HARDWARE DEVELOPMENT AND PRODUCTION

HARDWARE DEVELOPMENT AND PRODUCTION

¶a. Problems in Hardware Certification Issue 1

¶Having all elements of Space Shuttle flight hardware been ade- quately certified? Findings

1. The overall design and certification processes prescribed by NASA for each major element of Space Shuttle flight hardware are very comprehensive.

2. Prior to the STS 51-L accident, in spite of the comprehensive nature of NASA's prescribed design and certification processes, in- sufficient testing had been conducted to permit an adequate under- standing by either Morton-Thiokol or NASA regarding the actual functioning of the Solid Rocket Motor joint. Also, the Solid Rocket Motor had not been adequately certified to meet the natural and induced environmental conditions that are stated in NASA's design standards. The issue of whether or not standards were adequate is discussed in Section VII.

3. The deficiencies in Solid Rocket Motor testing and certifica- tion persisted in spite of many reviews of the program by panels of experts: (1)within the manufacturer; (2) within NASA; and (3) from independent, outside groups.

4. These deficiencies in testing and certification of one major ele- ment of the Space Shuttle system raise the possibility that other elements of flight hardware (or other subelements of the Solid Rocket Motor) could have similar deficiencies.

5. If NASA is unable to explain why the deficiencies in Solid Rocket Motor testing and certification went undetected by the ex- isting comprehensive set of processes and procedures, the agency will not be able to protect against a similar breakdown in its system of checks and balances in the future. Recommendations

6. NASA should devote more attention to determining why the deficiencies in Solid Rocket Motor testing and certification went undetected, so that appropriate action can be taken to uncover latent problems in existing hardware and to prevent similar prob- lems in future development programs.

7. NASA and its contractors should thoroughly reassess the ade- quacy of all of the testing and certification that has been conducted

¶(85)

86

¶to date on each element of Space Shuttle flight hardware. Where deficiencies are found, they must be corrected. Discussion

¶In background briefings for the Committee staff prior to the start of the hearings, NASA described the system of formal reviews that were employed to scrutinize the design and certification of each element of flight hardware.

¶The review process began with a System Requirements Review in the early 1970's. About 18 months later, each hardware element went through a Preliminary Design Review (PDR). This review was conducted when about 10 percent of the engineering drawings were complete and resulted in approval for the hardware to move into the final design stage. The Critical Design Review (CDR) was held when about 90 percent of the engineering drawings were complete and resulted in an authorization to carry the manufacturing proc- ess through to completion. After the end of a detailed test and cer- tification program, NASA conducted a Design Certification Review (DCR) to ensure that all tests and certification results were consist- ent with specified design requirements and standards.

¶Because of the extreme complexity of the Orbiter, a series of Configuration Acceptance Reviews (CARS) was also conducted in addition to the standard process of reviews described above. The Phase I CAR was a verification review to ensure that the Orbiter was ready to begin test. Prior to the start of the Orbiter combined system test, several additional incremental test reviews were also conducted. The Phase I11 CAR was the verification review that re- sulted in final acceptance of the vehicle for delivery from the man- ufacturer to NASA.

¶In Amendix K in Volume I1 of the Rogers Commission Report, the Deielopment and Production Team dcscusses in further detail the design and certification processes that were used by each prime contractor. For example, this appendix indicates that Rockwell used a total of 17 design review teams (some divided into as many as 17 subteams) to oversee the design and production work on the Orbiter. The appendix also describes the requirement verification system used by Thiokol for the Solid Rocket Motor as a "closed- loop'' system intended to track each specification requirement. The system specified the method of verification (analysis, inspection, test, etc.) that was to be used for each program phase (develop- ment, acceptance, prelaunch, etc.), along with all applicable re- quirements of the verification plan. These were tracked through the test plans and reports and then culminated in the issuance of a formal "certificate of qualification".

¶In addition to this comprehensive system of oversight and review by each prime contractor and each NASA field center responsible for monitoring the work of those contractors, detailed outside re- views of the design and testing programs for each major element of flight hardware also occurred. For example, the Aerospace Safety Advisory Panel regularly reviewed the safety aspects of Space Shuttle flight hardware and annually reported their concerns to

¶1 Rogers Commission Report, Volume 11, pp. K-12 and K-28.

87

¶the NASA Administrator. As another example, NASA Headquar- ters in 1980 created a Space Shuttle Verification/Certification Committee to thoroughly study the flight worthiness of the entire Shuttle system. This independent committee was chaired by Dr. Walt Williams, NASA's Chief Engineer, and was comprised of rec- ognized experts drawn from the military, private industry, and aca- demia. There was also additional reviews such as a study of the Space Shuttle Main Engine conducted by Professor Gene Covert of MIT.~

¶Finally, before the first flight of the Space Shuttle in 1981, NASA had each contractor and each field center carefully review all of the requirement specifications and certification tests for their flight hardware to ensure that all contract end-item requirements had been adequately certified. Upon determining that all certifica- tion requirements had been satisfied, each NASA project and tech- nical manager was requried to sign a Verification Completion Notice (a copy of which is contained in Appendix VI-A of this report). This entire process was then duplicated prior to the first "operational" flight of the Space Shuttle (i.e., STS-5 in 1982). This latter process also culminated in each NASA project and technical manager signing a second Verification Completion Notice (a copy of which is contained in Appendix VI-A of this report.).

¶Given this comprehensive system of reviews, it is difficult to un- derstand how major inadequacies in design and certification for any element of flight hardware could have gone unnoticed. But it is exactly what happened for the Solid Rocket Motor. Specifically, the Commission concluded that:

¶The joint test and certification program was inadequate. And,

Prior to the accident, neither NASA nor Thiokol fully understood the mechanism by which the joint sealing action took place.5

¶In addition, the Development and Production Team concluded that:

Prior to the STS 51-L accident, there was a lack of un- derstanding on the part of MTI [Morton Thiokol Inc.] and NASA of the joint operation as designed.

¶And,

JSC 07700, Volume X [the NASA master requirements document for the Space Shuttle program], clearly states the natural and induced environments to which the SRM [Solid Rocket Motor] is to be designed and verified. The field joints . . . were not qualification tested to the full range of the contractually required environments. This led to a lack of complete understanding of the joint design limits.6

¶bi d. ,Volume I, pp. 160-161 3 Ibid., pp. 124-125.⁴⁴ Rogers Commission Report, Volume 1 1, p. H-1. bid., Volume 11, p. K-24.

¶Ibid., Volume I, p. 148. 6 bid., Volume XI, p. K-30.

88

¶Relative to this last point, the NASA requirement documents state that: "The Shuttle Flight Vehicle design shall satisfy the nat- ural environmental design requirements . . .", including air tem- perature extremes of 20°F to 103°F at "Ferry Sites" and 31°F to 99°F for "Vertical Flight". Also, the requirement documents state that: "Each element of the Shuttle Flight Vehicle shall be capable of withstanding the induced environments imposed during trans- portation, ground operations, handling and flight operations . . .", including induced Solid Rocket Booster surface temperatures as low as 25°F and induced temperatures as low as 21°F at the point where the aft strut attaches the Solid Rocket Boosters to the Exter- nal Tank. (Excerpts documenting these temperature requirements are contained in a briefing given by NASA to Joseph Sutter of the Rogers Commission on May 19, 1986, which is reproduced in Ap- pendix VI-A-4 of this report.)

¶Of principal concern to the Committee is the fact that none of the extensive systems of checks and balances within the Space Shuttle program discovered the lack of adequate testing and certifi- cation of the Solid Rocket Motor. This failure of the management and review system indicates to the Committee that other elements of Shuttle flight hardware or other subelements of the Solid Rocket Motor may also be inadequately understood or certified. This will obviously require NASA and its contractors to conduct a careful review of all the testing and certification efforts that have been conducted to date for each element of Space Shuttle flight hard- ware.

¶A parallel concern of the Committee is that NASA does not yet know how or why this break-down occurred in this comprehensive system of reviews, checks, and balances. Without such an under- standing, the teams that will now be conducting the required re- views of each element of flight hardware will be somewhat disad- vantaged because they cannot be certain that they are "asking the right questions" or "looking for the right things." Further, without an understanding of how and why the existing management and control system broke down, NASA will not be able to make the necessary managerial and procedural changes required to be confi- dent that this problem will not reoccur in the future. Issue 2

¶Does the Space Shuttle Main Engine have adequate operating margins, and is the "fleet leader" concept adequate to ensure safe operation? Findings

1. The Space Shuttle Main Engine is an impressive technological achievement. However, it also is one of the higher risk elements of the Space Shuttle system. Anomalous component performance or premature engine shutdown could prove catastrophic to the Space Shuttle and its crew.

2. Some NASA officials familiar with the Space Shuttle Main Engine believe that it should be operated at a throttle setting of 109 percent only in an emergency; others believe the engine could be safely operated at 109 percent on a routine basis.

89

3. It is widely accepted that the Space Shuttle Main Engine would be safer if its operating margins (for temperature, pressure, operating time, etc.) were increased.

4. The Committee agrees with the sense of Dr. Feynman's con- cerns with respect to NASA's current, "fleet leader" concept for certifying Space Shuttle Main Engine components, such as high pressure turbopumps, for flight.

5. On a case by case basis, NASA regularly violates its own certi- fication requirements by permitting individual engine components to be used for flight even though they have accumulated an operat- ing time in excess of 50 percent of the two fleet leaders (i.e., in vio- lation of the "2X"rule). Recommendations

6. NASA should continue its active development program for the Space Shuttle Main Engine. The program should be focused more on increasing operating margins.

7. Because of the safety concerns raised by some knowledgeable officials, NASA should give serious consideration to restricting use of the 109 percent engine throttle setting to emergency situations only. If NASA decides that it needs to use the 109 percent throttle setting for other than emergency situations, the space agency should take whatever actions are required to ensure that adequate margins are present to maintain safety.

8. NASA should closely scrutinize each of the concerns raised by Dr. Feynman regarding the agency's "fleet leader" concept for cer- tifying Space Shuttle Main Engine components. The agency should also closely reassess its practice of selectively violating its "2X' rule for some Main Engine flight hardware elements. Discussion

¶The Space Shuttle Main Engine is, very appropriately, described by the Development and Production Team as a "high technology, high power density, state-of-the-art rocket engine." ' I Indeed, the Space Shuttle Main Engine represents a major increase in operat- ing performance over that provided by any other available rocket motor. In his paper Dr. Feynman notes that the Main Engine "is built at the edge of, or outside of, previous engineering experi- ence."s "he Development and Production Team also observed that the Space Shuttle Main Engine is "a very complex and high risk element of the Space Shuttle system."

¶It is this last observation that is of more concern here. Specifical- ly, if the Space Shuttle Main Engine were to experience a major problem in flight, the results could be catastrophic. Even prema- ture engine shutdown could prove fatal during certain segments of flight because it would mean that the Orbiter would have to ditch at sea-a maneuver that the Rogers Commission concluded would probably be non-survivable. O

¶:a,, era Commission Report, Volume 11, p. K-3.

¶p. F-2.

¶bid., p. K-3. l o bid., Volume I, p. 182.

¶64-420 0 - 86 - 4

90

¶Therefore, the key question is: how safe is the Space Shuttle Main Engine? An informal review of failures that have occurred during ground testing over the past five years was reported to the Committee staff." It concluded that five of these failures would probably have been catastrophic if they had occurred in flight. It is also of note that each of these failures occurred at an engine thrust setting of 109 percent or greater. However, closer examina- tion of the cause for each failure indicates that most were the result of: poorly installed test instrumentation (engine 2208); an im- properly tested "fix" to an engineering problem (engine 2013); the use of "deactivated" components because no others were available (engine 0204); or the existence of a phenomenon that cannot recur because of the adoption of a new safety "red line" in current flight engines (engine 0108). The failure of engine 2308, on the other hand, did uncover a life limit on current engine hardware. That particular engine had accumulated about 20,000 seconds of oper- ation (the equivalent of 40 Space Shuttle missions) in the compo- nent which failed (the main combustion chamber). Further, this engine had reportedly logged a significant amount of operating time at a power level of 109 percent.

¶However, the question of engine safety still remains. The majori- ty of present and past Space Shuttle Main Engine program officials who briefed the Committee staff were personally uneasy at the thought of operating the Main Engine at a thrust setting of 109 percent in anything other than an emergency situation. Specifical- ly, in certain emergency or abort situations, the throttle must be advanced to 109 percent to either reach orbit or to successfully return to the launch site. Under these circumstances, the risks of not using the 109 percent throttle setting (and having to ditch the Orbiter at sea) would obviously be greater than the risks of using that throttle setting. These officials also noted that, at the outset of the Main Engine development program, the 109 percent power set- ting was referred to as the "Emergency Power Level". As the pay- load lift performance of the Space Shuttle became increasingly marginal, however, the 109 percent setting was redesignated as the "Full Power Level." Subsequently, several engines were ground tested at the 109 percent power setting for a sufficient duration to certify use of that power setting in normal launch operations.

¶In addition to Space Shuttle Main Engine program officials at NASA, others have expressed concern with using the 109 percent throttle setting. For example, the Aerospace Safety Advisory Panel voiced concern that "each time NASA flies at 109% we are really pushing the capability of the engine".'3 In his testimony before the Committee, Mr. George Jeffs, President of Rockwell International (manufacturer of the engine) conceded that:

. . . we don't have a lot of margin at 109 percent. . . . To be comfortable . . . we would recommend that we go to a

¶Discussions with personnel from Rocketdyne, Pratt & Whitney, and Aerojet General, August, 1986.

¶l 2 These include the destructive failures of engine 0204 in September 1981; engine 2013 in April 1982; engine 2208 in August 1982; engine 0108 in February 1984; and engine 2308 in March 1985.

¶l 3 Discussion with Aerospace Safety Advisory Panel, May, 1986.

91

larger throat . . . and that we also add to that the dual manifold gas system. . . ." l 4

¶All observers agree that the "wear and tear" on an engine oper- ating at 109 percent is substantially greater than when it operates at the more standard 100 to 104 percent throttle settings. However, some NASA officials believe that the successful completion of a tra- ditional certification program involving two engines operating at 109 percent thrust levels is adequate justification for use of the 109 percent power setting for standard missions involving heavy pay- loads. Other officials, on the other hand, continue to believe that this power setting should be used only in emergencies. If this latter view is adopted, it would mean that the heaviest payloads now planned for launch by the Space Shuttle would have to be moved to expendable launch vehicles. The Committee is not now in a posi- tion to accurately predict the programmatic ramifications of such a decision, but the recent national commitment to an enhanced ex- pendable launch vehicle fleet could possibly minimize the negative impacts of a decision to restrict Space Shuttle Main Engine thrust levels to no more than 104 percent.

¶Though there is substantial disagreement whether or not the Space Shuttle Main Engine should be used routinely at a thrust setting of 109 percent, there is little or no disagreement that the Main Engine would be safer if its operating margins (for tempera- ture, pressure, operating time, etc.) were increased. Indeed, the De- velopment and Production Team noted in its report that one of the formal actions being taken by Rocketdyne in response to the STS 51-L accident is the creation of a "Margin Improvement Board." l 5 This board will review and suggest appropriate actions on all rec- ommendations for increased engine operating margins.

¶Another concern that has been raised regarding the certification of the Space Shuttle Main Engine relates to NASA's use of the "fleet leader" concept. NASA's basic engine certification guidelines require that all components be tested on the ground in two engines for a period of time at least twice as long as the time that those components will accumulate in flight. For example, before turbo- pumps can be used for four successive flights, the turbopumps in two ground test engines must be tested for the equivalent time that would be required to accomplish eight successive flights. Dr. Feyn- man cites several problems with this approach. These include:

The question of what constitutes an "unsuccessful" test? To the Federal Aviation Administration, a cracked turbine blade would constitute a failed test. To NASA, on the other hand, a turbine blade would not be considered to have "failed" until it actually broke in two.ls

92

The question of whether two "fleet leader" engines rep- resent a better indication of component operating life than a third engine which fails in a lesser time? In other words, should the operating time limits for flight hardware be set at one-half that of the two fleet-leader engines or one-half that of the shortest-lived components? When a defect is found in a fleet leader engine and a component must be replaced, what engine running time should be used for calculating permissable flight hardware operating times for that component using the "2X" rule: (1) the accumulated operating time up to the start of the final test; (2) the accumulated time as of the end of the final test; or (3) some length of time in between these two extremes?

¶In the staff review prior to the Committee hearings, NASA offi- cials also noted that the agency frequently violates its "2X" rule for engine flight hardware-permitting components to be used in a particular mission that have not been tested on the ground for twice as long as their intended use in flight. However, these offi- cials noted that this was only done on a "case by case basis" and only for those components that are considered to be highly reliable.

¶Possibly the most disturbing observation regarding the Space Shuttle Main Engine made by Dr. Feynman in his report is his as- sertion that: "the Flight Readiness Reviews and certification rules show a deterioration for some of the problems of the Space Shuttle Main Engine that is closely analogous to the deterioration seen in the rules for the Solid Rocket Boosters." If true, this assertion is obviously quite ominous.

¶b. Recurrent Hardware Problems Issue 1

¶What resolutions of inadequacies revealed in the landing gear, tires, wheels, brakes, and nose wheel steering of the landing and deceleration system are required? Findings

1. The Orbiter landing gear, tires, wheels, brakes, and nose wheel steering, as a system, is experimental, designed to criteria outside any other experience, and uses unique combinations of ma- terials. The original design performance specifications for speed and landing weights are routinely exceeded. The original design did not consider asymmetrical braking for cross wind steering as the normal case although it has become standard practice. Stresses which were not taken into account in the design have surfaced in as yet a very small real world sample.

¶broken blades totally within the engine; and (2) all commercial jet aircraft are designed to fly with one en 'ne ino rative. On the other hand, the FAA does consider aa critical any cracks in the "fir tree? r e g i o z f a turbine blade which is used to attach the blade to the hub of the tur- bine. (Should a turbine blade break in this region, it may be heavy enough to break through the engine shieldin 1 This is the region in which cracks are appearing in some Space Shuttle Main Engine turbinetlades.

Rogers Commission Report, Volume 11, p. F-3. bid.

93

2. As a consequence, Orbiter landings appear high risk even under ideal conditions, which seldom occur. Exceptional procedural and skill demands are placed upon the pilots to nurse the brakes and tires through every landing. Landing rules have had increas- ing constraints imposed that hamper operational flexibility and usefulness of the Orbiter.

3. Brake and tire damage have been evident since early on in the program. The Rogers Commission seems very correct in finding the current landing gear system unacceptable. Resolution of land- ing gear system problems can no longer be put off. Recommendations

¶The Committee recommends that NASA:

1. Assemble all of the fragmented studies, analyses, and conclu- sions on landing gear problems and integrate them into one engi- neering description of the system as it is now intended to be used. This should include consideration of the basic strength of the struts themselves and their attachments.

2. Write a new system specification and match the proposed design improvements to an acceptable reliability and certification specification.

3. Design a test and certification program adequate to meet cri- teria to fly and to continue well into future operations until under- standing and confidence in the landing gear system is attained.

4. In anticipation of requirements for a new brake specification, accelerate a program to provide:

Increased brake mass and/or heat sink; Substantial increase in energy absorption; Evaluation which weighs the experimental nature of the pro- posed 65 million foot pound carbon brake and its impact on the system against the penalty of weight of known materials (e.g. steel) for operational confidence.

5. Write updated subsystem specifications to upgrade the landing gear system to acceptable levels of performance to respond to the Rogers Commission's recommendations. Discussion

¶The sheer volume of testimony and documentation inevitably gives rise to apparent contradictions. None have surfaced that are assessed as consequential in evaluating the landing gear system problems (NASA's "anomalies") with a view to their solution.

¶The main landing gear (see Figure YI-1) consists of two heavily- loaded, two-wheel struts with two brakes on each and is designed for deceleration only. Roll-out and cross-wind steering correction was originally assigned to the nose wheel steering for the normal case. Each tire, wheel, and brake is supported by redundant fail operational anti-skid brake actuators, control valves, control boxes, and hydraulic power.

¶The nose wheel strut has two wheels on a common axle, no brakes, and is steerable. At the time of the accident nose wheel steering was not permitted except in an emergency because it did not have fail operational or fail safe redundancy. This places addi- tional requirements on the main gear braking system that were a substantive source of main gear problems. Need for correction of this oversight was most apparent and is the simplest of several dif- ficult landing gear problem solutions. The lack of definitive action in five years of operations is not explained.

94

¶The tires apparently meet all of their design specifications but are critical for other reasons: (1)If a tire is soft or flat at the time of the nose down load spike (caused by negative lift on the wing, when the nose wheel makes contact) the other tire on that strut will take loads far in excess of its 130,000 pound limit and fail. (2) There is a body of opinion that at almost any time in the landing, one failed tire will assure the failure of its mate. (3) There is no assurance at launch that there is adequate pressure in any of the tires to assure spec performance. (3) Scuffing, cutting, abrading, and wear from spin up, asymetrical braking (cross wind steering), surface roughness, and debris have been more than expected and disallow reuse of most tires (one landing per tire was spec). (4) Anti-skid becomes inactive at 20 knots and damaged brakes will lock up and blow both tires. It would appear that solving a host of other problems will resolve a number of the major tire problems.

¶The brakes by all standards are very large, very light, of conven- tional configuration, and very experimental because of extensive stretching of materials technolgy by using carbon-beryllium. Brake design is not rigorous, it is very empirical and results are often un- predictable in new designs. The Orbiter brakes incorporate berylli- um stators and carbon lined beryllium rotors. Beryllium has low density, high strength, and high heat capacity. Beryllium is very tender and not well behaved at high temperatures. Beryllium has unreliable plastic characteristics at higher temperatures. Use of be- ryllium in lieu of steel saved perhaps 1000 pounds in the cumula- tive landing gear weight. The C-5A aircraft uses beryllium rotors and stators.

2

w 3

96

¶For the first 23 Orbiter flights, brake damage occurred to vary- ing degrees on 15 flights for a sum of 32 damaged brakes. Failure seemed to favor the right hand gear. A great majority of these damages were not necessarily associated with heavy demands. A very few were caused by approaching the design energy absorption. A case cannot be made against the heavy footed pilot. Regression analysis indicates that there are no significant trends that show brake damage is a function of energy demands within limits, peak demands, or landing weight. It appears that the brakes, relieved of asymmetric steering loads, will approach design energy absorption specifications for one landing but those specs are inadequate to cur- rent requirements for repetitive operations.

¶The primary source of failure is cracking and fragmentation damage arising from hot spots and chatter or dynamic loads from vibrations. It was conjectured that these can be worse if the brake is lightly used ("not tightly clamped"). The pilots were given the astounding instructions to never release a brake once applied be- cause if the brake is reapplied the loose fragments will destroy it and cause seizure.

¶From the history unfolded to the Commission and Committee in- vestigation, it is not difficult to understand why the landing gear system is marginal in today's operation. The original Orbiter design criteria were quite different and are in part:

Svstem Orieinal Orbiter Current Orbiter ~~~ ~~

¶Drogue chute ............................................... Primary deceleration..................................... Deleted. Nose wheel steering .................................... Asymmetric loads ......................................... Delete-emergency only. Tires ............................................................ One landing per tire ..................................... Same. Landing weight, abort (worst case) ...........225,000 Ib................................................... 240,000 Ib. Lightweight wheel brakes ........................... Emergency, drogue back up and final Primary deceleration and stop.

¶deceleration. Wheel brake life .....................................⁵⁵ bid. 0 %id. iNm.-The nozzle to case joint design is significantly different than the case field joint design w ich caused the Challenger accident. However, it is cited here because some of the prob- l e m are relevant to the failure of the aft field joint.] landings dynamometer certified ................Same.

(Typical: Bombers..............................................⁴⁰⁴⁰ Ibid., Chart 4-2. landings. Airliners...............................................¹⁰⁰¹⁰⁰ Ibid., pp. 583-84. landings 5 max landings.¹¹ For the purpose of this report, a procedure is a formal set of instructions designed to guide and assist in the performance of a technical or management function. g8 mid., July 24, 1986, p. 11. 1 9 9 Ibid., June 25, 1986, p. 52. emergency. (all without thrust reversal)

¶The whole operational load to decelerate, stop, and steer fell on what was originally the emergency backup brake system. The five landing design is impossible to fine tune to that degree and may yield only a design of imminent failure. It follows that every land- ing with the now increased normal and abort landing weights is a n engineered emergency. How much the increased demands and weight have intruded into the landing gear strut design factor of safety and margin are unknown, but certainly a concern.

¶In summary, weight savings and inability to retrofit. (i.e. larger tires and/or brakes) collided with the then state of the art result- ing in the normal high risk of landing being compounded. It is a tribute to the pilots that they were able to carry such a tender system this far. Redundancy of tires and wheels has never been design practice. A successful landing could be made with both tires and brakes gone from one side with a steerable nose wheel and la- terial stability from the opposite truck, if on a hard surface (con- crete). The lake bed and stabilized overrun zones would probably be another matter.

97

¶Testimony implies that full-time nose wheel steering and higher capacity brakes are a top priority requirement for return to oper- ations. Reference is made several times to a replacement 55 million foot pound all carbon brake in lieu of the 42 million foot pound carbon-beryllium brake. Rockwell International gave testimony that a 65 million foot lb. brake was in work.20 To maintain the equivalent BTU's per pound, the carbon brakes must peak at much higher temperatures. This poses a new stress on the temperature environment of the tires and wheels. Carbon brakes used on the Concorde, B747, 757, 767 and C-5B are said to be experiencing dy- namic failure modes. Carbon brake design has a better data base to work from than the beryllium but such a new brake will continue to be experimental and developmental in nature in the Orbiter ap- plication. Issue 2

¶What actions should be taken relative to other recurrent prob- lems with flight hardware? Finding

¶There have been many instances of in-flight anomalies and fail- ures of other elements of Space Shuttle hardware, some involving mission critical pieces of equipment. Some of these past problems have been corrected while others have not. Recommendation

¶NASA should ensure that before reinstituting Space Shuttle flight operations, it fully understands and has corrected all in- stances of serious in-flight anomalous behavior or failures involv- ing mission critical pieces of flight hardware. Discussion

¶Throughout the Space Shuttle program, there have existed a number of recurrent hardware problems in addition to those dis- cussed elsewhere in this report. Some have already been solved. For others, new hardware has been ordered that hopefully will re- solve the problem, while still other problems remain unsolved. Listed below are some examples of recurrent problems that have occurred with elements of Space Shuttle flight hardware:

¶Anomalous behavior of Space Shuttle Main Engine hydraulic actuators-on two occasions (STS-41D and STS-51F). This resulted in engine shutdown just prior to liftoff.

¶Numerous instances of failure of temperature and pressure sensors within Space Shuttle Main Engines-in one case (STS51F) this resulted in the premature shutdown of a good engine

¶2o Cmte H e , Transcript, July 15, 1986, p. 9.

98

during flight.21 (During some periods of the launch phase, this could result in ditching of the Orbiter at sea, with probable catastrophic results.) Frequent occurrence of cracks in turbine blades and sheet metal parts of Space Shuttle Main Engines, requiring that engine components be replaced often. Nonconsistent erosion performance of Solid Rocket booster nozzles-with one instance (STS-8) nearly resulting in a poten- tionally disastrous "burn through". Evidence of damage to Solid Rocket Booster nozzle O-rings in 13 of the 23 missions for which the booster sets were recov- ered.22 Malfunctions in the Solid Rocket Booster recovery system (e.g., parachutes)-with one occurrence (STS-4) resulting in the loss of a flight set of Solid Rocket Boosters. At least 48 instances of anomalous inflight behavior of the Auxiliary Power Units that drive the Orbiter's flight controls during launch and landing.23 In one case (STS-91, two auxilia- ry power units failed during landing, shutdown, and then ex- ploded several minutes after the Orbiter had come to a stop on the runway. Anomalous behavior or total failure of the General Purpose Computers on the Orbiter. Ejection of thermal insulation from the "intertank" region of the External Tank (i.e., the region between the liquid oxygen and liquid hydrogen tanks), causing tile damage on the Orbiter. Failures in the Orbiter's Thermal Protection System, includ- ing the loss of tiles, the disconnection of thermal blankets, and chemical decomposition of the "screed" layer beneath many tiles on the Orbiter Challenger. At least 63 instances of anomalous inflight behavior of the Reaction Control System that controls the flight orientation of the Shuttle while in orbit and during the initial stages of re- entry.24 At least 78 cases of anomalous inflight behavior of the com- munications and tracking equipment on board the Orbiter.25

¶Clearly, some of these problems are more serious than others, and as noted earlier, some have been solved. However, the Commit- tee is mindful of the conclusion of the Rogers Commission regard- ing the existence of similar situations for the Solid Rocket Motor prior to STS 51-L: "a careful analysis of the flight history of O-ring performance would have revealed the correlation of O-ring damage and low temperature."²² Rogers Commission Report, Volume I, p. 199. o bid., Chart SRB-4. 2 1 Larry Mulloy, NASA, Marshall Space Fli ht Center, "STS-51L Level I1 Flight Readiness Review,'' January 14,1986. See Appendix VIII-g. 2 2 Discussion with Allan McDonald, September 4, 1986. Z3 Rogers Commission Report, Volume 11. See Chart 15 (p. H-10) and Chart 19 (p. H-12). s Ibid., Chart 30 (p. H-18). 6 Also referring to Criticality I flight hard2 ' The two events mentioned in this and the preceding paragraph involving Main Engines on STS-51F were separated by 17 days, with the ad abort due to an actuator failure occurring on July 12, 1985, and the inflight abort due to a cfouble thermocouple failure occurring on July 29, 1985.

99

¶ware elements, the Commission recommended that, "NASA should establish a system of analyzing and reporting performance trends for such items."²⁷²⁷ bid., p. 201. Rogers Commission Report, Volume 11, p. F-2.

¶In a similar vein, Dr. Feynman observed:

The argument that the same risk was flown before with- out failure is often accepted as an argument for the safety of accepting it again. Because of this, obvious weaknesses are accepted again and again, sometimes without a serious attempt to remedy them, or to delay a flight because of their continued presence.

¶And,

The acceptance and success of these (previous) flights is taken as evidence of safety. But erosion and blow-by are not what the design expected. They are warnings that something is wrong. The equipment is not operating as ex- pected, and therefore there is a danger that it can operate with even wider deviations in this unexpected and not thoroughly understood way.

¶In the spirit of these observations, it would seem clear that NASA should make sure that it fully understands all past in- stances of inflight anomalies and failures involving critical ele- ments of hardware. Then, when appropriate, NASA should correct the underlying causes of these anomalies and failures.

¶c. Other Engineering Concerns Issue

¶What action should be taken relative to other engineering con- cerns regarding critical elements of Space Shuttle flight hardware? Finding

¶In recent years, serious engineering concerns have been raised regarding the safety of some elements of Space Shuttle flight hard- ware, such as the 17 inch flapper value and the heat exchanger feeding the liquid oxygen tank. Recommendation

1. NASA should ensure that, as a part of its current review of Space Shuttle safety, it identifies, thoroughly evaluates, and then takes appropriate action on all serious engineering concerns raised regarding mission critical elements of Space Shuttle flight hard- ware.

2. NASA should give special attention to both the cost and risks of using Filament Wound Case Solid Rocket Boosters for very heavy Space Shuttle payloads versus the cost and programmatic impacts of simply transferring those payloads to expendable launch vehicles.

100

¶Discussion

¶In the months since the Challenger accident, there has been re- newed interest in scrutinizing engineering concerns that have been raised in recent years regarding the safety of some elements of Space Shuttle flight hardware. Typical examples of some of these concerns involve the following pieces of equipment:

The 17 inch "flapper valves" on the fuel lines between the External Tank and the Orbiter. The inadvertent closing of one of these valves before Main Engine shutdown could be cata- strophic, causing a rupture of a fuel line and/or the External Tank. Failure to close after engine shutdown, on the other hand, could cause the External Tank to crash into the Orbiter after being jettisoned. The heat exchanger used to produce gaseous oxygen to pres- surize the liquid oxygen tank in the External Tank. This heat exchanger is located inside one of the turbopump preburners of the Space Shuttle Main Engine. Should a rupture occur in the wall of the heat exchanger, high temperature hydrogen gas could be driven into the liquid oxygen tank or additional oxygen could be driven into the preburner-either situation could be catastrophic. A solution to this problem could be to move the heat exchanger outside of the Main Engine, possibly using the engine's hydrogen cooling jacket as a source of heat to produce the required gaseous oxygen. The Filament Wound Case version of the Solid Rocket Boost- er now under development for use in launches involving very heavy Space Shuttle payloads. The Aerospace Safety Advisory Panel argues that this system may have questionable structur- al strength safety margins in the transition areas between in- dividual case segments.29 Safety concerns such as these have been raised regarding the Filament Wound Case Soild Rocket Boosters by the Aerospace Safety Advisory Panel for several years. In testimony before the Committee on May 15, 1986, Mr. John Brizendine, Chairman of the panel, repeated a conclusion from the panel's most recent report: "Until the issue can be re- solved with a high level of confidence, . . . the Filament Wound Case Solid Rocket Boosters should not be used for STS launch. . . ."30

¶Regarding the last concern in the above listing, the Committee notes that the recent decisions to substantially delay the availabil- ity of the Space Shuttle launch facilities at Vandenberg Air Force Base and to increase the availability of expendable launch vehicles could potentially eliminate the need for Filament Wound Case Soild Rocket Boosters. Specifically, the Filament Wound Case Solid Rocket Boosters were originally intended only for use at Vanden- berg; and the increased availability of large expendable launch ve- hicles may provide a viable option to heavy-lift launches using the Space Shuttle.²² Rogers Commission Report, Volume I, p. 199. o bid., Chart SRB-4. 2 1 Larry Mulloy, NASA, Marshall Space Fli ht Center, "STS-51L Level I1 Flight Readiness Review,'' January 14,1986. See Appendix VIII-g. 2 2 Discussion with Allan McDonald, September 4, 1986. Z3 Rogers Commission Report, Volume 11. See Chart 15 (p. H-10) and Chart 19 (p. H-12). s Ibid., Chart 30 (p. H-18). 9 Hearings before the Space Science and Applications Subcommittee of the House Science and Technolo Committee, "Strategy for Safely Returning Space Shuttle to Flight Status," 99th Cong., 2nySeas., Transcript, May 15, 1986, p. 102.

¶mid.

101

¶The current requirement for preeminent emphasis on Space Shuttle flight safety obviously necessitates that all major engineer- ing concerns such as those listed above should be identified, thor- oughly scrutinized, and appropriately acted upon.

¶d. Desirable Tests Not Yet Approved Issue 1

¶Is the current ground test program for the SSME adequate to provide a complete understanding of the engine's operating charac- teristics and safety margins? Findings

1. The Committee supports the Findings and Conclusions of the Development and Production Team concerning the SSME, particu- larly the concern that "Hardware availability and the potential of damage to hardware and facilities resulting from tests malfunc- tions have constrained . . . [full margin] . . . testing during the ground test program."

2. The Committee shares Dr. Feynman's concern that there has been a slow shift toward decreasing safety in the SSME program.

3. There is not a sufficient understanding of SSME blade cracks and fractures. Recomrnendations

4. The Committee concurs with the Development and Production Team conclusion that over testing, limits testing, and malfunction testing in the SSME program should be re-emphasized to demon- strate full engine ~ a p a b i l i t y . ~ ~

5. NASA should prepare and submit to the Committee a cost- benefit analysis of testing a SSME to destruction including: (a) uti- lizing additional SSME test stands; (b) utilizing additional hard- ware for the ground test program; and (c) the value of such a test.

6. A vigorous study of fracture behavior should be conducted to minimize the hazard of cracked SSME blades and to increase the reliability and safety margin of blades. New blades and/or new policies for duration of blade use should be incorporated prior to the next Shuttle flight. Discussion

¶The development and operation of the SSME is a remarkable achievement and represents the leading edge of technology in large liquid hydrogedliquid oxygen rocket engines. Great attention to detail was emphasized by engineers at both Rocketdyne and Mar- shall as well as timely recognition and resolution of technical prob- lems.33 Despite intense oversight, individuals privately speculated, prior to the 51-L accident, that if an accident were to occur it would probably be the result of an SSME failure simp17 because of the uncertainties innate to a technology pushing the 'edge." This awareness of the uncertainties promoted high quality engineering and contributed to the success of the SSME program unlike the ap3' Rogers Commiasion Report, Volume 11, p. K-32. S2 Ibid. s3 Ibid.

102

¶parent complacent attitude toward the mature solid rocket technol- om.

¶Volume I1 of the Rogers Commission Report analyzes in great detail the development, production and operation of the SSME.34 The Commission's Findings and Conclusions regarding the SSME are appropriate. However, the Committee feels that even more rig- orous testing of the main engine is necessary to ensure that safety margins and hardware reliability are not compromised.

¶For example, Commission member Dr. Feynman notes that the "top-down"³³ NASA, "Report to the President Actions to Implement the Recommendations of the Presi- dential Commission on the Space Shuttle Challenger Accident," July 14, 1986. (Hereafter r e ferred to as NASA Response to Rogers Commission.) s bid.. Chart 3-1. 5 approach used to design the SSME has made it diffi- cult and expensive to discover the causes of component and subsys- tem problems. Specifically, Dr. Feynman writes that NASA and Rocketdyne (the SSME prime contractor and a division of Rockwell International), do not have a relatively precise knowledge of when a turbine blade is likely to crack, how quickly a crack will grow to fracture, and under what various rated power levels these phenom- ena will occur.37

¶Mr. Jeffs, President, North American Space Operations, Rock- well International, described the blade problem and explained Rocketdyne's testing efforts to improve blade life and minimize blade cracks and fractures.

¶. . . we are working the blades and bearing problems and have been for some time.

¶We have given ourselves confidence in flying the engine with those kinds of blades through off-limit testing. We've taken the worst cracked blades we could possibly find and run them in engines to see if we could make those cracks grow. We have not been able to do so. At the same time, it's not satisfactory for us to continue in the long-term flying cracked blades, and that's why we're putting so much effort on fixing those blades. I believe that we should have fixes for those blades before the next flight.

¶. . . the blades on the engines . . . I hedge a little bit on exactly when we can incorporate those into the vehicle. I believe we can do it by the 1988 period, but it's going to take a lot of certification testing. . .³³ NASA, "Report to the President Actions to Implement the Recommendations of the Presi- dential Commission on the Space Shuttle Challenger Accident," July 14, 1986. (Hereafter r e ferred to as NASA Response to Rogers Commission.) s bid.. Chart 3-1. 8

¶During staff discussions with NASA personnel, the issue of SSME destruction testing arose. Some NASA personnel expressed the desire to test a n SSME to destruction, but noted the lack of test stands and hardware.39 Curentl , NASA and Rocketdyne have

¶I three test stands. Some individua s privately noted that the SSME program should have four or five test stands to run and engine to destruction, to test product improvements, for flight support and anomaly resolution, and for acceptance tests of hardware. Others have explained that it is not necessarily the number of test stands that is the key to a successful SSME program, but rather the

¶3 4 Ibid., pp. K-23 through K-27; K-31.

103

¶amount of hardware available to feed the test stands. The Rogers Commission found that:

The number of engine test firings per month had de- creased over the past two years. Yet this test program has not yet demonstrated the limits of engine operation pa- rameters or included tests over the full operating envelope to show full engine capability. In addition, tests have not yet been deliberately conducted to the point of failure to determine actual engine operating margins.40

¶In addition, Dr. Feynman said:

Using the completed engine as a test bed to resolve such questions is extremely expensive. One does not wish to lose entire engines in order to find out where and how failure occurs. Yet, and accurate knowledge of this information is essential to acquire a confidence in the engine reliability in use. Without detailed understanding, confidence can not be attained.4

¶There has been some concern raised about the value of testing a n SSME to destruction. It is important that engine testing simulate flight as closely as possible so that information learned in testing can readily be applied to actual flight engines. For example, run- ning a n engine longer than a n actual flight may not be useful in understanding what effects starting and stopping have on lifetimes of engine components, such as turbine blades. However, damaging or destroying a n engine while testing components under flight con- ditons will yield valuable information. Consequently, it is impor- tant for NASA and Rocketdyne to aggressively test components to their design life even at the expense of a ground failure. It is un- derstandable that the 51-L accident may have resulted in a more conservative SSME ground test program in terms of a fear of fail- ure. However, if safety is to be the prime consideration in the STS program, then there has to be the freedom to fail in order to learn. It is far better to lose a n engine on the ground than in flight. Issue 2

¶Is the leak/combustion threat of the External Tank's hydrogen pressure valve a hazard warranting testing? Findings

1. The Committee supports the Rogers Commission concern re- garding the hazard posed by the liquid hydrogen vent and relief valve.42

2. The Committee suports the intent of the ET prime contractor, Martin Marietta, to pursue outdoor wind tunnel testing to elimi- nate the liquid hydrogen vent/relief valve h a ~ a r d . ~

¶4o Rogers Commission Report, Volume I, p. 192. 4L Ibid., Volume 11, p. F-2.⁴⁴ Rogers Commission Report, Volume 1 1, p. H-1. 2 Ibid., Volume I, pp. 192-93.⁴⁴ Rogers Commission Report, Volume 1 1, p. H-1. 3 Ibid., Volume 11, p. K-23.

104

¶Recommendation

¶NASA, in conjunction with the appropriate contractor, should consider designing and conducting an ET liquid hydrogen leak/ burn test to determine if corrective actions should be taken prior to the next Shuttle flight. Discussion

¶The Rogers Commission identified the hazard posed by the par- tially open vent/relief valve on the ET's liquid hydrogen tank. This valve can indicate it is closed when, in fact, it might be partially open. A liquid hydrogen leak and subsequent combustion could result in the loss of vehicle and crew.44 There are two ways of de- termining if the valve is closed. While both are highly accurate, neither can adequately assure closure. To date,

. . . no test has been permitted to leak and burn hydro- gen in a wind tunnel and analytical methods of determin- ing the heating rates associated with leaking hydrogen gas into the 1.5-foot thick boundary layer of External Tank are recognized by the analyst to be inadequate and inconclu- sive.

¶During the Commission investigation representatives of Martin Marietta stated a concern for the vent/relief valve leak hazard and indicated an intent to pursue outdoor wind tunnel testing.46 Issue 3

¶Does the present Range Safety System (RSS) on the External Tank present an unreasonable risk? Finding

¶There is substantial controversy over the relative benefits and risks of the present RSS on the External Tank. Recommendation

¶The Committee believes the Administrator should prepare and submit to the Committee a comprehensive review of RSS require- ments. Discussion

¶There has been considerable discussion through the years about the advantages and disadvantages of having a Range Safety System (RSS) radio controlled destruction device on the External Tank.

¶There have been recorded instances of spacecraft being struck by lightening during the launch.47 A t least some of the astronaut corps feel strongly that the ET RSS creates an unnecessary risk to the crew.

¶The Committee has been informed that the ET RSS was included during the design phase because of a range safety requirement.

105

¶The question that should be asked is: "DOthe relative risks.and ad- vantages of an ET RSS justify its inclusion as a part of the STS?"

¶Therefore, the Committee believes that as part of an overall review of safety requirements, the Administrator should ensure that NASA and the appropriate Air Force officials responsible for range safety requirements review RSS requirements as they apply to the ET.

¶e. Production/Refurbishment Issues Issue 1

¶Should 100 percent X-ray inspection of the propellant and insula- tion for the Solid Rocket Motors (SRM) be resumed? Findings

1. Previous X-ray inspections led to only one SRM being rejected for Shuttle use.

2. There is no non-destructive inspection method which can guarantee a defect-free SRM. X-ray inspection cannot detect "kiss- ing" voids in which the SRM insulation is touching the SRM steel casing but is not bonded to it. Debonded insulation at the end of an SRM segment could provide burning propellant gases with a path to the SRM steel casing and could result in loss of vehicle and crew. X-ray inspection can detect propellant cracks and large voids which if undetected could also result in a catastrophic situation.

3. Although there is no guarantee that X-ray inspection has been a particularly effective method of detecting propellant and insula- tion SRM flaws, it remains one of the best available methods to monitor the SRM manufacturing process, Recommendations

4. NASA should consider reinstating full X-ray inspection of the propellant and insulation for all motors used on succeeding flights until new, more accurate inspection methods can be devel- oped and implemented and there is unquestionable confidence in the SRM production process.

5. NASA, in conjunction with the appropriate contractors, should investigate the development of new, more accurate inspec- tion techniques which can detect "kissing" voids and other poten- tial defects that cannot be detected by X-ray inspection. Discussion

¶While the 51-L accident has focused attention on the design of the SRM joint, the explosion of a Titan 34D rocket on April 18, 1986, has focused attention on the production and inspection proc- esses of the SRM. Evidence has shown the Titan failure was caused by a "thermal insulation coating that pulled away from inside one of the two Solid Rocket Booster motors, allowing hot propellants to burn through the rocket's outer casing" nine seconds after being fired from Vanderberg Air Force B a ~ e . ~ 8

106

¶The Titan Solid Rocket Motors receive only visual inspection of bond lines and local ultrasonic inspection as required.

¶While there are some significant differences between the Shuttle SRB and the Titan motor, the design of the Shuttle SRB was pri- marily based on the Air Force's Titan I11 solid rocket.4g Also, the design of the insulation on the Shuttle booster is virtually identical with the Titan design.50 Brig. Gen. Nathan Lindsay, Chairman of the Air Force board investigating the accident said, "This was a failure we would have assigned a very low probability $0. We've flown 70 flights with the [Titan] Solid Rocket Motor and this was the first failure." l

¶The Shuttle SRB has flown 25 flights with one unrelated failure. In testimony before the Rogers Commission, NASA officials "made it clear that the kind of separation of insulation that apparently led to the destruction of the Air Force Titan 34D was commonplace on the Shuttle."⁵⁵ bid. 0 %id. iNm.-The nozzle to case joint design is significantly different than the case field joint design w ich caused the Challenger accident. However, it is cited here because some of the prob- l e m are relevant to the failure of the aft field joint.] 2 According to NASA officials, it was also common practice to visually inspect and repair unbonded insula- tion of the SRM end segments.53

¶Full X-ray inspection was conducted on all SRM segments used in the demonstration and qualification programs and the first five Shuttle flights. Full X-ray inspection of these early motors was re- quired as part of the development and verification plan, and was scheduled for reassessment after the flight of STS-5. During this period 24 motors were fully X-rayed. Three demonstration center motor segments exhibited excessive voids in their propellant, but only one segment was rejected. Studies established the voids were due to low casting rate and the method of dispersing propellant into the segments. As a result controls were implemented and veri- fied by X-ray inspection. It was also discovered during this time that an SRM segment of the size required for the Shuttle could contain 12,000 voids and be fired successfully without threat to the mission, vehicle or crew.

¶After evaluation of data from the SRM segments used up through STS-5 and data from military Solid Rocket Motors, NASA's confidence in the SRM production process was such that the SRM X-ray policy was changed. A cost-benefit analysis also contributed to this decision. Beginning with STS-6, X-ray inspec- tion was only conducted on all aft segments in the propellant hand- trimmed area and the segment produced following the identifica- tion of a process anomaly, process change, or design change. X-ray inspection of the aft segments in the propellant hand-trimmed area was continued because data indicated that only 3 percent of a seg- ment's insulation had to be bonded, particularly the ends, in order of the segment to burn properly and safely. In October of 1985 NASA implemented a recommendation from the Aerospace Adviso- ry Panel to change its X-ray policy to include random inspection of one SRM segment per month. Because of a SRM production lead

¶48 Rogers Commission Report, Volume I, p. 121.

¶JODavid E. Sanger, "Flaw in Titan's Boosters is Identified," the New York Times, June 4, 1986, p. A-23.⁵⁵ bid. 0 %id. iNm.-The nozzle to case joint design is significantly different than the case field joint design w ich caused the Challenger accident. However, it is cited here because some of the prob- l e m are relevant to the failure of the aft field joint.] 1 Isikoff, pp. A-1, A-20.⁵⁵ bid. 0 %id. iNm.-The nozzle to case joint design is significantly different than the case field joint design w ich caused the Challenger accident. However, it is cited here because some of the prob- l e m are relevant to the failure of the aft field joint.] 2 Sanger, p. A-23 time of approximately eight months, no SRM segment inspected under this new policy was flown before the 51-L accident.54

107

¶X-ray inspection, while the best available method to detect Rro- pellant voids and cracks, cannot detect so-called "kissing voids m which the insulation is touching but not bonded to the SRM steel casing. Staff discussions with NASA personnel revealed that other inspection methods are being analyzed. Thermography and accous- ticolography techniques could both be used to detect voids and un- bonded insulation. These techniques may not be refined enough to use on the boosters flown on the next Shuttle flight. However, a mechanical pull test should be available to test the new motors to ensure that insulation is bonded to the SRM steel casings prior to pouring the propellant. In addition, NASA will reinstate its initial 100 percent full X-ray policy which applied to the earlier demon- stration motors and first five flights. According to NASA officials the continued use of X-ray inspection once Shuttle flights have re- sumed will depend upon success of the new SRM design and devel- opment of new inspection techniques. Issue 2

¶Are all production and other activities involving Criticality 1 and 1R hardware at prime and secondary contractor facilities labeled as "critical" processes? Findings

1. Critical processes are formally identified and controlled by NASA. All processes are classified and controlled by the contrac- tor's Process Change Control Board.55

2. The O-ring used in the case joint is critical to the sealing in- tegrity of the joint, et it is not designated as a "critical process by

¶B either the Parker eal Co. or Hydrapack, the manufacturer and supplier re~pectively.~ This raises the possibility that other Criti- cality 1 and 1R hardware components are also not appropriately designated by their manufacturer as "critical" processes. Recommendations

1. NASA should require the manufacture of critical items, such as the O-rings, to be designated "critical" processes. Contractors should formally notify their employees involved in critical manu- facturing processes of the serious nature of particular production processes.

2. NASA should conduct a thorough review to ensure that all manufacturing processes involving Criticality 1 and 1R hardware components of prime and secondary contractors are appropriately designated "critical" processes. Discussion

¶"Critical processes are formally identified and controlled by NASA. All processes are classified and controlled by the contrac- tor's Process Change Control Board." 57 Failure of Criticality 1 and

108

¶1R components or systems will result in loss of vehicle and/or crew. The Commission's investigation revealed that the O-ring used in the case joint, whose failure led to the destruction of 51-L, was not designated a critical NASA personnel explained that O-ring production was not so classified because final O-ring inspec- tion occurred at KSC.

¶NASA's safety, reliability and quality assurance (SR&QA) philos- ophy is that you cannot inspect quality into products, rather you must build it in. It is questionable, then, why NASA would choose to rely solely upon O-ring inspection for quality control and not emphasize the criticality of the O-ring production process to the 0- ring manufacturers and their employees.

¶While the O-ring manufacturing process did not contribute to the 51-L accident, the fact that such a critical item was not designated a critical process raises the possibility that other critical items may not be so designated. Identifying critical processes and educating contractors and subcontractors about critical items and manufac- turing processes would be in line with NASA's policy of building in quality and safety. Issue 3

¶Do O-ring repairs compromise safety? Finding

¶The Committee supports the Development and Production Team Finding and conclusion that the "limit of five repair joints per O-ring is an arbitrary number" and that "repair of inclusions and voids in the rubber . . . appears to be an area of potential problem." Recommendation

¶NASA should review its O-ring repair policy and contractor repair practices in terms of their effects on O-ring performance and safety. Such review should be completed prior to the resumption of Shuttle flights if, as anticipated, the new SRB joint design uses O-rings. Discussion

¶The NASA/Commission Development and Production Team questioned the adequacy of the SRM joint O-ring process and qual- ity control. According to the D&P Team, "the O-ring is allowed to include five scarf joints, a quantity which is arbitrarily established, and repairs of inclusions and voids are routinely made by the vendor after receipt of the material supplies".6 Issue 4

¶What impact does growth of SRM case size have upon booster and Shuttle performance and safety?

109

¶Finding

¶The Committee concurs with the Development and Production Team Finding that "Remeasurement of two used $RM case seg- ments indicated both tang and clevis sealing surfaces have in- creased in diameter beyond the anticipated design limits." 6 2 Recommendation

¶NASA and the appropriate contractor should rqsolve through analysis and testing prior to the next Shuttle flight the cause of SRM case size growth and its impact upon booster and Shuttle per- formance, reliability of refurbished SRM case segments, and safety. Discussion

¶During the investigation of the 51-L accident, the NASA/Com- mission D&P Team "determined by measurement of two flown case segments that both the SRM tang and clevis sealing surfaces have increased in diameter beyond the anticipated design limits. The growth is believed to be material related and related to the hydro- static proof test pressure level." 6 3 f. Review of NASA's RedesigniRecertification Plan Issue

¶Is NASA's SRM redesign and hardware recertification plan a viable and realistic one which will result in a safer, more reliable Space Transportation System? Findings

1. NASA's SRM redesign plan is a step in the right direction. Moving the proposed launch date beyond June 1987 is a responsible and realistic decision. The membership of the SRM Redesign Team is representative of qualified individuals in and outside of NASA. With the expert assistance of the specially appointed National Re- search Council (NRC) Independent Oversight Group, the new SRM design should be a significantly safer and more reliable Shuttle ele- ment.

2. NASA's current hardware recertification plan is also a step in the right direction. The use of independent review contractors dis- tinguishes this recertification plan from earlier reviews. However, given the failure of previous reviews to discover the deficient SRB joint certification, the Committee is concerned there is still the pos- sibility that the recertification effort may not reveal other certifica- tion deficiencies, if indeed they exist. The plan also raises concern about the qualifications of independent reviewers to evaluate cer- tain elements given the uniqueness of particular Shuttle compo- nents.

3. The joint was never fully tested as a separate element of the SRM. The various forces that act on the joint during stacking, launch, and flight are difficult, if not impossible, to duplicate in a test of the joint under all conditions that could be experienced during launch and flight.

¶e2 Ibid., p. K-31. O3 Ibid.,p. K-3.

110

4. It is unclear what function the new Safety Office will perform in the redesign of the SRB field joint and other critical elements of the Shuttle, as well as NASA's recertification plan. Recommendations

5. The Committee recognizes the national need to return the Shuttle to flight status as soon as reasonably possible. As noted in NASA's July 14, 1986, report to the President, safety will deter- mine the launch schedule. However, NASA should consider the proposed launch date of early 1988 as a flexible one which should be slipped further if necessary. The Shuttle should not be launched again until NASA can assure that safety criteria have been met.

6. In establishing a test program to certify the new Solid Rocket Motor design, NASA should consider the feasibility of including in combination and in the proper sequence all of the thermal and structural loads expected to be experienced by the Solid Rocket Motor during ignition, lift-off, and flight.

7. The independent review contractors participating in the hard- ware recertification plan should utilize sufficient specific technical expertise to insure adequate recertification of all elements of the STS.

8. The Committee requests that the new Office of Safety, Reli- ability and Quality Assurance conduct an independent assessment of the SRB field joint redesign efforts. In addition, the new office should also be integrally involved in reviewing all other critical component redesign efforts and NASA's recertification plan. Discussion

¶The "Strategy for Safely Returning the Space Shuttle to Flight Status" includes the plans to redesign the SRM joint, reverify hardware design requirements, and to completely review all "criti- cal" items. This strategy was proposed March 24, 1986, by Admiral Truly, the Associate Administrator for Space Flight and supple- ments the Rogers Commission's recommendations. 6 4

¶The redesign of the SRM joint is being conducted and supervised by a cross section of competent and qualified individuals from NASA centers, including Marshall Space Flight Center, the Astro- naut Office, and individuals from outside NASA. An expert adviso- ry panel of 12 people, six from outside NASA, has also been ap- pointed. Further, at the request of the NASA Administrator, the National Research Council has established an Independent Over- sight Group which reports directly to the Administrator. (See Ap- pendix VI-B.)

¶To date, "many design alternatives have been evaluated, analy- ses and tests have been conducted, initial verification plans have been established. and overall schedules have been developed."6 In addition to desibing a new joint that will use existing hardware, an alternate design that does not use current hardware is also un- derway. Study contracts have been let to five companies to inde- pendently develop new designs and review current baseline ideas and tests already conducted by NASA.

¶NASA Response to Rogers Commission, July 14, 1986, pp. 37-40.

¶bid., p. 12.

111

¶In 1985, as joint problems continued with the Solid Rocket Motors, NASA recognized the need for a design that would limit the rotational movement between the joint tang and clevis that occurs at motor ignition. NASA was embarking on the design of a Filament Wound Casing which would have the advantage of allow- ing for an increase in payload. Since a new design was called for, it was to NASA's advantage to correct some of the joint problems at this time. In the new design, to reduce the rotational movement in the joint, a hook was added to the inner leg of the clevis. This would significantly limit any change in the spacing gap between the tang and the clevis in the area where the O-rings are installed. Shortly thereafter, Thiokol, on its own initiative, ordered new forg- ings which were thicker in the tang area so that the capture fea- ture could be machined into the casing. The hook has become know as the "capture feature". In August of 1985, however, the capture feature then under consideration was significantly different than current joint designs with the capture feature. Some of these differ- ences include the presence of a third O-ring, the addition of a second pressure test port, the adoption of an interlocking design for the case insulation in the vicinity of the joint, and the removal of all putty from the joint.

¶The new design, however, with the capture feature, appears to complicate the stacking operations and could increase the potential for damage, particularly leading to the creating of metal silvers during mating operations.

¶The hardware recertification plan appears to be a thorough ap- proach to verifying that components meet design requirements. The recertification plan involves three levels of review to be con- ducted by: (1)NASA personnel; (2) current Shuttle contractors; and (3) independent contractors.

¶A major concern about the thoroughness of the hardware recerti- fication plan was expressed by Mr. Nelson:

. . . looking back on how the whole system functioned we found out that there were a whole bunch of people in- volved in the SRB design and the certification process. There were the internal groups at Thiokol; there was the oversight by Marshall; there was a through review by an outside group, headed by Dr. Williams; there was the Aerospace Safety Advisory Panel; there was the certifica- tion process and signing off, [not only for the test flights] but for the first Shuttle flight, STS-1; and then there was that same certification process and signing off again that occurred before STS-5. Now, still all of those problems went undetected by so many groups.

¶A more detailed discussion of previous hardware certification is in Section VI-A.1.a. of this report.

¶Mr. Nelson further asked how this plan could provide confidence that it is relatively safe to fly again.

¶Be Cmte Hgs, Transcript, July 15, 1986, p. 95.

112

¶The use of independent contractors distinguishes this recertifica- tion plan from previous ones. Mr. Davis, President, Martin Mariet- ta Michoud Aerospace, said:

. . . some of the things that are being done differently . . . I think will help . . . Marshall Space Flight Center has contracted with other companies for independent FMEA/ CIL assessments of their hardware. In particular, Rockwell

¶is doing a total independent assessment of my External

¶Tank hardware, and I think that's well looked-to. I look to their expertise to question everything we did and maybe give us some advice on how to make it better.67

¶Mr. Murphy, Executive Vice President and General Manager, United Technology Booster Production Company, commented:

¶I think one of the things that is going to prevent a recurrence of what happened in the past, as far as oversight committees are concerned, is that we have come a long ways since the initial certification of the program. We now have advanced analytical tools which were not available before. We also have the flight environments for the 24 sucessful flights; it gives us a true indication of what the environment is that we're going to be facing. Plus, again, the environment of the whole aerospace industry has changed dramatically since 51-L. And all of these, I think, will be taken into consideration and will provide the oversight and the proper review of items that never occurred before. ti

¶Mr. Murphy explained how his company will recertify the new SRB design:

¶The recertification has three primary elements which follow a logical progression of evaluation. First, we will reestablish the basic design requirements from Level I1 and

¶Level 111. Second, we will establish a verification program based upon those requirements. And third, we will reestablish that the design and the hardware are in compliance with the first two elements.

¶Key activities to be performed as we recertify the SRB will include the traceability of all the requirements into all levels of SRB design and system environments, verification of the SRB design data base and analyses, establishment of tools such as the failure modes and effects analysis, and validation that our paper systems have properly incorporated requirements, constraints, and criteria.6g

¶Another distinction of this plan is that hardware will be com- pletely recertified through actual testing and analysis as if it were being done for the first time. Some earlier certification reviews were abbreviated paper checks many of which focused on only cer- tain components.

¶87 Ibid., p. 96.

¶Ibid., p. 98.⁵⁵ bid. 0 %id. iNm.-The nozzle to case joint design is significantly different than the case field joint design w ich caused the Challenger accident. However, it is cited here because some of the prob- l e m are relevant to the failure of the aft field joint.] 9 Ibid., p. 50.

113

Mr. ROE.. . . we're talking, where at all possible, actual field testing. Do you concur with that approach? . . . Mr. DAVIS. Yes, I'd say I agree with that. As a matter of fact, I believe that's what all the program contractors, are out doing at this point.'O

¶The use of independent review contractors is a necessary and critical component of the recertification plan. However, a legiti- mate concern has been raised by the current contractors and Com- mittee staff regarding the ability of independent contractors to review technologies and components for which they may have lim- ited expertise. For example, solid and liquid rocket propulsion has often been referred to as a "black art" for which there are few ex- perts. NASA has contracted with Martin Marietta to independent- ly review the SRB and SRM certification. Understanding the uniqueness of rocket propulsion, Martin Marietta has supplement- ed their in-house talent with outside experts to assist in the certifi- cation review.

¶The complete review of the Critical Items List (CIL), Hazard Analyses (HA), and Failure Modes and Effects Analyses (FMEA) is in response to the Rogers Commission's third recommendation and is intended to identify those items that must be improved prior to flight, and to affirm the completeness and accuracy of each FMEA/ CIL for the current NSTS design. This is the first such review since the system was originally instituted at the beginning of the NSTS program and involves, according to NASA, many man-hours of effort and a very large staff. Supporting this effort are independent contractor reviews of the various FMEAICIL activities associated with each major component and system of the National Space Transportation System. There are six such activities. These in- clude, in addition to the four major subsystems that comprise the Shuttle (Orbiter, Solid Rocket Booster, Space Shuttle Main Engine, and the External Tank), the Vandenberg Launch Site and the Ken- nedy Space Center operations. The re-evaluation is scheduled to be completed by March 1987. It will involve all levels of NASA man- agement, with auditing and oversight functions to be provided by outside personnel from the Aerospace Safety Advisory Panel and the National Research Council in accordance with the recommen- dations of the Rogers Commission.

¶A reconsideration of the level of design center involvement (i.e., the field centers that are responsible for designing various compo- nents of the Shuttle) in equipment processing or systems processing is required. The establishment of a n Office of Safety, Reliability and Quality Assurance under a separate Associate Administrator should lead to improvements or a n increase in the audit activities associated with the overall development and production process ac- tivities within the program. A systems design review that is pres- ently underway within NASA has led to some 70 or 80 items over and above the CIL review that have been brought to the attention of Level I1 as potential problem areas.71

¶70bid., pp. 59-60. 71 Discussion with NASA officials, Washington, D.C., July 10, 1986.

114

¶Program management at Level I1 has requested a complete audit of the problem reporting system in order to assure that only priori- ty issues are elevated to the Level I1 status for review. NASA sug- gests the problem has been that too many items of lower categori- zation than Criticality 1 or 1R have been brought up to Level I1 and have swamped the ability of this management level to ade- quately analyze Criticality 1 items.

¶The new office of Safety Reliability and Quality Assurance is now operational. It is the view of the new Associate Administrator that the role of the SR&QA office will be to assure that modifica- tions to the SRB field joint design, are extensively reviewed during the processes of development, fabrication and testing.72 It is the plan of this office to establish a position at headquarters to review the configuration management system that presently operates across the National Space Transportation System. It is also a goal of the Associate Administrator to establish and improve lines of communication among the various NSTS elements in order to im- prove component integration and information interfacing among the various elements of the Shuttle.

¶The Committee is fully aware that faulty designs, improper fabri- cation techniques and component certification efforts can only be detected and identified through the implementation of proper qual- ity control methods and procedures. The task of the NSTS program managers and the contractors is to assure that the quality is built into the design and production of Shuttle hardward. Nevertheless, the Committee also recognizes that the highest level of quality con- trol methods and reliability engineering must be applied to all phases of the Shuttle production process, utilizing the latest state- of-the-art techniques of testing and analyses.