Crater

Crater is an algorithm used by NASA’s Debris Assessment Team (DAT) to estimate how deeply an impacting object would penetrate the space shuttle’s thermal-protection tiles. In the investigation of the foam strike on Columbia, it became both an analytical tool and a measure of the limits of the evidence: the result seemed reassuring, but the algorithm had been designed for debris hundreds of times smaller than the foam that struck the shuttle.

Purpose and Use

On January 16, 2003, during the ascent of the twenty-eighth flight of the space shuttle Columbia, a large piece of foam broke off the left bipod area of the external fuel tank and struck the shuttle’s left wing. The launch-tracking cameras did not provide a clear view of the impact, leaving the extent of possible damage uncertain. By January 21, requests for on-orbit images had not been approved, so the DAT had to assess the strike with incomplete information.

The team first estimated the foam’s size and impact speed, then used Crater to predict how deeply debris of that size and speed would penetrate the tiles covering the shuttle’s wings. The tool thus converted estimates about the impact into a projection about possible tile damage. The DAT reached no definitive conclusion at that stage, but told Don McCormack that there was reason for concern.

Limits of the Analysis

At a January 24 briefing, the DAT laid out five possible scenarios and concluded that the shuttle was likely safe. But the engineers qualified that conclusion: their analysis was profoundly limited by inadequate information and by the tools available to them. Without approved on-orbit images, they did not know exactly where the foam had struck. Crater, meanwhile, had been designed to measure impacts from debris hundreds of times smaller than the piece that hit Columbia. The team therefore could not be sure that its output was accurate for this case.

Crater’s projection was not a direct observation of the damage, nor did it eliminate the unknowns about the foam’s size, impact location, or angle. The DAT stressed those uncertainties along with its tentative conclusion. In the subsequent Mission Management Team (MMT) meeting, McCormack mentioned both the possibility of significant damage and the uncertainty, but the discussion gravitated toward the finding that the thermal analysis did not indicate a potential burn-through. The tool’s result acquired a reassuring force that its limited applicability did not warrant.

From Tool Output to Management Conclusion

The MMT leader, Linda Ham, recast the analysis through a sequence of questions that treated the absence of a predicted burn-through as evidence against catastrophic damage and a safety-of-flight issue. The meeting ended without a member asking to see the DAT study or probing how much uncertainty lay behind its result. The distinction between a model that could not reliably resolve this unusually large impact and a conclusion that the shuttle was safe was consequently obscured.

The episode illustrates a broader problem in the book’s account of group judgment: specialized local analysis does not become collective knowledge merely because it exists. The DAT had gathered information and identified serious limits, but its cautions were not effectively carried into the MMT’s deliberation. Crater did not itself establish that Columbia was safe; the consequential failure was treating a constrained estimate as if it settled a question the available evidence could not answer.