10.7 ORBITER CORROSION

¶Removing and replacing Thermal Protection System tiles sometimes results in damage to the anti-corrosion primer that covers the Orbitersʼ sheet metal skin. Tile replacement often occurs without first re-priming the primed aluminum substrate. The current repair practice allows Room Temperature Vulcanizing adhesive to be applied over a bare aluminum substrate (with no Koropon corrosion-inhibiting compound) when bonding tile to the Orbiter.

¶A video borescope of Columbia prior to STS-107 found corrosion on the lower forward fuselage skin panel and stringer areas. Corrosion on visible rivets and on the sides and feet of stringer sections was also uncovered during borescope inspections, but was not repaired.

¶Other corrosion concerns focus on the area between the crew module and outer hull, which is a difficult area to access for inspection and repair. At present, corrosion in this area is only monitored with borescope inspections. There is also concern that unchecked corrosion could progress from internal areas to external surfaces through fastener holes, joints, or directly through the skin. If this occurs beneath the tile, the tile system bond line could degrade.

¶Long-Term Corrosion Detection

¶Limited accessibility renders some corrosion damage difficult to detect. Approximately 90 percent of the Orbiter structure (excluding the tile-covered outer mold line) can be inspected for corrosion.25 Corrosion in the remaining 10 percent may remain undetected for the life of the vehicle.

¶NASA has recently outlined a $70 million, 19-year program to assess and mitigate corrosion. The agency fore- sees inspection intervals based on trends in the Problem Resolution and Corrective Action database, exposure to the environment, and refurbishment programs. Development of a correlation between corrosion initiation, growth, and environmental exposure requires the judicious use of long-term test data. Moreover, some corrosion problems are uncovered during non-corrosion inspections. The risk of undetected corrosion may increase as other inspections are removed or intervals between inspections are extended.

222

¶Observations: 10.9 HOLD-DOWN POST CABLE ANOMALY

¶O10.7-1 Additional and recurring evaluation of corrosion

damage should include non-destructive analysis of the potential impacts on structural integrity.

¶O10.7-2 Long-term corrosion detection should be a funding priority. O10.7-3 Develop non-destructive evaluation inspections to find hidden corrosion. O10.7-4 Inspection requirements for corrosion due to

environmental exposure should first establish corrosion rates for Orbiter-specific environments, materials, and structural configurations. Consider applying Air Force corrosion prevention programs to the Orbiter.

¶10.8 BRITTLE FRACTURE OF A-286 BOLTS

¶Investigators sought to determine the cause of brittle fractures in the A-286 steel bolts that support the wingʼs lower carrier panels, which provide direct access to the interior of the Reinforced Carbon-Carbon (RCC) panels. Any misalign- ment of the carrier panels affects the continuity of airflow under the wing and can cause a "rough wing" (see Chapter 4). In the end, 57 of the 88 A-286 bolts on Columbiaʼs wings were recovered; 22 had brittle fractures. The fractures occurred equally in two groups of bolts in the same locations on each wing. Investigators determined that liquid metal embrittlement caused by aluminum vapor created by Columbiaʼs breakup could have contributed to these fractures, but the axial loads placed on the bolts when they separated from the carrier panel/box beam at temperatures approaching 2,000 degrees Fahrenheit likely caused the failures.

¶Findings:

¶F10.8-1 The present design and fabrication of the lower

carrier panel attachments are inadequate. The bolts can readily pull through the relatively large holes in the box beams.

¶F10.8-2 The current design of the box beam in the lower

carrier panel assembly exposes the attachment bolts to a rapid exchange of air along the wing, which enables the failure of numerous bolts.

¶F10.8-3 Primers and sealants such as Room Temperature

Vulcanizing 560 and Koropon may accelerate corrosion, particularly in tight crevices.

¶F10.8-4 The negligible compressive stresses that normally occur in A-286 bolts help protect against failure.

¶Observations:

¶O10.8-1 Teflon (material) and Molybdenum Disulfide

(lubricant) should not be used in the carrier panel bolt assembly.

¶O10.8-2 Galvanic coupling between aluminum and steel alloys must be mitigated. O10.8-3 The use of Room Temperature Vulcanizing 560 and Koropon should be reviewed. O10.8-4 Assuring the continued presence of compressive

stresses in A-286 bolts should be part of their acceptance and qualification procedures.

¶Each of the two Solid Rocket Boosters is attached to the Mobile Launch Platform by four "hold down" bolts. A five- inch diameter restraint nut that contains two pyrotechnic initiators secures each of these bolts. The initiators sever the nuts when the Solid Rocket Boosters ignite, allowing the Space Shuttle stack to lift off. During launch, STS-112 suffered a failure in the Hold-Down Post and External Tank Vent Arm Systems that control the firing of initiators in each Solid Rocket Booster restraint nut. NASA had been warned that a recurrence of this type of failure could cause catastrophic failure of the Shuttle stack (see Appendix D.15).

¶The signal to fire the initiators begins in the General Purpose Computers and goes to both of the Master Events Controllers on the Orbiter. Master Events Controller 1 communicates this signal to the A system cable, and Master Events Controller 2 feeds the B system. The cabling then goes through the T–0 umbilical (that connects fluid and electrical connections between the launch pad and the Orbiter) to the Pyrotechnics Initiator Controllers and then to the initiators. (There are 16 Pyrotechnics Initiator Controllers for Hold Down Post Systems A and B, and four for the External Tank Vent Arm Systems A and B.) The Hold Down Post System A is hard-wired to one of the initiators on each of the four restraint nuts (eight total) while System B is hard-wired to the other initiator on each nut. The A and B systems also send a duplicate signal to the External Tank Vent Arm System. Either Master Events Controller will operate if the other or the intervening cabling fails.

¶A post-launch review of STS-112 indicated that the System A Hold-Down Post and External Tank Vent Arm System Pyrotechnics Initiator Controllers did not discharge. Initial troubleshooting revealed no malfunction, leading to the conclusion that the failure was intermittent. A subsequent investigation recommended the following:

All T–0 Ground Cables will be replaced after every flight.
The T–0 interface to the Pyrotechnics Initiator Controllers rack cable (Kapton) is in redesign.
All Orbiter T–0 Connector Savers have been replaced.
Pyrotechnic connectors will be pre-screened with pin- retention tests, and the connector saver mate process will be verified using videoscopes.

¶However, prelaunch testing procedures have not changed and may not be able to identify intermittent failures.

¶Findings:

¶F10.9-1 The Hold-Down Post External Tank Vent Arm

System is a Criticality 1R (redundant) system. Before the anomaly on STS-112, and despite the high-criticality factor, the original cabling for this system was used repeatedly until it was visibly damaged. Replacing these cables after every flight and removing the Kapton will prevent bending and manipulation damage.

223

¶F10.9-2 NASA is unclear about the potential for damage

if the system malfunctions, or even if one nut fails to split. Several program managers were asked: What if the A system fails, and a B-system initiator fails simultaneously? The consensus was that the system would continue to burn on the pad or that the Solid Rocket Booster would rip free of the pad, causing potentially catastrophic damage to the Solid Rocket Booster skirt and nozzle maneuvering mechanism. However, they agree that the probability of this is extremely low.

¶F10.9-3 With the exception of STS-112ʼs anomaly, nu-

merous bolt hang-ups, and occasional Master Events Controller failures, these systems have a good record. In the early design stages, risk-mitigating options were considered, including strap- ping with either a wire that crosses over the nut from the A to B side, or with a toggle circuit that sends a signal to the opposite side when either initiator fires. Both options would eliminate the potential of a catastrophic dual failure. However, they could also create new failure potentials that may not reduce overall system risk. Todayʼs test and troubleshooting technology may have improved the ability to test circuits and potentially prevent intermittent failures, but it is not clear if NASA has explored these options.

¶Observation:

¶O10.9-1 NASA should consider a redesign of the system,

such as adding a cross-strapping cable, or conduct advanced testing for intermittent failure.

10.10 SOLID ROCKET BOOSTER EXTERNAL TANK ATTACHMENT RING

¶In Chapter 4, the Board noted how NASAʼs reliance on "analysis" to validate Shuttle components led to the use of flawed bolt catchers. NASAʼs use of this flawed "analysis" technique is endemic. The Board has found that such analysis was invoked, with potentially dire consequences, on the Solid Rocket Booster External Tank Attach Ring. Tests showed that the tensile strength of several of these rings was well below minimum safety requirements. This problem was brought to NASAʼs attention shortly before the launch of STS-107. To accommodate the launch schedule, the External Tanking Meeting chair, after a cursory briefing without a full technical review, reduced the Attach Ringsʼ minimum required safety factor of 1.4 (that is, able to withstand 1.4 times the maximum load ever expected in operations) to 1.25. Though NASA has formulated short- and long-term corrections, its long-term plan has not yet been authorized.

¶Observation:

¶O10.10-1 NASA should reinstate a safety factor of 1.4 for

the Attachment Rings—which invalidates the use of ring serial numbers 16 and 15 in their

10.11 TEST EQUIPMENT UPGRADES

¶Visits to NASA facilities (both government and contractor operated, as well as contractor facilities) and interviews with technicians revealed the use of 1970s-era oscilloscopes and other analog equipment. Currently available equipment is digital, and in other venues has proved to be less costly, easier to maintain, and more reliable and accurate. With the Shuttle forecast to fly through 2020, an upgrade to digital equipment would avoid the high maintenance, lack of parts, and dubious accuracy of equipment currently used. New equipment would require certification for its uses, but the benefit in accuracy, maintainability, and longevity would likely outweigh the drawbacks of certification costs.

¶Observation:

¶O10.11-1 Assess NASA and contractor equipment to deter-

mine if an upgrade will provide the reliability and accuracy needed to maintain the Shuttle through 2020. Plan an aggressive certification program for replaced items so that new equipment can be put into operation as soon as possible.