In recent years there's been talk about a total privatization, essentially giving the vehicles and the infrastructure to a private contractor and just letting them operate; and, very frankly, I feel that that is very naive, very unrealistic, and will never happen. I mean, there is nobody out there, I think, who would want to take on that responsibility unless they're indemnified; and if they're fully indemnified, then the government is gaining nothing except the contractor's fee.

So the cost is going to go up. So if there's some political reason why you don't want government work force working on it, then I think that can work; but you'd have to be very, very careful of the transition. It's not the steady state that you worry about in those things; it's the transition from one state to another. You've got a program that's over 20 years old, 25 years old really. It's been flying for over 20 years; and to try to change its culture overnight by saying it's totally privatized and removing the checks and balances that everybody has become accustomed to could entail some increased risk. It could be done. I would prefer to see it done in the next program and design it from the ground up.

If you want a privatized program, then design it from the ground up; but with one customer, the government, and a limited number of flights and an unknown liability for things like the infrastructure -- you know, what does it cost to change a roof on the VAB or the side panels or to meet environmental concerns if they should come up -- I just don't see it being realistic to transfer to a private contractor completely.

DR. LOGSDON: Under SFOC, there are a particular set of incentives. Was there any concern that those incentives diminished the emphasis on safety by USA or were you -- you, I guess, as an individual in this case -- confident that USA could operate the vehicle as safely as the civil servants had done in the first 20 years?

MR. BLOMBERG: Well, my answer on that has to be time-dependent. When I read the Statement of Work for the contract to USA, I had great concerns. I was concerned, for example, about the incentive fee for meeting launch on time. I thought that was ill-advised because the last thing you want to do is tie some money to a launch decision. That has to be made purely on risk grounds. I was also concerned that the safety measures against which the contractor was going to be evaluated were defined by the contractor, and so you could end up with a situation where you managed to the metrics rather than managed to the safety of the vehicle. That was in theory.

In practice, we looked at USA's performance very closely. I know the folks there very well and have followed their performance, and I think it's been exemplary. They have called launch halts whenever necessary -- in fact, at points where I probably would not have called them personally because I thought it was ultraconservative, but it's better to be ultraconservative than the other way around. So I think the performance has been right on what you would want. They have the safety culture that is necessary. That doesn't mean it's a hundred percent effective. That doesn't mean it can't be improved, but my concerns at the outset really did go away.

DR. LOGSDON: One final question. This is, I think, a giant extrapolation from what you have said this morning; but let me ask you about it. You've said you see no progress in materials or propulsion that would justify investment in a new vehicle, that the shuttle has to fly past 2020, and that there are lots of improvements that could be put into the shuttle. Would you recommend building an updated version of the shuttle design, one or two?

MR. BLOMBERG: Again, without knowing the full budget picture, just from an operational safety standpoint for the space shuttle program, I would absolutely recommend that. I think the finest thing that could be done right now would be to take all of the knowledge that the people have of the space shuttle system and all the additional knowledge that your board is going to produce, which is scrutinizing the system more than it's ever been scrutinized in recent years, and put that into one or two additional orbiters and when those come on line, maybe retire the oldest of the current ones. I think that would be the best thing that we could possibly do both for the safety of flight and for expanding our knowledge of human space vehicles.

Absent that, I would certainly like to see the existing vehicles upgraded with as many of those things as is reasonable to put in. We were talking about escape, for example. It might be a lot easier and more cost-effective to put an escape system into a new shuttle vehicle than to try to retrofit the existing vehicles and cut through the existing mold lines.

So I would certainly love to see that and I think it's a way to go while simultaneously commencing the basic research-and-development programs that you need to have a radically new vehicle. Because it's not just going to happen. There's no market out there for building efficient reusable rocket engines unless it's for a human space vehicle. So NASA and the country are going to have to do that and work on the materials side, but it's unclear how long it will take to get the breakthrough you need to have a significantly better vehicle than the upgraded shuttle that you're talking about, the shuttle derivative, would be.

DR. LOGSDON: Thank you.

ADM. GEHMAN: Mr. Blomberg, among the other tasks that this board has, including finding the direct cause of this accident and making recommendations to prevent it, we also have to place our report, in terms that I've used, "in context." As the chairman, that's one of my specific problems is to place our recommendations in context.

One of the contexts is the life of the shuttle program, which is something that we've talked about before. If we're near the end of the shuttle program, our recommendations would have a certain flavor to them. If we are only 50 percent of the way through the shuttle program, as has been suggested that we're going to be flying shuttles until 2020, we're at the halfway point. We've lost 40 percent of our vehicles at the halfway point.

This problem of putting it in context is weighing on my shoulders; and I was struck by some words in the last ASAP report that you signed, which was last year's, technically, 2001's. I would like to read something here. I'm not going to throw these things back in your face, but I want to allow you to talk to us about it.

This was finding and recommendation No. 1. "Last year, concern arose that the planning horizon for the space shuttle and the international space program was too short, imperiling the development, advancement, and adaptation of safety improvements" because you couldn't amortize them or you couldn't justify them -- my words. "It is now recognized that the space shuttle will be used well beyond 2012, a longer life span than was originally anticipated. Now serious safety concerns are currently ranged around the potential for lost opportunities in safety improvements which can lead to safety problems as ageing systems deteriorate." In other words, now we've got a new set of problems. "The panel believes that the space shuttle is fully capable of supporting the ISS for its entire life."

So my understanding of what I just read is that by extending the program life, we now have eliminated the excuses for not making infrastructure upgrades and all the safety things that you have mentioned, which I value that as a good thing -- that is, if there's money there -- but now we have a new problem and the problem is, of course, ageing and deteriorating systems. My first question is: Have I characterized that approximately correctly?

MR. BLOMBERG: Yes, I think you have, although I think it's a matter of emphasis. I don't think the ageing issue per se is anywhere near as great as the other issues, the issues of not upgrading the vehicle. I think the ageing issues could very likely give you some graceful deterioration, whereas the upgrades could give you some quantum jumps in safety or reductions in risk.

ADM. GEHMAN: The reason why the ageing problem is stuck on my forehead so well is because of the theory of the unknown unknowns, that it's turned out that the parts of the shuttle program, the parts of the STS which were viewed to be the most dangerous have not failed -- it's always something else which has gotten us, it seems -- and we feel that if you're going to continue to fly this thing for twice as long as it's already flown, there has to be an aggressive program out there looking for what we call the unknown unknowns. In other words, you've got to start looking for trouble. I believe that can be done, that we have other examples of aircraft that are working kind of at the edges of their margins, that are old and things like that -- military aircraft and civilian aircraft. The second part of my question, though, gets to the comment about the relationship between the shuttle and the ISS. Do you believe that they are linked?

MR. BLOMBERG: Absolutely. I mean, the ISS was designed to the shuttle's capabilities, with some help from the Russian vehicles and a little bit from the European vehicles, but basically to the shuttle's capabilities. Frankly, from my own perspective, it would probably be a poor economic decision for the country to build another vehicle to service the ISS because the next-generation vehicle might have a totally different mission. So why not, as long as the space shuttle is capable of servicing the ISS throughout its entire life, keep that symbiotic relationship going. I mean, it was designed to re-boost the space station. They were designed to exchange consumables in both directions, if necessary.

So I think just a very simple answer is to keep the space shuttle flying as safely as possible as long as you are doing the space station and then think about what the mission is for the next vehicle, whether it's the support journey to Mars or some other purpose. Going back to your first remarks also, I would like to point out that the kinds of safety improvements that we're talking about are not only hardware, software, and even ground infrastructure.

We're talking about training. We're talking about re-analyses to understand and characterize the vehicle better for its now realistic lifetime. So that while there were life limits placed on every component -- you could only keep an external tank in storage for so many years and you could only keep a solid rocket motor segment in storage -- those limits are no longer realistic, and it's time to redo those analyses.

Well, as Dr. Widnall was saying, that's not romantic -- romantic from the Congressional standpoint. "Why do I have to redo an analysis? Did you get it wrong the first time?" It's millions and millions of dollars, but really that's what's necessary. It was done after Challenger. The failure modes and effects analyses were all redone. The critical items list were all redone, based on experience.

Well, now we have a lot of additional experience in both directions. We know that there are things that were originally characterized as Critical 1 items that aren't Critical 1. They're not Criticality 1, and there are other things maybe that were not categorized as Crit 1 that are now, because of ageing conditions, and either should be changed out or made redundant or some other changes. We need to recharacterize that.

All of the computer models that were used to develop the space shuttle in the late 1970s have been upgraded multiple times, the materials models, the flow models and so forth. What are the implications of those on the vehicle in both directions? Were we too conservative with those things, or were we too liberal? Did we misunderstand?

I believe that the requirements, down to the most minute requirements, need to be revisited by the people who understand the system, to determine whether they need to be upgraded. The simple example that the program went through, I don't know, about five or six years ago with a new pressure-sensitive adhesive in the solid rocket motors -- they couldn't use the one that was spec'ed, because of environmental concerns, and they had a requirement of a certain peel strength.

They went out and found another adhesive that met the requirement. It was right in the middle of the range of the requirement, and it didn't work. When they went and re-analyzed it, now scrutinizing it, they found out that they had been flying at two or three times the requirement and they really needed it. They bought the best off-the-shelf stuff and it was much higher than the requirement, and that was absolutely necessary.

So falling back on a spec that was written before you flew the vehicle doesn't have a lot of meaning. You now have over a hundred flights. It's time to re-do that. It's a costly process, it's not a romantic process, it doesn't produce things that are impressive to the public, but it is absolutely what goes on with commercial aircraft, with military aircraft, and it should be going on with the space shuttle.

ADM. GEHMAN: You are aware, of course, of NASA's budget and the kind of limitations on their budget. As I understand it, you are recommending that we consider upgrades to the shuttle to keep it fully capable of flying for another 20 years, given certain conditions that you've outlined here; but we also have to get to work on the next manned spacecraft. This is going to be a tremendous pressure on a budget.

MR. BLOMBERG: Well, maybe. You know, there was a lot of money spent in the NASA budget, during the 15 years I was on the ASAP, that was not productive. Billions were spent on the advanced solid rocket motor. It never flew. Millions or billions -- I'm not a budget expert -- were spent on the X-33 and the X-34. They never flew. I think that even within the present budget confines, it's possible to support the international space station and the space shuttle to the fullest extent that they need and have a technology development program that will support a next generation; but if you try to initiate a new vehicle program, to develop a vehicle from scratch when you don't have the technology -- so you're doing the technology development and the vehicle development at the same time -- then you're not going to have enough budget. That's what happened, I think, with X-33.

Instead of going and working on the technology areas that were clearly needed to make X-33 work, they embarked on building a test vehicle. I just am a believer in finishing what's on your plate before you take more, and I think supporting the ISS and shuttle adequately is first priority for the country.

MR. WALLACE: Let me switch to sort of a pure human factors type of question. We're a little over two months in this effort, and I have to say there are no lack of processes at NASA. I mean Flight Readiness Reviews and COFRs and Launch Readiness Reviews and all the processes leading up to that; and every time we ask a question, we get lots of paper.

Really, I mean it's a tremendously methodical, thorough set of processes; yet the investigation has raised some troubling questions about sort of communications and decision-making and flow of information up and down. My question is sort of human factors. Is there a point at which people find too much comfort in processes, where processes might actually stop thinking? Admiral Gehman talked about the unknown unknowns.

MR. BLOMBERG: You certainly can be over-proceduralized and can be process-bound. That is one of the things that can happen to an organization. I don't think it has happened to NASA. However, any big organization, any organization as large as NASA will have some communications issues and it is always difficult to determine how much should bubble all the way up to the top, to the administrator's level, for example. Frankly, there is a real question of whether you want the administrator making ultimate technical decisions because the administrator is just that, an administrator.

I think in the 15 years I observed NASA, I think the processes were not perfect but certainly as good as you could expect from a large organization, and improving. It's an overused phrase, but continuous improvement was there. Now, not everything that was done was an improvement; but people were watching it. I think the processes are sincere. I think everyone within the system is truly dedicated to safety; and the big change that I saw over the 15 years on both sides, contractor and NASA side, was when I first joined the panel, I would say that the likelihood of a randomly picked person in the system standing up and saying, "Time out. We're not going to fly. I'm stopping the flight," was very low. Today I would say it's virtually a hundred percent, that anyone out there, from somebody turning a wrench to a middle manager to a senior manager, would feel absolutely empowered, if they were uncertain, to say, "Stop," and they would be listened to, that it would not be something that they would say, "No, you don't know what you're talking about." It would be at least run to ground very professionally before a decision was made; and certainly if time was of the essence, they would not fly. That, to me, is the essence of a good safety system.

MR. WALLACE: Well, I didn't mean to suggest that more decisions needed to go to the administrator's level at all. I understand. But just to follow up on your answer where you say anybody can stop the process, in your experience, is there any change, post launch, in terms of that sort of thing?

MR. BLOMBERG: Well, of course, the options available to you post launch are fairly limited. The post-launch environment and the launch countdown environment, I think once you start into a launch countdown and then you go on from there to the post launch, you really do want to be procedurally bound. You want to be requirements-driven. You do not want to be defining waivers on the fly.

A waiver sounds like a terrible thing. I know when I first got into the aerospace business, I said, "You mean you're waiving a requirement? You're agreeing to fly in an unsafe condition?" Well, that's not the case, in virtually every situation. A waiver is a carefully thought-out process by which you decide that something is an acceptable risk. You don't do that under time pressure while you're in the middle of a launch count. You don't do that while you have a crew up in orbit and make decisions on the fly.

So, you know, if the flight rules say, "If such and such happens, you come home," you come home. Then you work it out. You know, if it turns out that you were wrong, that it was a sensor failure rather than a true failure of the system, you've taken the conservative approach. So I think that that's where you have to draw the line in this is when do you have to be procedure-bound and when can people have some leeway in the system and call it.

Even though it might sound conservative, I would not want somebody, while a flight was in process to say, "Time out. Bring it back." That's not the way to go; but, "Time out. We ought to study this and see whether we ought to bring it back tomorrow," that's what the Mission Management Team is for and things will get elevated to that team very rapidly. It depends on the context of what you're dealing with.

GEN. BARRY: One of the things we're trying to understand is a little bit about the management structure, and I'd like to see if this resonates with you. We're going to talk pre-launch and post launch. Pre-launch, obviously Challenger, a lot of focus has been spent on improving the process, particularly in a certification of flight readiness.

If we characterize that and we said, okay, pre-launch is centralized, it is focused on competition between centers a little bit, where all the centers are involved in certification of flight readiness, and there is, some would some argue, an attitude that you've got to prove there is no problem. Post launch is more de-centralized. It is only really one center primarily involved and that's the Johnson Space Center and, as some would argue -- and we're trying to figure this out -- that you have to prove there is a problem. Does any of that resonate with you insofar as pre- and post-launch considerations are?

MR. BLOMBERG: Well, it does resonate; but I think, General, that it may be a bit of a simplification. Pre-launch, I think you have a whole series of what I would call challenge-and-response meetings that culminate in the combined Flight Readiness Review, but really every element and every subsystem has its own Flight Readiness Review that start way before that and it's a series of challenges based on what you know about the system and its recent performance. So if there was a hiccough on a previous flight or during processing or the previous flight of that vehicle, then you've got to clear that; and that starts way down with the sub-tier people, each of whom goes through a bunch of challenges. I would agree with your characterization that it's "Prove to me that it's safe to fly," but it's an incremental process.

Once the flight is up, the focus shifts to JSC for sure, but, remember, there's a Mission Evaluation Room operating not only at every human space flight center but at all the major contractors and those rooms are there specifically to support their elements and the issues. So I guess my short answer is I agree with you except with the caveat that it has to be clear that the JSC folks are not trying to make technical decisions that are outside of their technical areas. They rely completely on the technical specialists. If it's a propulsion issue on the thrusters, for example, they would go to the thruster specialists. What they are specialists in is mission operations and once you're operational and once you're flying, they know all of these requirements and the rules and so they know to really turn to you and say, "You told me from your analysis that if this happens, if so many of these fail, we have to come back. We're coming back because you told me that." And if the specialists were to say, "Well, we really didn't mean that. It's okay to go on," then -- I can't recall a situation where that's happened and they've won; but if it were to happen, they would certainly have to produce some very, very compelling analyses and produce them virtually instantaneously. For example, they probably have had to have a change request in the system already for that to happen. So my take on it is that your characterization is a good one and the system is a good one. That's about the way it should go.

GEN. BARRY: Let me follow up on that, if I may. If it is a rather structured process going up prior to launch with the Certification of Flight Readiness -- and I think the next hundred flights for the shuttle are programmed to go to the space station, a couple are going to Hubble, so other than just the space station -- some have proposed an idea of having a certification of re-entry readiness. In other words, you have an associate administrator who signs off on the Certification of Flight Readiness and we have a de-centralized focus with the Mission Management Team, the MER, and you have also, of course, the flight director involvement. If we are on the space station, should there be a more centralized focus on re-entry?

MR. BLOMBERG: That's actually a very complex question because the first thought I have is it depends on what countermeasures you have available that would make that certification a valid certification. If you have no ability to fix the vehicle or to bring the crew back any other way, then it's kind of a moot point. If there are things you can do, if there are alternatives, then that has a lot of appeal as long as it doesn't get in the way of all of the other things that are necessary for safe mission operations. Re-entry is not just getting in and pushing a button and saying, "Let's go down." There's a lot of crew preparation. There's a lot of support needed from the ground; and as long as that review doesn't get in the way of those things or supplant any of them, I don't see where it would hurt; and it might help.

ADM. GEHMAN: Mr. Blomberg, I was thinking here to myself that in support of one of your comments here when we were talking about re-entry -- having looked at re-entry things, checklists and things like that -- I was reminded that one of the things on the re-entry checklist is to put all the laptops away, which supports your argument that we've got to upgrade the computer systems because what we're doing is we're carrying a lot of laptops up there because the computer systems won't handle it. Earlier we had this discussion about whether or not the shuttle is a research-and-development or an operational vehicle and I think I heard you say -- and I'll give you a chance to comment -- it's closer to being an R&D vehicle than a transportation system.

MR. BLOMBERG: Well, I don't even think it's close. I mean, it is an experimental vehicle. Just the fact that it's flown over a hundred times doesn't change its nature. Every flight is an experiment. Every flight is gaining knowledge. It's not an airline, by any means.

ADM. GEHMAN: We may be using the terms loosely here as to whether it's an experimental vehicle or an engineering development model vehicle or something like that; but in any case, we are in agreement that this is an experimental vehicle. But it is being used in an operational sense.

MR. BLOMBERG: Well, that's true and I don't think those things -- I think that's a semantic issue more than a technical issue. It's being used for the repetitive support of the international space station and for flying humans into space on a regular basis, but that doesn't change the nature of the vehicle. That nature arises, for example, from things such as you've got multiple copies and they're not all identical by any means, that the technology that's being used in the vehicle is not widely-used technology, or much of that technology. It doesn't come from the nature of the mission.

ADM. GEHMAN: Of course, there's no law against using an engineering development model or an experimental vehicle in operational use. In the first Gulf War, the military's JSTARS was still an engineering development and was used. The Predator unmanned aerial vehicle was used in Bosnia that was still technically under engineering development. So there's no law that says you can't do that. I'm still working on this context thing, and I want to get your views. I want to get this thing clarified. So it's an experimental vehicle and we're still learning about the environment in which it operates and particularly this Mach 24, 300,000-foot altitude environment which we know precious little about for a winged manned vehicle, but it is being used for operational purposes also. Now, the question I have relates to your building another one. If we're in agreement on those two points, do you think it's reasonable for an experimental vehicle to have a 40-year life?

MR. BLOMBERG: I don't see anything that precludes it. I mean, I don't think we have any models to follow for that. This is a unique situation, probably one that we've never been in before; but given the care that went into the design of the vehicle and that has gone into its operation, I don't see anything that precludes that.

ADM. GEHMAN: Let me rephrase the question, then. Let's forget about NASA and forget about the shuttle program. Do you think the United States should evolve into manned flight into space by not evolving itself for 40 years?

MR. BLOMBERG: Well, Admiral, you know, if you ask me do I think that the United States made a poor decision perhaps 20 years ago in not spending the money to have a shuttle replacement ongoing, I would say yes; but if you also ask me would the country be better served by not having human space flight until a shuttle replacement is produced, I would vehemently say no, I mean, that human space flight is important, we are learning a great deal from it, we are accomplishing things in space, and the shuttle is fully capable of supporting that at an acceptable, albeit not perfect, level of risk.

Now, would we have been better if we had Shuttle 2 now or some other vehicle? Probably. But we didn't make that decision. So right now we have to play the cards that we're dealt. The cards that we're dealt is the only human-rated vehicles that we know of on this planet are Soyuz and Shuttle, and Soyuz can't do the job. So it's going to be Shuttle.

DR. OSHEROFF: Well, first let me say that your team won last night. I'm sure you're happy about that. I noticed that. I have no stake in that. Stanford did not make it in that part.

I wanted to bring up a question. When my graduate students do something with a cryostat, which is actually a kind of extreme environment and things go wrong and they end up having to warm up and fix things, I always tell them that they learn far more from their failures than they do from their successes. I think that goes well beyond graduate students doing research projects, as well.

I think it is fair to say that we have some good ideas as to what led to the loss of the Columbia and her crew. We certainly don't know for sure and we're not willing to identify anything at this point; but assuming that we've done that, can you give me some ideas as to what the lessons are that we need to learn? I guess I'm particularly interested in the issues of risk management and risk abatement.

MR. BLOMBERG: Well, this is an area which I've examined quite thoroughly, not only for the shuttle but particularly aircraft accidents that I've been involved in. The reality is that the sequence of events is that whenever you have a human vehicle, a vehicle that's going to transport humans, you do as much analysis as you can possibly do -- and I'm including testing in that -- to make it as safe as possible before you operate it. But as the vehicle gets more and more complex, it is absolutely impossible to check out every interaction and every type of failure and every situation that the vehicle will encounter. Therefore, in those places that you consider to be most risky, you build in redundancy, you do whatever you can, and you hope that your operational experience, the closed-loop feedback, will give you that additional experience, as you operate the vehicle, to upgrade it.

Mr. Wallace was talking about the airline industry. This goes on all the time, whether it's brakes or various components of aircraft that reports come back from operators saying, "We're having trouble with this." The manufacturer looks at it and says, "Oops, we missed that." We didn't miss it because of dereliction of duty. We missed it because it's a maybe a second or third order of interaction, but now we can fix it. We've got this operational experience. Unfortunately, part of our operational experience in any vehicle is accidents. We hope it never gets to that, but it is part of the reality of operating, particularly in a high-risk environment. When there is an accident, we get a spinoff benefit; and the benefit is that we get the resources to focus in on the area that was involved in the accident and then a wider part of the vehicle. Challenger is a perfect example. There was a focus in on virtually every high-risk component of the vehicle, and a lot of improvements were put in.

I think that is the natural progression of things; and your students, when they destroy an experiment or have a problem with the laboratory, learn from that. You'd hope that they don't learn by someone getting injured or a high-cost destruction of property; but regardless, as long as we close the loop and as long as we didn't do anything intentional, deliberate, or uncaring -- we are fallible. I mean, I'm a human factors person, and I'm the first one to tell you that humans are perhaps the most fallible part of any system. We design the systems, we operate the system, we make the decisions to go, and so somewhere in whatever you're going to find for Columbia, humans failed.

The question that I would want to ask is: Did we fail through malice, did we fail through neglect, or did we fail through ignorance? If we failed through ignorance, let's learn from it, let's increase our vigilance, and make the system better and keep that closed loop going. That's all we can do in any vehicle.

DR. OSHEROFF: I would suggest that there's another possibility and that is that the failure was through a faulty process which did not properly identify some of the risks and which would then have allowed NASA to take steps to minimize those risks.

MR. BLOMBERG: Absolutely. That is certainly a possibility; but if that's the possibility, I would speculate that that process failed because we didn't understand it, not because we short-circuited it or because anybody deliberately said, "Oh, it's okay. Let's go full speed ahead." That's part of the understanding. It's not only characterization of the materials and the software and so forth, it's characterization of how people and processes work. That's an integral part of it, and the whole shuttle program has been struggling with that now for years and doing a pretty good job of process control and understanding that processes are, in many cases, as important as products, as the hardware and software that results from them. So they've developed a process failure modes and effects analysis technique and some other things.

It's very likely that -- it's assured -- I mean, I am sure that whatever caused the accident escaped a process at some point. It had to have, because it flew. So at some point in the process, somebody missed it; and it may have been my panel. We may have been staring it in the face and missed it, but it wasn't for lack of trying, I'm convinced, on the part of all concerned, because, as I said in my opening remarks, I just have never seen a system more safety conscious and people more dedicated to safety. That's not a hundred percent assurance; it just says that their hearts are in the right place.

DR. OSHEROFF: Well, I fully agree with you, but I think that we really have to look at what processes may need improvement and I'm sure you agree with me on that.

MR. BLOMBERG: I do, Doctor, but with one variation. I think that the time to do that is after you've decided what the proximate cause was. The processes are in the root cause domain, and right now my understanding from your statement is you're still struggling with understanding the proximate cause. Once you understand that, then I think that's the time to step back and say how did that slip through all of the defenses.

DR. OSHEROFF: Well, let me suggest -- and I think that NASA's already suggested this -- inspection of the shuttles in orbit, with the ability to repair at least the tiles, if not the RCC panels.

MR. BLOMBERG: Well, even if that doesn't turn out to be the cause of the accident, that may be a positive outcome of the investigation, saying here is a technique, is an ability that we had that we weren't making maximum use of. That's the kind of improvement that I was talking about that comes out of this intense scrutiny. Again, I don't think that we're dealing with an escape here that anybody can be faulted for not having realized, because the operational experience just didn't point to it.

DR. OSHEROFF: I'm sorry, I have absolutely no intention of assigning fault to anyone. This is an extremely complicated vehicle and the process of certifying it for flight readiness is extremely complicated, but I think we have to set aside the issue of fault and, in fact, not identify that but recognize the processes that must be changed.

MR. BLOMBERG: I fully agree with you. I'm just saying I think it's a matter of timing, and I think that is done most effectively after you understand the causes and, you know, you have to work backwards from the effects and then say what processes were there that could have caught this and are reasonable to perform. I venture that you will find in some of your blind alleys, some of the theories that you've checked out that don't turn out to be the cause of this accident, you will still be able to back those out to improved process because you've scrutinized those so much. That's a terrific benefit of the kind of investigation that you're doing. It's just the question of when to do it.

DR. OSHEROFF: So the idea of minimizing risk is certainly one that's very valuable.

MR. BLOMBERG: That has to be the overriding principle of the entire operation is risk management and minimizing risk and understanding the risk you're accepting. It's not only minimizing the risks but it's understanding the risk that you've accepted.

DR. OSHEROFF: Thank you.

DR. WIDNALL: I'd like to follow up a little bit on some of the words you've used. I didn't write them all down, but you said, you know, we know it wasn't due to malice. Then you had this rather large catch-all category called ignorance, and I guess I'm just not willing to allow so much to be in this category of ignorance. Being a poor engineer, I don't have a rich vocabulary in organizational theory; but it seems to me to me words like denial, organizational structure in the way the various levels work together, issues of unconscious trade-offs that various parts of an organization make, I think somehow that vocabulary has to get into any kind of framework which otherwise might be called ignorance. I mean, I think we really need to think deeply about how one organizes an effective, you know, as you mentioned earlier, large organization for the whole question of making good decisions in the safety area.

MR. BLOMBERG: Well, I agree with you completely; and probably the word "ignorance" was unfortunate. Being a poor engineer myself, I couldn't think of a better term. But I wrap in that the clear issues of things like we don't have the technical knowledge to understand how a material performs under certain circumstances because it's never been tested in that environment and we never looked at it because we never thought it was a problem, which is another form of what I'm saying, in quotes, is ignorance.

My own concern is that, with the best of intentions, any organization -- and I think NASA and its contractors may have fallen into this -- when you're so goal-oriented and you're so budget-limited, you tend to put blinders on and you tend to look at -- in my experience here, they tended to look at the next flight, let's look at getting this next flight off as well as we can. Maybe the old not seeing the forest for the trees comes into play. That's one of the reasons, for example, why we try to get engineers and managers in any organization to understand the end-to-end system so they understand where their portion fits in and maybe will see some of the interactions that go beyond just the performance of their subset. That clearly could have been a problem here.

The space shuttle people were under enormous stress, stress from one side of supporting the international space station and not being the weak link in the international effort to put a space station up and, on the other side, the very real knowledge that if they could not perform within the budget, there was a risk to the entire program and, therefore, to their lives, to what they had dedicated themselves to. I'm absolutely convinced that nobody said, "Well, we've got to go ahead. I know we're increasing the risk; but if we don't do that, we could lose the whole program." That I would be very sure of, knowing the people; but whether they inadvertently missed something because of their zeal and because of their innovative capabilities remains to be seen.

Certainly they need relief. They're not going to be able to fly for another 20 years under the stress levels that they've been asked to fly under for the last seven or eight. I would liken it to a very taut rubber band. You can only pull that rubber band just so far, and eventually it's going to snap. These folks are being asked to continually pull rabbits out of hats, and you can't do that forever. I am convinced that if they knew they couldn't pull the rabbit out of the hat, they would stop the flight; but as you're saying, sometimes you think you've pulled the rabbit out of the hat and all your analyses say that and you just don't have the tools to give you the proper insight.

DR. WIDNALL: Or you don't really want to know the rabbit is in the hat.

MR. BLOMBERG: Well, I think there's very little of that. I honestly do believe that the folks on both sides, NASA and the contractor, do want to know if the rabbit's still in the hat. They understand the implications of failure. They are very dedicated to the crews and to keeping everybody safe. So I think if there's uncertainty, they err on the side of conservatism; but sometimes zeal can say that you're certain when perhaps you should have said you're uncertain.

ADM. GEHMAN: Mr. Blomberg, on behalf of the panel, we want to thank you very much for your help here today. You've been looking at this for over 20 years, and your views are very helpful to us. We appreciate your very frank answers. We appreciate your willingness to dialogue with us as we attempt to bring our level of knowledge up to yours. Your views are very helpful to us, will make a big difference in the report, and we want to thank you for your contribution. So thank you very much. We'll take about a ten-minute break here while we seat the next panel. (Recess taken)

ADM. GEHMAN: All right. Ladies and gentlemen, we're ready to resume here. We're privileged to have join us today a panel. Mr. Gary Grant is the systems engineer in the Thermal Management Group for Boeing; and Mr. Dan Bell is in the TPS, subsystem manager for Boeing. I'll invite you to make a statement and give us a briefing or whatever you want to do; but before we begin, let me ask you to affirm that the information you will provide to the board today will be accurate and complete, to the best of your current knowledge and belief.

THE WITNESSES: I affirm that.

ADM. GEHMAN: Thank you very much. Would you introduce yourselves. Tell us your background and what your current position is.

DAN BELL and GARY GRANT testified as follows:

MR. BELL: My name is Dan Bell. I am the TPS subsystem manager for the Boeing Company. I've got 15 years of experience in TPS, TPS installations, materials. Prior to becoming the TPS subsystem manager, I was the manager in the Thermal Management Systems Group in the Huntington Beach facility, also Boeing.

MR. GRANT: My name is Gary Grant. I'm also in the Thermal Protection System. I have 14 years experience, primarily in the operational and turn-around area and requirements. I'm an active member of the LASS subsystem, and I'm acting as an assistant subsystem manager in that capacity.

ADM. GEHMAN: Thank you very much. We're delighted to have you join us today, and we invite you to make a presentation or a statement.

MR. BELL: I think we're here to give you guys a presentation.

ADM. GEHMAN: Go ahead.

MR. BELL: I want to bring up the charts.

Next slide, please. We're here to kind of bring the board and give an overview of our TPS and RCC systems. In this presentation we're going to talk in some detail about the reinforced carbon-carbon system, the leading edge of the vehicle and some other components, what we call our high-temperature reusable insulation. I think you all know them better as these are the black tiles on our vehicle. Our low-temperature reusable surface insulation, these are the white tiles. AFRSI or FIB -- each of those are kind of interchangeable names -- those are kind of quilted soft goods that we use primarily on the upper surface of the vehicle. We have FRSI, flexible reusable surface insulation. These components are a needled felt material that's used on the upper surface of the vehicle, more durable than our AFRSI material. Then we're going to go into some penetrations and seals, those locations on our vehicle where we have areas that need to be closed out with different thermal barriers and sealing systems.

Next slide, please. Just to demonstrate on a very high level where the RCC and these different components exist. RCC makes up the leading edge components. The nose cap and what's not shown here on the lower surface. We also have the chin panel and what we call the aero head, and that's the forward attach point for the vehicle itself.
Next slide. When we talk about our high-temperature reusable surface insulation tile, those are the black tiles, the upper surface tiles that are shown here. Most have seen the lower surface -- and we'll get into that -- but the entire lower surface of the vehicle is covered by those components.

Next slide, please. Our LRSI tile. As you can see, right around the forward windows and on the forward edge of the OMS pods themselves, we have our low-temperature surface insulation tiles. Next slide. Our AFRSI blankets or FIB blankets that we have cover a large acreage of the upper surface. These components are lower maintenance than are LRSI tiles, and that's the primary reason those were selected over the tile system for that upper surface.

If we go to the next slide. This fills in the puzzle with our FRSI system. This is a felt system, very durable and very maintenance friendly, having workers in and around that vehicle. The penetration seals and thermal barriers, we're going to get to on some later charts.

Next slide, please. When we talk about the environments that our vehicles are exposed to, the first thing everybody asks is what kind of temperature, thermal environments we're exposed to. What's shown here are some data that came off a compilation of data taken from three flights early on in the program. It shows you a variation in temperatures from the very forward edge of the vehicle, lower surface, ranging from 1900 degrees. Then we have some areas on the vehicle that we'll talk about a little later on that get upwards into the 2500-degree range. These isotherms vary across the vehicle. Our upper surface of the vehicle sees much lower temperatures, generally less than a thousand degrees, and varies, depending upon the location, to as low as 300 or 350 degrees at the top of the payload bay doors.

Next slide. Now, when we go through a re-entry cycle, what we wanted to demonstrate here is the change in pressure; and pressure is an important part of the equation on re-entry. Starting from the time of re-entry, you can see how the pressure actually increases as you get further in the atmosphere, as one would expect. This was taken from a body point forward on the vehicle surface.

Next slide. I wanted to touch base in a little more detail on some heating and some very specific locations. These are some of the more extreme environments that our TPS, our tile systems see. A body point on the very forward edge of the nose landing gear door, Body Point 1024, sees a peak heating of about 2300 degrees Fahrenheit. On the door itself, the temperatures start to decrease as we move aft. We're still getting extremes around close to 2100 degrees there. We do have a very hot region in between the two elevons, the inner and outer elevon. In this region we get some additional heating that causes us to push that tile system upwards to 2500 degrees.

ADM. GEHMAN: There are two lines on each of those graphs. What do they mean?

MR. BELL: I don't think I have the background on this specific slide to answer your question correctly. So we'll get you that data. I do know that the lines that were listed there are the actual temps, though, that were measured at those body points.

Let me go to the next slide. The TPS system is very extremely part-count heavy. We have very high numbers of parts that we have to deal with on a daily basis. Our high-temperature reusable, our black tiles, what's listed on the first line there, is two different systems. One is our LI-900 system, which makes up the majority of the components, 9-pounds-per-cubic-foot tiles. Then our LI-2200 tiles make up a smaller subset of that, and we'll get to those locations on some later charts.

You can look there just with those systems alone. There's about 20,000 tiles on each vehicle. TUFI tiles, which we'll talk about, are our newer introduction to the vehicle; and we have about 306 of those installed on the vehicle. Those primarily take up the base heat shield and upper body flap section of the vehicle at this time.

FRCI tiles, which were an introduction sometime in mid-program, we have almost 3,000 of those installed. Again, now getting to the upper surface, the upper surface tiles, our LRSI, about 700, actually 800 tiles with varying density of substrates. Then if we look at the amount of area occupied by our FIB or AFRSI blankets and then our FRSI, we're talking over 2,000 square feet for each one of those systems. It's a lot of parts to deal with.

Next page, please. I wanted to touch on how our system goes together, and it's primarily for our tiles. Well, let's start at the top of our system. The tiles are a substrate, which three of the components that we are currently using up there are listed. LI-900, LI-2200, two of the original substrates from Day 1 on the program, still occupy the majority of our substrate material. We have a material called FRCI 12 which was introduced at a later time. It's got some benefits from a strength standpoint. Then we have what's not listed up there, an AETB-8 material, an 8-pound-per-cubic-foot material that accommodates us the use of a TUFI coating on that surface.

These three substrates have the same coating, our RCG coating, reaction-cured glass coating, over the surface of that. We then take that substrate, the base of the material is densified, and we bond onto that what we call SIP. It's a strain isolation pad. That is bonded to the base of the tile with an RTV system, which is a silicone. It's a two-part silicone system, and that two-part silicone system is then bonded to the structure. We have multiple types of structure that we actually bond to.

One of the features of our design system, as you can see, is this component. This is what we call filler bar. Filler bar allows us to have a seal in between two adjacent tiles. So if you can imagine -- you kind of see in this gap here. If we had another tile that would sit into this hole here, this piece of filler bar would be covered by this tile and then its adjacent tile.

Next page, please. When we talked about the different types of substrates that we have on our vehicle -- and this is a little archaic as far as it's a demonstration of where those parts are located -- the 9-pound material, our LI-900 material, as you can see, makes up the majority of our lower surface of the vehicle. It's our primary workhorse from an acreage standpoint. FRCI 12 -- and this is 102, so it has actually less FRCI 12 than do the other vehicles. We have instituted some locations where FRCI 12 has been installed for different reasons.

LI-2200 material is a higher density material that we use in LESS regions, generally around penetrations and a highly-loaded region. It's also used quite a bit around the nose of the vehicle itself. AETB-8 obviously isn't shown here because it's on the base heat shield and upper body flap of the vehicle.

Questions?

Next slide, please.

GEN. BARRY: One question. Could you tell us what percentage of the tiles on the bottom are original tiles?

MR. BELL: We have that data. It's a pretty substantial number. Most of our tiles. I believe the number is about 60 percent. We certainly can get you some accurate data, and I think we have those charts available and we'll make those available to you.

GEN. BARRY: Thank you.

DR. RIDE: Could I just ask how you chose the areas on 102 to put the FRCI tile on? You said that it's less than the other orbiters.

MR. BELL: Sure. The FRCI 12 tiles are an introduction that occurred after the build of 102. From a design standpoint, those tiles give us some benefit because they have some added strength characteristics that allowed low-margin tiles to be upgraded and in some cases we went forward and upgraded specific areas of low-margin tiles that would benefit from that strength.

DR. RIDE: So it looked like the doors of the wheel wells, the inboard doors of both wheel wells?

MR. BELL: Actually this forward edge, there's a seam that exists under this edge. I don't think it's really driven by the fact that the doors are at that location. Yes. And there's some other very specific areas. FRCI allowed introduction of a stronger substrate that can accommodate relieving some of those low-margin areas that we've had to deal with for 102. We simply installed more of them on the other vehicles to deal with that, but there was still attrition mods where FRCI, on the books, that 102 would have had upgraded at points this time.

Next slide, please. This kind of gives you a feel. You know, you take a look at the bottom of our vehicle and you think that it's a nice, flat surface; but it's really not. We have various thicknesses of our tiles; and our tiles provide some contour to the vehicle, as well. You can see in some of our thinner areas we get down to less than an inch in thickness; and back on the very base of the body flap, we're talking about tile thicknesses approaching 4 inches in thickness. So a significant variation across the vehicle.

ADM. GEHMAN: And the reds are thicker?

MR. BELL: The red ones would be thinner.

ADM. GEHMAN: Thinner. Then the blues and purples are thicker? MR. SPARKS: That's right.

ADM. GEHMAN: I can't read the numbers over there.

MR. BELL: Next chart, please. Talking a little bit more detail about our lower-temperature systems that are used on the upper surface. I talked about AFRSI or FIB blanket. What we have is two glass fabrics, an outer OML fabric which is a quartz, astroquartz material, and S-class IML fabric on the lower surface; and that surrounds a 6-pounds-per-cubic-foot-density batting. This is the insulating characteristics of the blankets themselves. Then just as you would stitch a blanket, we actually stitch, using quartz thread, through the entirety of the blanket itself to hold those together.

Now, a little bit different approach is our FRSI material. Our FRSI material is specifically fiber that is felted. This is a Nomex fiber. It is felted together and produces these sheets. Then we apply a silicone coating to the surface of that, and that is bonded then to the structure itself. We have vent holes, too, for obvious reasons. A little lower density. This material is very good around the work force. Very durable. We actually walk on this material. This is the only TPS component that we actually can walk on.

You can see the difference in the materials is driven by -- we'd love to use this material everywhere, but we can't because of these temperature requirements. That's really what defines those locations where we can put those materials.

Next slide, please. A little more detail. I'm not sure we want to go into a whole lot of this. A couple of features. You know, how do we close out the edges of the blankets? Simply the fabric is wrapped around the edges and then the stitches that we talked about are provided all the way through the blanket itself. Another feature that is interesting about this design is the actual loop part of the stitches occurs at the very bottom of the blanket. That allows this bond line; or when we bond this blanket, these stitches and overlaps are included in that bond line. So if we ever lost -- let's say we broke a thread. We wouldn't be subjected to an unravelling situation where the blanket could unravel itself.

Next slide. When we talk about our tile systems, you'd be negligent to not include our gap-filler systems. In between our tiles, we have a gap. If that gap is deemed to be out of tolerance or specifically designed to be large, then we would come in and include what we call a pillow-type or pad-type gap-filler which, simply stated, it's batting with fabric wrapped around it, similar Nextel or quartz fabrics that we talked about for the AFRSI blankets themselves.
We include a strip of Inconel foil. This Inconel foil provides some stiffness that allows us to handle these parts and install them. We have some features that we include in specific areas for design purposes where we would add a piece of sleeving to the surface of that.

We get down to where we would have design cases. In some areas we want to protect that gap a little more. We actually build into our tile system this lip. This lip protects the gap-filler in that gap a little more, and then we come in with our gap-filler underneath it. And there's what we call a double lip and single lip type of installation. On the acreage portion of the vehicle, we utilize a lot of -- and you'll see a lot of these -- what we call RTV or ceramic-coated Ames gap-fillers. These Ames gap-fillers, you can think of them as almost like playing cards; and we can include up to six layers of these Ames gap-fillers to deal with either out-of-tolerance gaps or to deal with flow conditions that we've witnessed and inspected down the cavity itself. So we'll install those on an as-needed basis.

Next slide, please. The penetrations. Penetrations are a difficult thing to deal with. An ideal vehicle would have no penetrations on the lower surface of the vehicle. Obviously, for many reasons, we don't have that luxury. The major penetrations that we're talking about here are the nose landing gear door, a very critical area because it's very hot in that region, as well; the mains, which everybody has had a lot of attention on; the ET doors; body flap seals; and then elevon cove seals. On the upper surface, we have our rudder speed brake, we have around our thruster, the forward RCS thruster module, around the hatch, and then around our hinge line. There are places that TPS needs to be included. It certainly doesn't get the attention that the big acreage stuff that you can see, but it is probably as or more critical than the other systems.

Let's go to the next slide and talk more detailed about that. There's a lot that goes into dealing with how we keep heat out of these locations where we have penetrations. The nose landing gear door, again, I touched on it being a very critical area. It's very critical because this is in a very hot area, and actually for this nose we have a triple-redundancy NR seal on the forward edge of the nose. There's an OML thermal barrier, what we call a primary thermal barrier, and then an IML thermal barrier; and that is backed up by a pressure seal that we have or an environmental seal, if you will, that seals the surface of the structure together, closing that door itself. This kind of shows the three barriers in place. The reason we have the redundancy here obviously is because of the extreme environments and heating.

Let's go to the next slide and talk main landing gear door thermal barrier. This shows a difference between an old and new design. It's a pretty good example of what the barrier is itself. We start with a Nextel sleeving and Nextel fabric wrapped around an Inconel spring tube. This Inconel spring tube supplies stiffness into the part that allows it to retain some compressibility. If it was just batting or other material, we wouldn't get a spring-back that we need to maintain our seal.

We used to come and bond in. Every time we had to replace a barrier, we actually had to bond in this barrier into place. Very, very time-consuming. Very labor-intensive. Difficult bonds to make in situ. A redesign that occurred included a standoff, if you will, that had an attach plate; and this aluminum attach plate snaps into place. So now we have piece parts that we can apply much quicker to include into the design of the vehicle. Helped maintenance significantly.

When we start to talk about elevon cove and even the body flap cove, it's a very difficult area to deal with because it's a dynamic environment while the heating is occurring. We have moving parts here occurring that we have to protect. It all centers around what we call our hinge tube. We have a primary seal here and then a secondary curtain seal on the back side of that. The tiles are designed to protect the seal itself here and here, and then we have actually AFRSI blankets installed inside this cove to deal with any heating that might get through and into that panel itself. The rest of the components obviously have to move in situ with any movement around that part.

Next slide. I wanted to go into a little bit about damage history as far as our vehicle goes and what we typically have seen as far as impacts to our vehicle. We use this greater than 1 inch as kind of a criteria that we track our larger impacts. There is no significance about that size in particular. For the fleet average, we have about 30 impacts of that size every mission and with a total number of impacts, including the ones that are less than an inch, of about 144 per flight. The average tiles --

MR. WALLACE: Can I interrupt you with a question, Mr. Bell? This fleet average of 30 impacts, can you give an historical perspective on at the very beginning of the program? I mean, was there an expectation that there would be a number of impacts?

MR. BELL: Obviously you're probably pre-dating me with that question, but I certainly can go back and know that the requirement for TPS is that there would be no impacts to that system. That's in our OVEI document and that still exists today. That has not changed. So early on in the system -- and I've gotten this from those that have preceded me -- early flights, they were even concerned about having cracks in tiles and obviously having to deal with those type of changes and evolving into where we are now.

MR. WALLACE: We've seen these sort of numbers, and they seem to be fairly level. I mean, while there are some extreme cases, the trend is fairly flat. I mean, can you tell me sort of from a standpoint of the TPS program is this something that has just sort of become -- and I know that you don't cause these impacts, you're the victim of these impacts.

MR. BELL: Sure.

MR. WALLACE: But you work with the other elements. Is this just like an ongoing effort to lower this number?

MR. BELL: From the TPS standpoint, we are primarily looking at these numbers and these numbers come out of our post-flight reports that we generate every flight if we see a movement in these numbers or these have been treated as our baseline. Now, what we really look for is anomalies, very large damages, or a case where you would have a significant number of damages that are out of the norm; and that drives us generally to go and pursue that further.

I think if we'll go to the next slide, what you'll see is -- next slide, please. If you look at these impacts, you know, there's a variation from flight to flight. You know, here's a significant case; and I've got another slide that will kind of point out those events. Generally, what we're using this data for is to point out, say, significant event or changes from that baseline that you kind of defined.

ADM. GEHMAN: This slide here is actually Columbia?

MR. BELL: This is 102.

ADM. GEHMAN: This is OV 102. This is Columbia minu