10.9 Hold-Down Post Cable Anomaly

¶Each of the two Solid Rocket Boosters is attached to the Mobile Launch Platform by four "hold down" bolts. A five- inch diameter restraint nut that contains two pyrotechnic initiators secures each of these bolts. The initiators sever the nuts when the Solid Rocket Boosters ignite, allowing the Space Shuttle stack to lift off. During launch, STS-112 suffered a failure in the Hold-Down Post and External Tank Vent Arm Systems that control the firing of initiators in each Solid Rocket Booster restraint nut. NASA had been warned that a recurrence of this type of failure could cause catastrophic failure of the Shuttle stack (see Appendix D.15).

¶The signal to fire the initiators begins in the General Purpose Computers and goes to both of the Master Events Controllers on the Orbiter. Master Events Controller 1 communicates this signal to the A system cable, and Master Events Controller 2 feeds the B system. The cabling then goes through the T–0 umbilical (that connects fluid and electrical connections between the launch pad and the Orbiter) to the Pyrotechnics Initiator Controllers and then to the initiators. (There are 16 Pyrotechnics Initiator Controllers for Hold Down Post Systems A and B, and four for the External Tank Vent Arm Systems A and B.) The Hold Down Post System A is hard-wired to one of the initiators on each of the four restraint nuts (eight total) while System B is hard-wired to the other initiator on each nut. The A and B systems also send a duplicate signal to the External Tank Vent Arm System. Either Master Events Controller will operate if the other or the intervening cabling fails.

¶A post-launch review of STS-112 indicated that the System A Hold-Down Post and External Tank Vent Arm System Pyrotechnics Initiator Controllers did not discharge. Initial troubleshooting revealed no malfunction, leading to the conclusion that the failure was intermittent. A subsequent investigation recommended the following:

All T–0 Ground Cables will be replaced after every flight.
The T–0 interface to the Pyrotechnics Initiator Controllers rack cable (Kapton) is in redesign.
All Orbiter T–0 Connector Savers have been replaced.
Pyrotechnic connectors will be pre-screened with pin- retention tests, and the connector saver mate process will be verified using videoscopes.

¶However, prelaunch testing procedures have not changed and may not be able to identify intermittent failures.

¶Findings:

¶F10.9-1 The Hold-Down Post External Tank Vent Arm System is a Criticality 1R (redundant) system. Before the anomaly on STS-112, and despite the high-criticality factor, the original cabling for this system was used repeatedly until it was visibly damaged. Replacing these cables after every flight and removing the Kapton will prevent bending and manipulation damage.

223

¶F10.9-2 NASA is unclear about the potential for damage if the system malfunctions, or even if one nut fails to split. Several program managers were asked: What if the A system fails, and a B-system initiator fails simultaneously? The consensus was that the system would continue to burn on the pad or that the Solid Rocket Booster would rip free of the pad, causing potentially catastrophic damage to the Solid Rocket Booster skirt and nozzle maneuvering mechanism. However, they agree that the probability of this is extremely low.

¶F10.9-3 With the exception of STS-112ʼs anomaly, numerous bolt hang-ups, and occasional Master Events Controller failures, these systems have a good record. In the early design stages, risk-mitigating options were considered, including strap- ping with either a wire that crosses over the nut from the A to B side, or with a toggle circuit that sends a signal to the opposite side when either initiator fires. Both options would eliminate the potential of a catastrophic dual failure. However, they could also create new failure potentials that may not reduce overall system risk. Todayʼs test and troubleshooting technology may have improved the ability to test circuits and potentially prevent intermittent failures, but it is not clear if NASA has explored these options.

¶Observation:

¶O10.9-1 NASA should consider a redesign of the system, such as adding a cross-strapping cable, or conduct advanced testing for intermittent failure.

10.10 Solid Rocket Booster External Tank Attachment Ring

¶In Chapter 4, the Board noted how NASAʼs reliance on "analysis" to validate Shuttle components led to the use of flawed bolt catchers. NASAʼs use of this flawed "analysis" technique is endemic. The Board has found that such analysis was invoked, with potentially dire consequences, on the Solid Rocket Booster External Tank Attach Ring. Tests showed that the tensile strength of several of these rings was well below minimum safety requirements. This problem was brought to NASAʼs attention shortly before the launch of STS-107. To accommodate the launch schedule, the External Tanking Meeting chair, after a cursory briefing without a full technical review, reduced the Attach Ringsʼ minimum required safety factor of 1.4 (that is, able to withstand 1.4 times the maximum load ever expected in operations) to 1.25. Though NASA has formulated short- and long-term corrections, its long-term plan has not yet been authorized.

¶Observation:

¶O10.10-1 NASA should reinstate a safety factor of 1.4 for

the Attachment Rings—which invalidates the use of ring serial numbers 16 and 15 in their present state—and replace all deficient material in the Attachment Rings.

10.11 Test Equipment Upgrades

¶Visits to NASA facilities (both government and contractor operated, as well as contractor facilities) and interviews with technicians revealed the use of 1970s-era oscilloscopes and other analog equipment. Currently available equipment is digital, and in other venues has proved to be less costly, easier to maintain, and more reliable and accurate. With the Shuttle forecast to fly through 2020, an upgrade to digital equipment would avoid the high maintenance, lack of parts, and dubious accuracy of equipment currently used. New equipment would require certification for its uses, but the benefit in accuracy, maintainability, and longevity would likely outweigh the drawbacks of certification costs.

¶Observation:

¶O10.11-1 Assess NASA and contractor equipment to deter-

mine if an upgrade will provide the reliability and accuracy needed to maintain the Shuttle through 2020. Plan an aggressive certification program for replaced items so that new equipment can be put into operation as soon as possible.

10.12 Leadership/Managerial Training

¶Managers at many levels in NASA, from GS-14 to Associate Administrator, have taken their positions without following a recommended standard of training and education to prepare them for roles of increased responsibility. While NASA has a number of in-house academic training and career development opportunities, the timing and strategy for management and leadership development differs across organizations. Unlike other sectors of the Federal Government and the military, NASA does not have a standard agency-wide career planning process to prepare its junior and mid-level managers for advanced roles. These programs range from academic fellowships to civil service education programs to billets in military-sponsored programs, and will allow NASA to build a strong corps of potential leaders for future progression.

¶Observation:

¶10.12-1 NASA should implement an agency-wide strategy for leadership and management training that provides a more consistent and integrated approach to career development. This strategy should identify the management and leadership skills, abilities, and experiences required for each level of advancement. NASA should continue to expand its leadership development partnerships with the Department of Defense and other external organizations.