Columbia is significant. In the Challenger account, later investigation established the physical cause and held Morton Thiokol liable; the stock market had sharply singled out the company on the day of the explosion, before public comments identified it. In the Columbia account, by contrast, the decisive problem was the handling of uncertainty before reentry: the foam strike had occurred, but the effort to establish what it meant was constrained by the team’s assumptions and choices. In both, the tank anchors a chain of events in which a small material failure carries consequences far beyond the component itself.