|Columbia Accident Investigation Board Public Hearing
Tuesday, April 8, 2003
9:00 a.m. - 12:00 noon
Hilton Houston Clear Lake
3000 NASA Road One
Board Members Present:
Admiral Hal Gehman
Brigadier General Duane Deal
Dr. Sally Ride
Dr. Sheila Widnall
Dr. Douglas Osheroff
Dr. John Logsdon
Mr. Steven Wallace
Mr. Richard Blomberg
Mr. Dan Bell
Mr. Gary Grant
Columbia Accident Investigation Board
Public Hearing - April 8, 2003
Good morning, ladies and
gentlemen. This public hearing of the Columbia
Accident Investigation Board is in session. We're
going to continue learning about various parts of
NASA's handling of safety items, safety issues.
This morning we're privileged to have in
our company Mr. Richard Blomberg. Mr. Richard Blomberg
used to be the chairman of the Aerospace Safety
Advisory Panel and has looked at these issues for many
years and probably is as knowledgeable as anybody. So
we're delighted to have you with us and thank you very
much for helping us.
Before we get started, I would like to
ask you to affirm to this panel that the information
you're giving us today is correct and accurate, to the
best of your current belief and knowledge.
THE WITNESS: I affirm that.
Thank you very much. If
you would introduce yourself and give us a little bit
of a biographical comment, and then we'll ask you to
make an opening comment.
testified as follows:
MR. BLOMBERG: Thank you, Mr. Chairman
and members of the board. I am currently the president
of Dunlap Associates, Incorporated, which is one of the
oldest human factors consulting firms in the world. I
have been with Dunlap for 35 years. My work focuses on
transportation safety and particularly on how humans,
hardware, and software can work together to prevent
accidents. I've also been extensively involved in
From August 1987 through March 2002, I
was associated with NASA's Aerospace Safety Advisory
Panel as a consultant member, deputy chair, and chair.
The ASAP, as it is sometimes called, was formed by an
act of Congress after the Apollo fire in the late
1960s, to be an independent safety adviser to the NASA
administrator and the Congress itself. Although the
panel dealt with the full range of NASA's aeronautics
and space activities, the space shuttle was obviously a
main focal area.
For much of my 15-year tenure, I was the
team leader of the panel's subgroup that examined
activities at the Kennedy Space Center. As the panel's
human factors expert and then its deputy chair and
chair, I participated on most of the other fact-finding
teams and visited all of the NASA human space flight
facilities and major contractors on a regular basis.
Since leaving the Aerospace Safety Advisory Panel, I
have continued my involvement with the space shuttle as
an independent consultant to some of the contractors.
Thank you very much.
MR. BLOMBERG: You're welcome.
Very impressive. Let me
ask the first question, and then we'll pass it around
to the panel. I noticed that the ASAP has been
concerned over the years about NASA's investment in
basic infrastructure and test equipment and things like
that, based on an assumption that there would be a
system that followed the shuttle; and then there were
some announcements that the shuttle is going to be
extended much longer, to 2012 or maybe even 2020. So
that takes care of that problem. I mean, now we've got
enough time to amortize investments in infrastructure
and test equipment and things like that, which is good.
Now we've got a problem about ageing aircraft and
whether that's a reasonable engineering goal so the
shuttle can operate safely until 2020 or 2012 or
whatever the number is. Do you have views on that
issue about how we would determine what is the proper
life for a research-and-development vehicle like the
MR. BLOMBERG: Yes, I do. The panel
looked at that very carefully, both from the top down,
so to speak, and from the bottom up. In other words,
we looked at the total system and tried to consider its
ability to fly to 2020 or beyond, because we were
firmly convinced that it had to. Even with the
rhetoric concerning a new vehicle, we didn't see the
capability to develop such new vehicle on the time
frame that people were talking about. So the notion of
having a new human-rated space vehicle, for example,
within eight years just was unrealistic, by the time
you go through all the funding cycles and approvals;
and, further, there were no new enabling technologies.
We felt that there were two main areas
where you would need some breakthroughs before you
would have a better vehicle than the space shuttle, and
those areas were propulsion and materials. We didn't
see anything out there that was notably better than
what was being used in the shuttle.
So we really came to the conclusion that
if you built a new vehicle, what you'd end up with is
an upgraded shuttle-type vehicle, so why not upgrade
what you have and follow the models that commercial
aircraft and military aircraft had used for years. So
we felt very strongly that the vehicle was capable of
flying as long as NASA needed it and was capable of
doing the job safely. What concerned us was that there
was no investment in the future and therefore there was
no ability to take advantage of new safety improvements
that could make the vehicle even safer. And it was an
opportunity loss that really, really concerned us more
than a degradation of safety. Because we were
absolutely confident that the NASA folks and the
contractors would never fly the vehicle if safety
deteriorated. It's a requirements-driven system. They
either met requirements or they didn't fly. And in my
experience, I've never seen a program and a work force
as dedicated to safety as the shuttle and its
contractors. But they also were dedicated to achieving
their goals and sometimes those two objectives can
clash if you don't have sufficient budget.
So what was happening and what concerned
me and what I reported to the Congress last year was
that they were deferring a lot of safety upgrades and
deferring investments that were needed for the future.
That wasn't sacrificing safety immediately because all
the requirements were being met, but they were pulling
in the funding needed for long-term improvements in
order to fly safely today and they would not be able to
recover from that down the road.
Would you comment? What
are your views on how you get out of that loop? As the
shuttle gets older, it requires more maintenance and,
as you mentioned, it's a requirements-driven system,
but the requirements of today are not the same as the
requirements in the early Seventies and so essentially
every flight gets more expensive. You have to start
making infrastructure upgrades and safety upgrades; and
metal which was not designed to last 25 or 30 years,
you have chronological problems. So I think it's not
hard to imagine that while you could continue flying
the shuttle safely as long as you invested in the
things that you mentioned, essentially it keeps getting
more expensive every flight. So you're in a loop where
you can't invest in the things that you need to to get
out of this -- that is, the next program. I hate to
use the word "gracefully degrade," but how do you break
MR. BLOMBERG: Well, I don't think the
loop is quite as difficult to break as you're
characterizing it, Admiral. I think, first of all, if
expense is the issue -- expense and safety, first of
all, are not necessarily tied. There can be things
that are expensive to deal with that are not safety
related; but if you have an obsolescence issue and
you're dealing with expensive parts, that's when an
upgrade is called for. And in most cases with the
space shuttle, there were upgrades identified that
would deal with the cost issues. Now, you were never
going to deal with the basic problem that the vehicle
is very difficult to maintain. It's very
labor-intensive and it takes a lot of care and feeding,
even when it's brand-new, but that's inherent in the
In terms of safety, I think the two
things that were needed, as I mentioned, one was
upgrades, where you've got new technology that's safer.
An example, the general-purpose computers. The space
shuttle's computers are back literally from the dark
ages. They're performing very well, but there's
additional capability -- for example, giving the crew
predictor information -- that they don't have right
now, that the new electronic displays are capable of
doing if they had computer power behind them. I mean,
that's an upgrade that would improve safety.
The other area is additional analyses.
The analyses on which the design was based, as you
point out, were quite old and they were based on flying
a hundred missions but over a relatively short period
of time. So it's time to go back and find out where
those analyses break down when you extend the life.
The hydrogen line on the pad, for example, that failed
and delayed a launch was an example of something that,
had one said this has to last for 40 years, there would
have been weld inspections on that line; but since the
requirements weren't stated for 40 years, nobody
inspected the line. So I think you have to revisit
those requirements and change them as necessary to fit
the age of the vehicle; but if you do that, I think you
could fly the space shuttle at a reasonable cost for
the space shuttle and certainly at an increased level
of safety from where it was being flown.
MR. WALLACE: I'm from the civil aviation
sector. You mentioned the sort of civil aviation
model. I'd like to pursue that a bit further, as to
whether or not there are advances to be made that would
be sort of in the nature of what we call a derivative
aircraft. I mean, the Boeing 737 was designed over
40 years ago and it's still being produced at a great
rate although what's produced today, in many respects,
just aerodynamics and engines, bears little resemblance
to what was produced 40 years ago. Is there likely to
be derivative or incremental improvements to the
shuttle, or is it time to start with a clean sheet of
MR. BLOMBERG: Well, as I mentioned
earlier, Mr. Wallace, I think that starting with a
clean sheet of paper means going back to do some basic
research in propulsion and materials that hasn't been
done yet. So if we were to start a new vehicle today,
I think a derivative vehicle would be the way to
proceed because we have a lot of operational experience
with the shuttle and it's well characterized. I think
the civil model that you're pointing out, I think there
are two variants of that. One is the derivative
aircraft like the new generation 737, which takes
advantage of all the operational experience of the
older generation. The other is retrofitting the actual
old vehicles, which some of the airlines, for example,
have done about the DC9 and gotten a very efficient and
passenger-friendly and pilot-friendly vehicle. I think
both could be done.
There was an example of that. Endeavor
is a derivative of the space shuttle. It was not
certainly the same as Columbia or Challenger or the
earlier vehicles, but it was based on them and then
putting the multifunctional electronic display system
in the space shuttle has upgraded the flight deck quite
a bit. There were other derivative kinds of proposals
on the table, some of which may have been worth doing
and others may not have been; but it would have taken
some more R&D to determine whether they were valid or
not. So I think both of those models would have
worked; and from my opinion, I think the space shuttle
could fly well into the 2020s without any problem if it
were the subject of a program such as the airlines or
the military do with their older aircraft.
MR. WALLACE: Would you point to any
particular guiding principles for driving the
derivative upgrade process? I'm thinking about the
current ASAP report which just came out in the last
couple of weeks which identifies the current
human-rated requirement of a crew escape system which
will function through the full range of powered flight
and recommends that that be retroactively applied to
the shuttle. Could you speak to that?
MR. BLOMBERG: Well, that was something
that we started working on; I guess it was three years
ago now. This is the third year that that's been in
the ASAP's report -- two years when I was chair and now
this year. I think that's tied to the themes that we
had also of the reality of the service life of the
space shuttle. The government -- and I won't say NASA
because NASA is not master of its own destiny when it
comes to budgets -- the government had made decisions
at first that the space shuttle was only going to fly
to 2006 and that the new vehicle was going to be on the
drawing board. Then when that didn't happen, it kept
creeping out in two-year-or-so increments; and so there
was never a payback period that would warrant looking
at an upgrade as significant as a crew escape system,
which is clearly in the billions of dollars, not
millions of dollars.
What the panel started saying three years
ago was, look, this vehicle is going to be flying for
25 years more probably, that's the reality, and the
lead time for anything -- and you've picked an extreme
example -- the lead time to get a full crew escape
system into the vehicle is maybe a decade under current
engineering. Maybe you can move it down to eight
years; but in reality the new brakes when they were put
in, took eight years. The last upgrade to the
general-purpose computer took eight years from
authorization-to-proceed to first flight. So something
as complex as a crew escape system, assuming a decade
is not unreasonable. We were saying, "But you've got a
decade. If you get it in there in a decade, you've
still got probably 15 years to use it; and that's very
That's what we were trying to get
everyone -- the Congress, the Office of Management and
Budget, and NASA -- to listen to, that you can't creep
up on these things because it takes too long to
respond. The latency, the response time in the shuttle
system, even for just procurement -- if you just decide
to buy spare parts of the same vintage that you have
now, many of the critical components can take three to
five years to acquire. That's not counting the
paperwork and the authorizations and the contract.
That's just from the time you sign the contract. Some
of the turbine wheels, for example, take 13 or 15
months to machine. So you've got to stay ahead of
this, and they were not, because they didn't have the
So the budget shortfall was forcing them
to take a very short-term view in order to maintain
safety. They had to meet all the current requirements,
and so every cent they had, just about, was going into
meeting the short-term requirements with Band-Aid
DR. OSHEROFF: Well, we now know that
there are only three shuttles left; and I dare say that
if we lost another one, I suspect that the entire
manned space shuttle program would be in jeopardy. I'm
not wishing to predict something. Do you consider the
design of the shuttle to be an intrinsically safe
MR. BLOMBERG: Well, Doctor, as a safety
professional, I never say anything is or isn't safe. I
think you're dealing with a risk-management issue and
what is safe under certain circumstances or acceptable
under certain circumstances may not be under others.
As an example, this country is at war right now and the
military will be flying aircraft in conditions that
they'd never fly them on training missions, because of
the risk trade-offs of not flying them. If we had a
crew stranded in space and we needed to launch a space
shuttle right now, my recommendation would be to go
ahead and launch it because I think it is inherently as
low-risk a vehicle as we have to carry humans into
space and do the job.
Can it be less risky? Yes. Absolutely.
There are identified risk-reduction measures that can
make it safer or less risky to fly the space shuttle,
but we're still dealing with an inherently dangerous
environment. We've got 7 million pounds of thrust at
liftoff. The analogy I like to use when I speak to
people is that's on the order of 45 to 55 Boeing 747s
stacked end-to-end, at full thrust. That's a lot of
power. The re-entry conditions are extremely hostile.
No atmospheric aircraft comes close to meeting those
So we're never going to have a perfectly
safe vehicle. We're never going to have a vehicle, at
least with the current technology, that's as safe as
the airliners we all fly on; but I think for a
human-rated vehicle, the space shuttle is a good
design, a risk-manageable design. It's a design that
is well understood, that the folks can manage well
enough to keep the risk as low as is humanly possible
for that environment. I think that's all you can ask
for when you're dealing with a dangerous situation.
DR. OSHEROFF: Well, let me ask another
question, then. That is, how would you characterize
the safety record of the shuttle, given that it is, in
fact, an experimental craft?
MR. BLOMBERG: Well, I don't want to be
flip about it, but I would use two terms, "magnificent"
and "unacceptable," because any accident is
unacceptable but given what the space shuttle has had
to do and has been asked to do and the environment in
which it flies, I think its safety record has been
actually very good. Again, I'm not saying that two
accidents is an acceptable number by any means; but it
is a very, very dangerous situation. If you look back
at the history of military aircraft test flights in all
of the services and you look at the loss rates -- in
the Fifties, for example, a jet aircraft, which is
about the same maturity level that we're talking about
human space flight -- the loss level and the accident
level was much, much higher.
DR. OSHEROFF: Then you would
characterize this more as a vehicle under development
rather than a ready-for-flight vehicle. Is that
MR. BLOMBERG: Well, I think the chairman
described it as an experimental vehicle; and I think it
is an experimental vehicle and will remain an
experimental vehicle certainly for our lifetime. You
cannot fly six times a year, let's say, on average --
it's actually less than that -- in any environment and
call a vehicle operational. That's just not realistic.
I don't know care if it's a submarine, an aircraft, a
ship, an airplane, or a space plane. If you're only
flying it a few times a year, it is an experimental
DR. OSHEROFF: Thank you.
GEN. BARRY: Mr. Blomberg, good to see
MR. BLOMBERG: Nice seeing you.
GEN. BARRY: Two questions, if I can.
John, pull the microphone
over to you. There you go.
GEN. BARRY: I'd like to afford you an
opportunity to comment on your testimony last year.
You were quoted -- and I'm paraphrasing -- in April
that you were more worried than you've ever been before
on the safety of the shuttle program -- not the exact
words you used, but I'd like you to give the full
context behind that comment. I know you've already
commented on a few things; but if you could give us a
full context, that would be helpful.
The second question that I'd like to just
have you comment on is when you were in charge of the
ASAP, under your purview you reviewed the movement from
Palmdale to KSC and JSC and then also the movement from
Huntington Beach to JSC and KSC -- Palmdale to KSC and
Huntington Beach to Kennedy and Johnson. If you could
give us a little background on your views on those
moves and how significant they were.
MR. BLOMBERG: Okay. Well, as to your
first question, General, my remarks to the Congress
were, I think, almost verbatim what you said. I said
in all the years I've been involved, I've never been as
concerned as I am right now. I went on, though, to say
I'm not concerned for this flight or the next flight or
perhaps the one after that but I am concerned in the
long term. You can light a fuse that is slow-burning
and takes a long time; and my concern was, as I've
stated earlier, that the failure to put some money into
the long term and to plan for flying this vehicle in
the years 2012, 2015, and beyond, was sowing the seeds
for a decrease in safety or an increase in risk out in
those years and doing it in a way from which you could
not recover because there was no way to just go down to
the spare parts supplier and buy new parts, that you
had to take action and it had to be done quickly.
I was trying to get their attention,
frankly, and say, look, you've got to act now. This is
not something you can argue about for two or three
years because if you argue about it for two or three
years, you run the risk that the safety level of the
space shuttle is going to decrease over time; and
that's unacceptable to all of us. It's unacceptable, I
know, to NASA, it's unacceptable to the contractors,
and certainly it was unacceptable to the ASAP to see
the safety level slide backwards when there, in fact,
were identified ways to have it move forward.
So what I was saying was, please, act now
because the really dedicated people who are maintaining
this vehicle are getting to the limit of what they can
do with ingenuity. Sooner or later they're going to
need cash; and it's really sooner, not later. So
that's what I was saying to the Congress.
If you take the quote out of context, as
has been done, it sounds as if I was predicting this
tragedy; and I certainly was not. I was as surprised
as everyone else that there was an accident and I still
do not see necessarily a connection that something they
failed to spend money on in the past caused this. When
your board comes up with a probable cause, it may show
that. It may show that there was something that could
have been done if some research money had been spent
that was identified early on, but we won't know that
until you come to a conclusion.
As for your second question, I think it
relates very strongly to what we on the panel
identified as one of the three major components of
safety for the space shuttle; and that is work force.
The space shuttle is a very labor-intensive vehicle,
and it requires people who fully understand how it
operates and its care and feeding and, also, the
differences among what was then the four vehicles.
While they are similar, they're by no means identical.
The folks at Palmdale, to take your first
example, were experienced initially in building the
vehicles and then in doing the major overhauls, the
orbiter maintenance and down periods and the upgrades,
installing the electronic displays and so forth. That
heavy maintenance experience was somewhat different
from the line experience that the folks had at the
Kennedy Space Center; and, in particular, the
management of heavy maintenance in the aircraft
industry and aerospace industry is somewhat different
than line maintenance management.
On a line maintenance basis, you want to
get your aircraft back into service as quickly as
possible and as safely as possible for the next set of
flights. You want to meet your passengers the next
morning. When you deal with heavy maintenance, you're
talking about rolling a vehicle out that's got another
five years of service life and is as close to zero time
as you can get it.
From a management standpoint, those
philosophies are quite different; from the floor work
force, it's not so different. They get a job card to
do a particular job, and they do it. We felt that
Palmdale had unique experience in the heavy maintenance
arena and therefore maintaining that experience was an
asset to the program, although an expensive asset. It
was a luxury.
What ended up happening with the budget
cutbacks was that the work force at Palmdale kept
getting cut back. Every time an orbiter rolled out, a
major proportion of the work force was laid off; and
each time they recalled them, they were getting about
75 percent and then 60 percent coming back. So you
were dealing with new work force anyway, and that was a
The program decided to move the heavy
maintenance to KSC, or considered that. We looked at
it very, very carefully on the ASAP; and we concluded
that under the then-prevailing circumstances with this
loss of work force and capability in Palmdale that, as
long as the requirements were maintained, as long as
there was no cutting back on the requirements, that the
work could be pursued as safely at KSC as it could at
Palmdale. We did not delve into the cost issues
because that was not within our purview. We took it at
face value that it was going to produce a cost saving.
With respect to the move from Huntington
Beach to JSC, I think many of the same things applied.
We were very concerned about the potential loss of
engineering talent and experience that was in the
Huntington Beach work force, which had already moved
once from Downey to Huntington Beach -- and that was a
move that was more easily controlled because it was
basically local, you just changed your commute. This
was requiring people to uproot their families and move
from the Los Angeles area to the Houston area.
We had numerous exchanges with the Boeing
folks about this and got reassurance that the process
they were dealing with was sensitive to this and that
while there would definitely be a perturbation in the
system that everybody acknowledged, they were aware of
it and knew its dangers and would therefore track it.
So we were comfortable that if it was the right thing
to do economically and from a program standpoint, that
the people were on top of it and it would settle down
eventually and it would not compromise safety because
nobody would allow it to. In other words, if they
didn't have the engineering talent to make the
decision, they just wouldn't fly.
DR. WIDNALL: I have a couple of
questions. You mentioned earlier that you saw no new
enabling technologies, say, in the area of propulsion
and material that would really justify starting a new
program. Do you see new technologies that are related
to ease of maintenance, because you also mentioned how
expensive the shuttle program was? And part of that is
do you think the new technologies related to ease of
maintenance would be viewed as exciting by the
researchers and the engineers who would be pursuing
MR. BLOMBERG: Well, Dr. Widnall, I think
the answer's very clearly that there were lots of new
technologies or new applications of technologies that
would help both maintenance/obsolescence issues and
safety, would improve incrementally safety, not a
breakthrough, not a hundred times, but certainly
meaningful breakthroughs in many areas. In terms of
the romance of it and the excitement of it, I wish you
could have been, for example, on our visit when we went
out to meet with the people who were looking at new
technology for an electric auxillary power unit, just
as an example. Those people were so excited about what
they were doing and so involved that it was really
I think the people involved in the space
shuttle -- and I know in aerospace in general, because
I work all sides of aerospace -- are very, very caught
up in the field. I sometimes refer to it as an
addiction. Those of us who are involved in aerospace
don't do it for the money. Certainly it's not the most
highly-paid industry around. It's because of the
romance. It's because it's the only way to deal with
your interest. If you're interested in human space
flight, there's one program. That's it. You're on the
space shuttle. If you're interested in building the
next generation of commercial aircraft, really right
now there are two or three manufacturers.
So I think there was more than adequate
romance and more than adequate enthusiasm even for the
smallest components down to literally
30 and 40 thousand-dollar changes in processes that the
people really believed in, suggestion box items. I've
been out to third-tier suppliers for which the shuttle
is a very, very small proportion of their income, it's
not a financial issue, but where they really want to
make an improvement and have been thwarted because
there's just no budget for it.
DR. WIDNALL: I guess another part of my
question is -- because we have talked about this strain
on resource and balancing the future with the present.
Do you think there's a minimum number of shuttle
flights per year that could be conducted safely? I'm
talking about work force issues and facility issues
and, you know, dropping below a sort of certain
MR. BLOMBERG: Yes. I personally believe
that, and I think most of the members of the ASAP
believe that there was a floor. As I recall, the
National Research Council Committee said the floor was
four; and we resonated pretty well with that. Clearly,
if you go below some level as yet to be specified, you
lose capability. You also aren't really saving all
that much money because if you keep your work force
around, your cost is there and they're just idle and
that's not particularly beneficial.
So my own feeling personally, not
speaking for the panel or anyone else, is I would
certainly not want to see it go below four unless there
was some compensatory development programs going on
simultaneously. For example, if you were building a
new orbiter, you could then fly maybe three or two and
still keep capability. But it's just absolutely
essential to keep that experienced work force involved,
engaged, and working on the vehicle to keep their
DR. WIDNALL: Let me challenge you just a
little bit on this issue of culture because, as you
know, I'm a professor at MIT and so I'm dealing with
our students. I can only imagine the discussion if I
went into the class of these students and told them
that they weren't going to go to Mars but they were
going to develop a new pump. I think there is a
discontinuity there that would affect many of the sort
of what I would call aerospace advocates, and I believe
very strongly that we have to kind of make that
cultural change to emphasize the importance of doing
the job right and doing it reliably. So I really
resonate with what you say.
MR. BLOMBERG: Well, and I resonate with
your comment. It's been quite a few years since I
taught at the university level, but I do give guest
lectures every once in a while and I've met with a lot
of students. You're right, but part of that -- and I'm
not saying this in a pejorative way -- is the naivety
DR. WIDNALL: Thank God for it.
MR. BLOMBERG: Thank God for it.
Absolutely. But part of it is also the lack of a firm
objective. When we had the Apollo program, the nation
was committed to putting humans on the moon; and
everybody was caught up in that. Right now we have
that spirit within the NASA programs because everybody
is caught up in the space shuttle and the international
space station; but when you back that up to the
university level, it looks as if it's mundane. When
those folks come out, however -- and I would recommend
to you, if you haven't done it, that you track some of
your five-year-ago graduates, even from an elite
university such as MIT, that have gone into the space
program and find out what they're doing. You'll find
out they are working on what they would have considered
minutia back in school and they're loving it because
they can see their involvement in the total program and
the criticality of it.
So I think we need both. We need to have
a mandate for a national commitment to a space program
with some reasonable short-, medium-, and long-term
objectives; and we also need to support our current
flight programs better than we're doing. They can't be
done on the cheap, and they can't be done based on just
the ingenuity of the work force. It can't go on
DR. WIDNALL: Thank you.
DR. RIDE: Just a little while ago, you
mentioned that there are some numbers of identified
risk-reduction measures that could be put into place.
I wonder if you could discuss those.
MR. BLOMBERG: I could discuss a few of
them. I didn't bring a list of them and, of course,
not all of them will prove out by any means; but I
think I mentioned one that's near and dear to my heart
because it's a research area that I've done a lot of
work in, which is adding predictor information to the
display so the crew have a better situational awareness
of what's going on. It's great to have all the ground
support for the flights, but still it's the crew that
are on the leading edge, the cutting edge of what's
going on, and they have to know what the vehicle is
doing. Right now they're not getting the best
information that they could get. So that's a safety
improvement I would like to see.
The general-purpose computers was another
area where the program has been forced to work out ways
to extend the current GPCs as long as the program
lasts, which is just not taking advantage of modern
The auxiliary power units. Right now
they're hydrazine powered, which causes significant
explosive risk during flight and significant risk to
the work force on the ground. Electric APUs were
looked at. They were very close to a reality. They
were expensive. That was a fairly expensive retrofit.
They were lacking a little bit of battery technology
development which the industry said was, as I recall,
something on a less-than-two-year time frame with a
reasonable development program. They could have had
the battery technology.
There's health monitoring of the main
engines that I recall, better health monitoring systems
which would get you out of a lot of first-stage
difficulties, first- and second-stage difficulties in
the launch. For example, you would not have premature
shutdowns of a healthy engine which could get you into
an abort profile situation when you could actually
reach orbit. The panel was very concerned about
aborts. They're not something that you want to fly.
I'm just thinking through the vehicle.
There were TPS improvements that were probably more in
the area of obsolescence and cost but also toughened
the tiles a bit against impact damage. The foam that
everybody has been speaking of. There were programs
looking at different blowing agents that were on the
Then there were the larger-scale things
that were longer-term, like adding a fifth segment to
the solid rocket motors so that you could reach orbit
with a main engine failure right off the pad, and other
things such as that that were on a larger scale.
So there were things -- and I didn't dig
out my list of all these things that were briefed to
us -- but there were things literally from the
50,000-dollar kind of level up to the 5 billion-dollar
level, I guess probably the most expensive one being
the full crew escape system, that were all at various
stages of conceptualization and development. Some were
actually developed and virtually ready to go in. GPS
navigation is an example. We just kept after that on
the panel because it just never got in. There were
some antenna problems and some minor difficulties; but
with a concerted effort with the smart engineers
around, those could have been solved. Again, they took
money; and there just was no money available.
DR. RIDE: What about in the area of risk
MR. BLOMBERG: There were some advances
in risk assessment. NASA had used risk assessment, we
thought, pretty well. The risk assessment models that
were developed at headquarters were used appropriately.
From a safety panel's viewpoint, one of the things that
concerned us was that people have a tendency to use
probabilistic risk assessment numbers as gospel, and
they are really a relative design tool. You know,
whatever numbers comes out of your model is not an
absolute. It depends on all the assumptions that you
put in. So we looked at that and we followed the
development of the new risk model at headquarters and
we were rather satisfied it was being used at an
appropriate level and used also appropriately to
supplement the engineering judgment of the people who
knew and understood the vehicle very well.
I'd like to follow up on --
go ahead, Dr. Logsdon. I'm sorry. Go ahead.
DR. LOGSDON: Earlier you said,
Mr. Blomberg -- and I think I've got the quote right --
that budget shortfalls forced meeting short-term
requirements with Band-Aid solutions. Could you give a
few examples of Band-Aid solutions?
MR. BLOMBERG: Well, one that comes to
mind -- and this is certainly not, by any means, at the
top of the list of most important or most significant
from the safety standpoint -- is the data cables that
run from the data center out to the pads at Kennedy
Space Center. These are old paper-jacketed cables,
metal cables, into which water has intruded; and they
keep losing pairs over and over again. The solution is
to put air pumps on at various places along the cable
and flow air in to keep the water out, as opposed to
spending the money -- and it was not an enormous amount
of money in the scheme of things -- to put fiber optic
cables in and replace them completely, which inevitably
will be needed.
Now, the argument was -- the
rationalization, I should say, was that it's probably
not safety related. If the cables fail, we just don't
launch; but it doesn't take much imagination to say if
the cables fail at just the wrong time, just the worst
situation, that it could be a safety problem. So it
all depends on how you look at it. If you look at
worst case, then maybe it was. Was it Priority 1?
Absolutely not. But is it an example? Sure.
The siding on the Vehicle Assembly
Building, which blows off in the wind and is a problem,
is another example of something that really needed
attention that was just Band-Aided, just stick it back
on for now. The roof of the VAB.
Then lots of things, mostly in the
infrastructure. Test equipment. There's still cathode
ray tube test equipment, even when the systems that
they're testing have been upgraded once or even more
than once; but the test equipment was never upgraded
Dr. Widnall was talking about her
engineers. I would venture that she doesn't have too
many engineers who understand vacuum tube technology
too well coming out of MIT right now or who can program
in HAL. So those are the kinds of things we're talking
DR. LOGSDON: Let me go to the other end
of that quote: "In the days after the accident, there
were a fair number of press reports that the shuttle's
safety budget had been cut by 40 percent." Does that
comment make any sense to you? Is there an
identifiable shuttle safety budget, and where would
that 40 percent number have come from?
MR. BLOMBERG: Well, my guess -- and I
haven't analyzed it -- but my guess would be that it
comes from the budget for the Safety and Mission
Assurance office and function within NASA and probably
within the contractors. Again, that has to be placed
in context because after Challenger, there was an
enormous expenditure in that arena for things such as
redundant inspections; and the aerospace industry has
realized in recent years that redundant inspections not
only don't improve safety but they can actually be
detrimental to safety. So a lot of that reduction in
budget, I would assume, having not looked at the press'
numbers; came from what were rational and reasonable
cutbacks in excessive expenditures for things like
redundant inspections and for things that were passed
over to the contractor to do and were still being done.
So we did not on the panel see that level
of cut. We did comment several times and expressed
concerns several times about the degree of work force
cutback across NASA, which included the safety and
mission assurance function but also included the
engineering functions and the training functions and
everything else. We felt very strongly that they were
going down way too far and way too fast; and we spoke,
I think, loud enough and long enough that we got heard
and turned the curve around and got it to go back up.
Because, again, of the experience level you need. This
is not an industry where you can go out and just hire
new people when you need them and have them be
DR. LOGSDON: Did you look at the
mentoring relationship between the new folks coming
into the shuttle processing world and the people that
had that experience?
MR. BLOMBERG: We sure did. Not only
that, we looked at that very carefully in the context
of giving more responsibility to the contractor,
because we said that the new NASA folks coming in in a
smaller work force were not going to have the ability
to learn on the job and get that hands-on experience.
And we argued very strongly for a mentoring program
across the two groups so that NASA folks could mentor
with contractor folks and vice versa because unless you
kick the tires, so to speak, you really can't
understand this vehicle. There were programs such as
that in the works. So we were pleased with the
response to our recommendations in that area and the
actions that were taken.
DR. LOGSDON: You say programs in the
work. Did they happen?
MR. BLOMBERG: Yes. A lot of times the
ASAP made recommendations to NASA and they were
concurred with, but the following year we'd look at
them and it was a concurrence in name only, there was
no budget, nobody did anything. In that area, the area
of mentoring and the area of training, there were some
very, very positive steps taken to correct the issues
that we raised.
DR. LOGSDON: Did ASAP have a view on the
privatization effort and its impact on shuttle safety?
MR. BLOMBERG: We probably had about
30 views on it, Dr. Logsdon.
DR. LOGSDON: Well, you're here today.
Let's hear yours.
MR. BLOMBERG: Okay. Well, first of all,
it depends on how privatization is defined.
Privatization was initially defined as going to the
Space Flight Operations Contract, the current contract;
and we had some concerns about the form of the contract
that, frankly, turned out to be unfounded. They were
theoretical concerns, and they were very well handled
by both sides in the transition.
In recent years there's been talk about a
total privatization, essentially giving the vehicles
and the infrastructure to a private contractor and just
letting them operate; and, very frankly, I feel that
that is very naive, very unrealistic, and will never
happen. I mean, there is nobody out there, I think,
who would want to take on that responsibility unless
they're indemnified; and if they're fully indemnified,
then the government is gaining nothing except the
So the cost is going to go up. So if
there's some political reason why you don't want
government work force working on it, then I think that
can work; but you'd have to be very, very careful of
the transition. It's not the steady state that you
worry about in those things; it's the transition from
one state to another. You've got a program that's over
20 years old, 25 years old really. It's been flying
for over 20 years; and to try to change its culture
overnight by saying it's totally privatized and
removing the checks and balances that everybody has
become accustomed to could entail some increased risk.
It could be done. I would prefer to see it done in the
next program and design it from the ground up.
If you want a privatized program, then
design it from the ground up; but with one customer,
the government, and a limited number of flights and an
unknown liability for things like the infrastructure --
you know, what does it cost to change a roof on the VAB
or the side panels or to meet environmental concerns if
they should come up -- I just don't see it being
realistic to transfer to a private contractor
DR. LOGSDON: Under SFOC, there are a
particular set of incentives. Was there any concern
that those incentives diminished the emphasis on safety
by USA or were you -- you, I guess, as an individual in
this case -- confident that USA could operate the
vehicle as safely as the civil servants had done in the
first 20 years?
MR. BLOMBERG: Well, my answer on that
has to be time-dependent. When I read the Statement of
Work for the contract to USA, I had great concerns. I
was concerned, for example, about the incentive fee for
meeting launch on time. I thought that was ill-advised
because the last thing you want to do is tie some money
to a launch decision. That has to be made purely on
risk grounds. I was also concerned that the safety
measures against which the contractor was going to be
evaluated were defined by the contractor, and so you
could end up with a situation where you managed to the
metrics rather than managed to the safety of the
vehicle. That was in theory.
In practice, we looked at USA's
performance very closely. I know the folks there very
well and have followed their performance, and I think
it's been exemplary. They have called launch halts
whenever necessary -- in fact, at points where I
probably would not have called them personally because
I thought it was ultraconservative, but it's better to
be ultraconservative than the other way around. So I
think the performance has been right on what you would
want. They have the safety culture that is necessary.
That doesn't mean it's a hundred percent effective.
That doesn't mean it can't be improved, but my concerns
at the outset really did go away.
DR. LOGSDON: One final question. This
is, I think, a giant extrapolation from what you have
said this morning; but let me ask you about it. You've
said you see no progress in materials or propulsion
that would justify investment in a new vehicle, that
the shuttle has to fly past 2020, and that there are
lots of improvements that could be put into the
shuttle. Would you recommend building an updated
version of the shuttle design, one or two?
MR. BLOMBERG: Again, without knowing the
full budget picture, just from an operational safety
standpoint for the space shuttle program, I would
absolutely recommend that. I think the finest thing
that could be done right now would be to take all of
the knowledge that the people have of the space shuttle
system and all the additional knowledge that your board
is going to produce, which is scrutinizing the system
more than it's ever been scrutinized in recent years,
and put that into one or two additional orbiters and
when those come on line, maybe retire the oldest of the
current ones. I think that would be the best thing
that we could possibly do both for the safety of flight
and for expanding our knowledge of human space
Absent that, I would certainly like to
see the existing vehicles upgraded with as many of
those things as is reasonable to put in. We were
talking about escape, for example. It might be a lot
easier and more cost-effective to put an escape system
into a new shuttle vehicle than to try to retrofit the
existing vehicles and cut through the existing mold
So I would certainly love to see that and
I think it's a way to go while simultaneously
commencing the basic research-and-development programs
that you need to have a radically new vehicle. Because
it's not just going to happen. There's no market out
there for building efficient reusable rocket engines
unless it's for a human space vehicle. So NASA and the
country are going to have to do that and work on the
materials side, but it's unclear how long it will take
to get the breakthrough you need to have a
significantly better vehicle than the upgraded shuttle
that you're talking about, the shuttle derivative,
DR. LOGSDON: Thank you.
Mr. Blomberg, among the
other tasks that this board has, including finding the
direct cause of this accident and making
recommendations to prevent it, we also have to place
our report, in terms that I've used, "in context." As
the chairman, that's one of my specific problems is to
place our recommendations in context.
One of the contexts is the life of the
shuttle program, which is something that we've talked
about before. If we're near the end of the shuttle
program, our recommendations would have a certain
flavor to them. If we are only 50 percent of the way
through the shuttle program, as has been suggested that
we're going to be flying shuttles until 2020, we're at
the halfway point. We've lost 40 percent of our
vehicles at the halfway point.
This problem of putting it in context is
weighing on my shoulders; and I was struck by some
words in the last ASAP report that you signed, which
was last year's, technically, 2001's. I would like to
read something here. I'm not going to throw these
things back in your face, but I want to allow you to
talk to us about it.
This was finding and recommendation
No. 1. "Last year, concern arose that the planning
horizon for the space shuttle and the international
space program was too short, imperiling the
development, advancement, and adaptation of safety
improvements" because you couldn't amortize them or you
couldn't justify them -- my words. "It is now
recognized that the space shuttle will be used well
beyond 2012, a longer life span than was originally
anticipated. Now serious safety concerns are currently
ranged around the potential for lost opportunities in
safety improvements which can lead to safety problems
as ageing systems deteriorate." In other words, now
we've got a new set of problems. "The panel believes
that the space shuttle is fully capable of supporting
the ISS for its entire life."
So my understanding of what I just read
is that by extending the program life, we now have
eliminated the excuses for not making infrastructure
upgrades and all the safety things that you have
mentioned, which I value that as a good thing -- that
is, if there's money there -- but now we have a new
problem and the problem is, of course, ageing and
deteriorating systems. My first question is: Have I
characterized that approximately correctly?
MR. BLOMBERG: Yes, I think you have,
although I think it's a matter of emphasis. I don't
think the ageing issue per se is anywhere near as great
as the other issues, the issues of not upgrading the
vehicle. I think the ageing issues could very likely
give you some graceful deterioration, whereas the
upgrades could give you some quantum jumps in safety or
reductions in risk.
The reason why the ageing
problem is stuck on my forehead so well is because of
the theory of the unknown unknowns, that it's turned
out that the parts of the shuttle program, the parts of
the STS which were viewed to be the most dangerous have
not failed -- it's always something else which has
gotten us, it seems -- and we feel that if you're going
to continue to fly this thing for twice as long as it's
already flown, there has to be an aggressive program
out there looking for what we call the unknown
unknowns. In other words, you've got to start looking
for trouble. I believe that can be done, that we have
other examples of aircraft that are working kind of at
the edges of their margins, that are old and things
like that -- military aircraft and civilian aircraft.
The second part of my question, though,
gets to the comment about the relationship between the
shuttle and the ISS. Do you believe that they are
MR. BLOMBERG: Absolutely. I mean, the
ISS was designed to the shuttle's capabilities, with
some help from the Russian vehicles and a little bit
from the European vehicles, but basically to the
shuttle's capabilities. Frankly, from my own
perspective, it would probably be a poor economic
decision for the country to build another vehicle to
service the ISS because the next-generation vehicle
might have a totally different mission. So why not, as
long as the space shuttle is capable of servicing the
ISS throughout its entire life, keep that symbiotic
relationship going. I mean, it was designed to
re-boost the space station. They were designed to
exchange consumables in both directions, if necessary.
So I think just a very simple answer is to keep the
space shuttle flying as safely as possible as long as
you are doing the space station and then think about
what the mission is for the next vehicle, whether it's
the support journey to Mars or some other purpose.
Going back to your first remarks also, I
would like to point out that the kinds of safety
improvements that we're talking about are not only
hardware, software, and even ground infrastructure.
We're talking about training. We're talking about
re-analyses to understand and characterize the vehicle
better for its now realistic lifetime. So that while
there were life limits placed on every component -- you
could only keep an external tank in storage for so many
years and you could only keep a solid rocket motor
segment in storage -- those limits are no longer
realistic, and it's time to redo those analyses.
Well, as Dr. Widnall was saying, that's
not romantic -- romantic from the Congressional
standpoint. "Why do I have to redo an analysis? Did
you get it wrong the first time?" It's millions and
millions of dollars, but really that's what's
necessary. It was done after Challenger. The failure
modes and effects analyses were all redone. The
critical items list were all redone, based on
Well, now we have a lot of additional
experience in both directions. We know that there are
things that were originally characterized as Critical 1
items that aren't Critical 1. They're not
Criticality 1, and there are other things maybe that
were not categorized as Crit 1 that are now, because of
ageing conditions, and either should be changed out or
made redundant or some other changes. We need to
All of the computer models that were used
to develop the space shuttle in the late 1970s have
been upgraded multiple times, the materials models, the
flow models and so forth. What are the implications of
those on the vehicle in both directions? Were we too
conservative with those things, or were we too liberal?
Did we misunderstand?
I believe that the requirements, down to
the most minute requirements, need to be revisited by
the people who understand the system, to determine
whether they need to be upgraded. The simple example
that the program went through, I don't know, about five
or six years ago with a new pressure-sensitive adhesive
in the solid rocket motors -- they couldn't use the one
that was spec'ed, because of environmental concerns,
and they had a requirement of a certain peel strength.
They went out and found another adhesive that met the requirement. It was right in the middle of the range of the requirement, and it didn't work. When they went and re-analyzed it, now scrutinizing it, they found out that they had been flying at two or three times the requirement and they really needed it. They bought the best off-the-shelf stuff and it was much higher than the requirement, and that was absolutely necessary.
So falling back on a spec that was
written before you flew the vehicle doesn't have a lot
of meaning. You now have over a hundred flights. It's
time to re-do that. It's a costly process, it's not a
romantic process, it doesn't produce things that are
impressive to the public, but it is absolutely what
goes on with commercial aircraft, with military
aircraft, and it should be going on with the space
You are aware, of course,
of NASA's budget and the kind of limitations on their
budget. As I understand it, you are recommending that
we consider upgrades to the shuttle to keep it fully
capable of flying for another 20 years, given certain
conditions that you've outlined here; but we also have
to get to work on the next manned spacecraft. This is
going to be a tremendous pressure on a budget.
MR. BLOMBERG: Well, maybe. You know,
there was a lot of money spent in the NASA budget,
during the 15 years I was on the ASAP, that was not
productive. Billions were spent on the advanced solid
rocket motor. It never flew. Millions or billions --
I'm not a budget expert -- were spent on the X-33 and
the X-34. They never flew. I think that even within
the present budget confines, it's possible to support
the international space station and the space shuttle
to the fullest extent that they need and have a
technology development program that will support a next
generation; but if you try to initiate a new vehicle
program, to develop a vehicle from scratch when you
don't have the technology -- so you're doing the
technology development and the vehicle development at
the same time -- then you're not going to have enough
budget. That's what happened, I think, with X-33.
Instead of going and working on the technology areas
that were clearly needed to make X-33 work, they
embarked on building a test vehicle. I just am a
believer in finishing what's on your plate before you
take more, and I think supporting the ISS and shuttle
adequately is first priority for the country.
MR. WALLACE: Let me switch to sort of a
pure human factors type of question. We're a little
over two months in this effort, and I have to say there
are no lack of processes at NASA. I mean Flight
Readiness Reviews and COFRs and Launch Readiness
Reviews and all the processes leading up to that; and
every time we ask a question, we get lots of paper.
Really, I mean it's a tremendously methodical, thorough
set of processes; yet the investigation has raised some
troubling questions about sort of communications and
decision-making and flow of information up and down.
My question is sort of human factors. Is there a point
at which people find too much comfort in processes,
where processes might actually stop thinking? Admiral
Gehman talked about the unknown unknowns.
MR. BLOMBERG: You certainly can be
over-proceduralized and can be process-bound. That is
one of the things that can happen to an organization.
I don't think it has happened to NASA. However, any
big organization, any organization as large as NASA
will have some communications issues and it is always
difficult to determine how much should bubble all the
way up to the top, to the administrator's level, for
example. Frankly, there is a real question of whether
you want the administrator making ultimate technical
decisions because the administrator is just that, an
I think in the 15 years I observed NASA,
I think the processes were not perfect but certainly as
good as you could expect from a large organization, and
improving. It's an overused phrase, but continuous
improvement was there. Now, not everything that was
done was an improvement; but people were watching it.
I think the processes are sincere. I think everyone
within the system is truly dedicated to safety; and the
big change that I saw over the 15 years on both sides,
contractor and NASA side, was when I first joined the
panel, I would say that the likelihood of a randomly
picked person in the system standing up and saying,
"Time out. We're not going to fly. I'm stopping the
flight," was very low. Today I would say it's
virtually a hundred percent, that anyone out there,
from somebody turning a wrench to a middle manager to a
senior manager, would feel absolutely empowered, if
they were uncertain, to say, "Stop," and they would be
listened to, that it would not be something that they
would say, "No, you don't know what you're talking
about." It would be at least run to ground very
professionally before a decision was made; and
certainly if time was of the essence, they would not
fly. That, to me, is the essence of a good safety
MR. WALLACE: Well, I didn't mean to
suggest that more decisions needed to go to the
administrator's level at all. I understand. But just
to follow up on your answer where you say anybody can
stop the process, in your experience, is there any
change, post launch, in terms of that sort of thing?
MR. BLOMBERG: Well, of course, the
options available to you post launch are fairly
limited. The post-launch environment and the launch
countdown environment, I think once you start into a
launch countdown and then you go on from there to the
post launch, you really do want to be procedurally
bound. You want to be requirements-driven. You do not
want to be defining waivers on the fly.
A waiver sounds like a terrible thing. I
know when I first got into the aerospace business, I
said, "You mean you're waiving a requirement? You're
agreeing to fly in an unsafe condition?" Well, that's
not the case, in virtually every situation. A waiver
is a carefully thought-out process by which you decide
that something is an acceptable risk. You don't do
that under time pressure while you're in the middle of
a launch count. You don't do that while you have a
crew up in orbit and make decisions on the fly.
So, you know, if the flight rules say,
"If such and such happens, you come home," you come
home. Then you work it out. You know, if it turns out
that you were wrong, that it was a sensor failure
rather than a true failure of the system, you've taken
the conservative approach. So I think that that's
where you have to draw the line in this is when do you
have to be procedure-bound and when can people have
some leeway in the system and call it.
Even though it might sound conservative,
I would not want somebody, while a flight was in
process to say, "Time out. Bring it back." That's not
the way to go; but, "Time out. We ought to study this
and see whether we ought to bring it back tomorrow,"
that's what the Mission Management Team is for and
things will get elevated to that team very rapidly. It
depends on the context of what you're dealing with.
GEN. BARRY: One of the things we're
trying to understand is a little bit about the
management structure, and I'd like to see if this
resonates with you. We're going to talk pre-launch and
post launch. Pre-launch, obviously Challenger, a lot
of focus has been spent on improving the process,
particularly in a certification of flight readiness.
If we characterize that and we said, okay, pre-launch
is centralized, it is focused on competition between
centers a little bit, where all the centers are
involved in certification of flight readiness, and
there is, some would some argue, an attitude that
you've got to prove there is no problem. Post launch
is more de-centralized. It is only really one center
primarily involved and that's the Johnson Space Center
and, as some would argue -- and we're trying to figure
this out -- that you have to prove there is a problem.
Does any of that resonate with you insofar as pre- and
post-launch considerations are?
MR. BLOMBERG: Well, it does resonate;
but I think, General, that it may be a bit of a
simplification. Pre-launch, I think you have a whole
series of what I would call challenge-and-response
meetings that culminate in the combined Flight
Readiness Review, but really every element and every
subsystem has its own Flight Readiness Review that
start way before that and it's a series of challenges
based on what you know about the system and its recent
performance. So if there was a hiccough on a previous
flight or during processing or the previous flight of
that vehicle, then you've got to clear that; and that
starts way down with the sub-tier people, each of whom
goes through a bunch of challenges. I would agree with
your characterization that it's "Prove to me that it's
safe to fly," but it's an incremental process.
Once the flight is up, the focus shifts
to JSC for sure, but, remember, there's a Mission
Evaluation Room operating not only at every human space
flight center but at all the major contractors and
those rooms are there specifically to support their
elements and the issues. So I guess my short answer is
I agree with you except with the caveat that it has to
be clear that the JSC folks are not trying to make
technical decisions that are outside of their technical
areas. They rely completely on the technical
specialists. If it's a propulsion issue on the
thrusters, for example, they would go to the thruster
specialists. What they are specialists in is mission
operations and once you're operational and once you're
flying, they know all of these requirements and the
rules and so they know to really turn to you and say,
"You told me from your analysis that if this happens,
if so many of these fail, we have to come back. We're
coming back because you told me that." And if the
specialists were to say, "Well, we really didn't mean
that. It's okay to go on," then -- I can't recall a
situation where that's happened and they've won; but if
it were to happen, they would certainly have to produce
some very, very compelling analyses and produce them
virtually instantaneously. For example, they probably
have had to have a change request in the system already
for that to happen. So my take on it is that your
characterization is a good one and the system is a good
one. That's about the way it should go.
GEN. BARRY: Let me follow up on that, if
I may. If it is a rather structured process going up
prior to launch with the Certification of Flight
Readiness -- and I think the next hundred flights for
the shuttle are programmed to go to the space station,
a couple are going to Hubble, so other than just the
space station -- some have proposed an idea of having a
certification of re-entry readiness. In other words,
you have an associate administrator who signs off on
the Certification of Flight Readiness and we have a
de-centralized focus with the Mission Management Team,
the MER, and you have also, of course, the flight
director involvement. If we are on the space station,
should there be a more centralized focus on re-entry?
MR. BLOMBERG: That's actually a very
complex question because the first thought I have is it
depends on what countermeasures you have available that
would make that certification a valid certification.
If you have no ability to fix the vehicle or to bring
the crew back any other way, then it's kind of a moot
point. If there are things you can do, if there are
alternatives, then that has a lot of appeal as long as
it doesn't get in the way of all of the other things
that are necessary for safe mission operations.
Re-entry is not just getting in and pushing a button
and saying, "Let's go down." There's a lot of crew
preparation. There's a lot of support needed from the
ground; and as long as that review doesn't get in the
way of those things or supplant any of them, I don't
see where it would hurt; and it might help.
Mr. Blomberg, I was
thinking here to myself that in support of one of your
comments here when we were talking about re-entry --
having looked at re-entry things, checklists and things
like that -- I was reminded that one of the things on
the re-entry checklist is to put all the laptops away,
which supports your argument that we've got to upgrade
the computer systems because what we're doing is we're
carrying a lot of laptops up there because the computer
systems won't handle it. Earlier we had this
discussion about whether or not the shuttle is a
research-and-development or an operational vehicle and
I think I heard you say -- and I'll give you a chance
to comment -- it's closer to being an R&D vehicle than
a transportation system.
MR. BLOMBERG: Well, I don't even think
it's close. I mean, it is an experimental vehicle.
Just the fact that it's flown over a hundred times
doesn't change its nature. Every flight is an
experiment. Every flight is gaining knowledge. It's
not an airline, by any means.
We may be using the terms
loosely here as to whether it's an experimental vehicle
or an engineering development model vehicle or
something like that; but in any case, we are in
agreement that this is an experimental vehicle. But it
is being used in an operational sense.
MR. BLOMBERG: Well, that's true and I
don't think those things -- I think that's a semantic
issue more than a technical issue. It's being used for
the repetitive support of the international space
station and for flying humans into space on a regular
basis, but that doesn't change the nature of the
vehicle. That nature arises, for example, from things
such as you've got multiple copies and they're not all
identical by any means, that the technology that's
being used in the vehicle is not widely-used
technology, or much of that technology. It doesn't
come from the nature of the mission.
Of course, there's no law
against using an engineering development model or an
experimental vehicle in operational use. In the first
Gulf War, the military's JSTARS was still an
engineering development and was used. The Predator
unmanned aerial vehicle was used in Bosnia that was
still technically under engineering development. So
there's no law that says you can't do that. I'm still
working on this context thing, and I want to get your
views. I want to get this thing clarified. So it's an
experimental vehicle and we're still learning about the
environment in which it operates and particularly this
Mach 24, 300,000-foot altitude environment which we
know precious little about for a winged manned vehicle,
but it is being used for operational purposes also.
Now, the question I have relates to your
building another one. If we're in agreement on those
two points, do you think it's reasonable for an
experimental vehicle to have a 40-year life?
MR. BLOMBERG: I don't see anything that
precludes it. I mean, I don't think we have any models
to follow for that. This is a unique situation,
probably one that we've never been in before; but given
the care that went into the design of the vehicle and
that has gone into its operation, I don't see anything
that precludes that.
Let me rephrase the
question, then. Let's forget about NASA and forget
about the shuttle program. Do you think the United
States should evolve into manned flight into space by
not evolving itself for 40 years?
MR. BLOMBERG: Well, Admiral, you know,
if you ask me do I think that the United States made a
poor decision perhaps 20 years ago in not spending the
money to have a shuttle replacement ongoing, I would
say yes; but if you also ask me would the country be
better served by not having human space flight until a
shuttle replacement is produced, I would vehemently say
no, I mean, that human space flight is important, we
are learning a great deal from it, we are accomplishing
things in space, and the shuttle is fully capable of
supporting that at an acceptable, albeit not perfect,
level of risk.
Now, would we have been better if we had
Shuttle 2 now or some other vehicle? Probably. But we
didn't make that decision. So right now we have to
play the cards that we're dealt. The cards that we're
dealt is the only human-rated vehicles that we know of
on this planet are Soyuz and Shuttle, and Soyuz can't
do the job. So it's going to be Shuttle.
DR. OSHEROFF: Well, first let me say
that your team won last night. I'm sure you're happy
about that. I noticed that. I have no stake in that.
Stanford did not make it in that part.
I wanted to bring up a question. When my
graduate students do something with a cryostat, which
is actually a kind of extreme environment and things go
wrong and they end up having to warm up and fix things,
I always tell them that they learn far more from their
failures than they do from their successes. I think
that goes well beyond graduate students doing research
projects, as well.
I think it is fair to say that we have
some good ideas as to what led to the loss of the
Columbia and her crew. We certainly don't know for
sure and we're not willing to identify anything at this
point; but assuming that we've done that, can you give
me some ideas as to what the lessons are that we need
to learn? I guess I'm particularly interested in the
issues of risk management and risk abatement.
MR. BLOMBERG: Well, this is an area
which I've examined quite thoroughly, not only for the
shuttle but particularly aircraft accidents that I've
been involved in. The reality is that the sequence of
events is that whenever you have a human vehicle, a
vehicle that's going to transport humans, you do as
much analysis as you can possibly do -- and I'm
including testing in that -- to make it as safe as
possible before you operate it. But as the vehicle
gets more and more complex, it is absolutely impossible
to check out every interaction and every type of
failure and every situation that the vehicle will
encounter. Therefore, in those places that you
consider to be most risky, you build in redundancy, you
do whatever you can, and you hope that your operational
experience, the closed-loop feedback, will give you
that additional experience, as you operate the vehicle,
to upgrade it.
Mr. Wallace was talking about the airline
industry. This goes on all the time, whether it's
brakes or various components of aircraft that reports
come back from operators saying, "We're having trouble
with this." The manufacturer looks at it and says,
"Oops, we missed that." We didn't miss it because of
dereliction of duty. We missed it because it's a maybe
a second or third order of interaction, but now we can
fix it. We've got this operational experience.
Unfortunately, part of our operational
experience in any vehicle is accidents. We hope it
never gets to that, but it is part of the reality of
operating, particularly in a high-risk environment.
When there is an accident, we get a spinoff benefit;
and the benefit is that we get the resources to focus
in on the area that was involved in the accident and
then a wider part of the vehicle. Challenger is a
perfect example. There was a focus in on virtually
every high-risk component of the vehicle, and a lot of
improvements were put in.
I think that is the natural progression
of things; and your students, when they destroy an
experiment or have a problem with the laboratory, learn
from that. You'd hope that they don't learn by someone
getting injured or a high-cost destruction of property;
but regardless, as long as we close the loop and as
long as we didn't do anything intentional, deliberate,
or uncaring -- we are fallible. I mean, I'm a human
factors person, and I'm the first one to tell you that
humans are perhaps the most fallible part of any
system. We design the systems, we operate the system,
we make the decisions to go, and so somewhere in
whatever you're going to find for Columbia, humans
The question that I would want to ask is:
Did we fail through malice, did we fail through
neglect, or did we fail through ignorance? If we
failed through ignorance, let's learn from it, let's
increase our vigilance, and make the system better and
keep that closed loop going. That's all we can do in
DR. OSHEROFF: I would suggest that
there's another possibility and that is that the
failure was through a faulty process which did not
properly identify some of the risks and which would
then have allowed NASA to take steps to minimize those
MR. BLOMBERG: Absolutely. That is certainly a possibility; but if that's the possibility, I would speculate that that process failed because we didn't understand it, not because we short-circuited it or because anybody deliberately said, "Oh, it's okay. Let's go full speed ahead." That's part of the understanding. It's not only characterization of the materials and the software and so forth, it's characterization of how people and processes work. That's an integral part of it, and the whole shuttle program has been struggling with that now for years and doing a pretty good job of process control and understanding that processes are, in many cases, as important as products, as the hardware and software that results from them. So they've developed a process failure modes and effects analysis technique and some other things.
It's very likely that -- it's assured --
I mean, I am sure that whatever caused the accident
escaped a process at some point. It had to have,
because it flew. So at some point in the process,
somebody missed it; and it may have been my panel. We
may have been staring it in the face and missed it, but
it wasn't for lack of trying, I'm convinced, on the
part of all concerned, because, as I said in my opening
remarks, I just have never seen a system more safety
conscious and people more dedicated to safety. That's
not a hundred percent assurance; it just says that
their hearts are in the right place.
DR. OSHEROFF: Well, I fully agree with
you, but I think that we really have to look at what
processes may need improvement and I'm sure you agree
with me on that.
MR. BLOMBERG: I do, Doctor, but with one
variation. I think that the time to do that is after
you've decided what the proximate cause was. The
processes are in the root cause domain, and right now
my understanding from your statement is you're still
struggling with understanding the proximate cause.
Once you understand that, then I think that's the time
to step back and say how did that slip through all of
DR. OSHEROFF: Well, let me suggest --
and I think that NASA's already suggested this --
inspection of the shuttles in orbit, with the ability
to repair at least the tiles, if not the RCC panels.
MR. BLOMBERG: Well, even if that doesn't
turn out to be the cause of the accident, that may be a
positive outcome of the investigation, saying here is a
technique, is an ability that we had that we weren't
making maximum use of. That's the kind of improvement
that I was talking about that comes out of this intense
scrutiny. Again, I don't think that we're dealing with
an escape here that anybody can be faulted for not
having realized, because the operational experience
just didn't point to it.
DR. OSHEROFF: I'm sorry, I have
absolutely no intention of assigning fault to anyone.
This is an extremely complicated vehicle and the
process of certifying it for flight readiness is
extremely complicated, but I think we have to set aside
the issue of fault and, in fact, not identify that but
recognize the processes that must be changed.
MR. BLOMBERG: I fully agree with you.
I'm just saying I think it's a matter of timing, and I
think that is done most effectively after you
understand the causes and, you know, you have to work
backwards from the effects and then say what processes
were there that could have caught this and are
reasonable to perform. I venture that you will find in
some of your blind alleys, some of the theories that
you've checked out that don't turn out to be the cause
of this accident, you will still be able to back those
out to improved process because you've scrutinized
those so much. That's a terrific benefit of the kind
of investigation that you're doing. It's just the
question of when to do it.
DR. OSHEROFF: So the idea of minimizing
risk is certainly one that's very valuable.
MR. BLOMBERG: That has to be the
overriding principle of the entire operation is risk
management and minimizing risk and understanding the
risk you're accepting. It's not only minimizing the
risks but it's understanding the risk that you've
DR. OSHEROFF: Thank you.
DR. WIDNALL: I'd like to follow up a
little bit on some of the words you've used. I didn't
write them all down, but you said, you know, we know it
wasn't due to malice. Then you had this rather large
catch-all category called ignorance, and I guess I'm
just not willing to allow so much to be in this
category of ignorance. Being a poor engineer, I don't
have a rich vocabulary in organizational theory; but it
seems to me to me words like denial, organizational
structure in the way the various levels work together,
issues of unconscious trade-offs that various parts of
an organization make, I think somehow that vocabulary
has to get into any kind of framework which otherwise
might be called ignorance. I mean, I think we really
need to think deeply about how one organizes an
effective, you know, as you mentioned earlier, large
organization for the whole question of making good
decisions in the safety area.
MR. BLOMBERG: Well, I agree with you
completely; and probably the word "ignorance" was
unfortunate. Being a poor engineer myself, I couldn't
think of a better term. But I wrap in that the clear
issues of things like we don't have the technical
knowledge to understand how a material performs under
certain circumstances because it's never been tested in
that environment and we never looked at it because we
never thought it was a problem, which is another form
of what I'm saying, in quotes, is ignorance.
My own concern is that, with the best of
intentions, any organization -- and I think NASA and
its contractors may have fallen into this -- when
you're so goal-oriented and you're so budget-limited,
you tend to put blinders on and you tend to look at --
in my experience here, they tended to look at the next
flight, let's look at getting this next flight off as
well as we can. Maybe the old not seeing the forest
for the trees comes into play. That's one of the
reasons, for example, why we try to get engineers and
managers in any organization to understand the
end-to-end system so they understand where their
portion fits in and maybe will see some of the
interactions that go beyond just the performance of
their subset. That clearly could have been a problem
The space shuttle people were under
enormous stress, stress from one side of supporting the
international space station and not being the weak link
in the international effort to put a space station up
and, on the other side, the very real knowledge that if
they could not perform within the budget, there was a
risk to the entire program and, therefore, to their
lives, to what they had dedicated themselves to.
I'm absolutely convinced that nobody
said, "Well, we've got to go ahead. I know we're
increasing the risk; but if we don't do that, we could
lose the whole program." That I would be very sure of,
knowing the people; but whether they inadvertently
missed something because of their zeal and because of
their innovative capabilities remains to be seen.
Certainly they need relief. They're not
going to be able to fly for another 20 years under the
stress levels that they've been asked to fly under for
the last seven or eight. I would liken it to a very
taut rubber band. You can only pull that rubber band
just so far, and eventually it's going to snap. These
folks are being asked to continually pull rabbits out
of hats, and you can't do that forever. I am convinced
that if they knew they couldn't pull the rabbit out of
the hat, they would stop the flight; but as you're
saying, sometimes you think you've pulled the rabbit
out of the hat and all your analyses say that and you
just don't have the tools to give you the proper
DR. WIDNALL: Or you don't really want to
know the rabbit is in the hat.
MR. BLOMBERG: Well, I think there's very
little of that. I honestly do believe that the folks
on both sides, NASA and the contractor, do want to know
if the rabbit's still in the hat. They understand the
implications of failure. They are very dedicated to
the crews and to keeping everybody safe. So I think if
there's uncertainty, they err on the side of
conservatism; but sometimes zeal can say that you're
certain when perhaps you should have said you're
Mr. Blomberg, on behalf of
the panel, we want to thank you very much for your help
here today. You've been looking at this for over
20 years, and your views are very helpful to us. We
appreciate your very frank answers. We appreciate your
willingness to dialogue with us as we attempt to bring
our level of knowledge up to yours. Your views are
very helpful to us, will make a big difference in the
report, and we want to thank you for your contribution.
So thank you very much.
We'll take about a ten-minute break here
while we seat the next panel.
All right. Ladies and
gentlemen, we're ready to resume here. We're privileged to have join us today a panel. Mr. Gary
Grant is the systems engineer in the Thermal Management
Group for Boeing; and Mr. Dan Bell is in the TPS,
subsystem manager for Boeing.
I'll invite you to make a statement and
give us a briefing or whatever you want to do; but
before we begin, let me ask you to affirm that the
information you will provide to the board today will be
accurate and complete, to the best of your current
knowledge and belief.
THE WITNESSES: I affirm that.
Thank you very much. Would
you introduce yourselves. Tell us your background and
what your current position is.
DAN BELL and GARY GRANT
testified as follows:
MR. BELL: My name is Dan Bell. I am the
TPS subsystem manager for the Boeing Company. I've got
15 years of experience in TPS, TPS installations,
materials. Prior to becoming the TPS subsystem
manager, I was the manager in the Thermal Management
Systems Group in the Huntington Beach facility, also
MR. GRANT: My name is Gary Grant. I'm
also in the Thermal Protection System. I have 14 years experience, primarily in the operational and
turn-around area and requirements. I'm an active
member of the LASS subsystem, and I'm acting as an
assistant subsystem manager in that capacity.
Thank you very much. We're
delighted to have you join us today, and we invite you
to make a presentation or a statement.
MR. BELL: I think we're here to give you
guys a presentation.
MR. BELL: I want to bring up the charts.
Next slide, please.
We're here to kind of bring the board and
give an overview of our TPS and RCC systems. In this
presentation we're going to talk in some detail about
the reinforced carbon-carbon system, the leading edge
of the vehicle and some other components, what we call
our high-temperature reusable insulation. I think you
all know them better as these are the black tiles on
our vehicle. Our low-temperature reusable surface
insulation, these are the white tiles. AFRSI or FIB --
each of those are kind of interchangeable names --
those are kind of quilted soft goods that we use
primarily on the upper surface of the vehicle. We have
FRSI, flexible reusable surface insulation. These components are a needled felt material that's used on
the upper surface of the vehicle, more durable than our
AFRSI material. Then we're going to go into some
penetrations and seals, those locations on our vehicle
where we have areas that need to be closed out with
different thermal barriers and sealing systems.
Next slide, please. Just to demonstrate
on a very high level where the RCC and these different
components exist. RCC makes up the leading edge
components. The nose cap and what's not shown here on
the lower surface. We also have the chin panel and
what we call the aero head, and that's the forward
attach point for the vehicle itself.
Next slide. When we talk about our
high-temperature reusable surface insulation tile,
those are the black tiles, the upper surface tiles that
are shown here. Most have seen the lower surface --
and we'll get into that -- but the entire lower surface
of the vehicle is covered by those components.
Next slide, please. Our LRSI tile. As
you can see, right around the forward windows and on
the forward edge of the OMS pods themselves, we have
our low-temperature surface insulation tiles.
Next slide. Our AFRSI blankets or FIB
blankets that we have cover a large acreage of the upper surface. These components are lower maintenance
than are LRSI tiles, and that's the primary reason
those were selected over the tile system for that upper
If we go to the next slide. This fills
in the puzzle with our FRSI system. This is a felt
system, very durable and very maintenance friendly,
having workers in and around that vehicle. The
penetration seals and thermal barriers, we're going to
get to on some later charts.
Next slide, please. When we talk about
the environments that our vehicles are exposed to, the
first thing everybody asks is what kind of temperature,
thermal environments we're exposed to. What's shown
here are some data that came off a compilation of data
taken from three flights early on in the program. It
shows you a variation in temperatures from the very
forward edge of the vehicle, lower surface, ranging
from 1900 degrees. Then we have some areas on the
vehicle that we'll talk about a little later on that
get upwards into the 2500-degree range. These
isotherms vary across the vehicle. Our upper surface
of the vehicle sees much lower temperatures, generally
less than a thousand degrees, and varies, depending
upon the location, to as low as 300 or 350 degrees at the top of the payload bay doors.
Next slide. Now, when we go through a
re-entry cycle, what we wanted to demonstrate here is
the change in pressure; and pressure is an important
part of the equation on re-entry. Starting from the
time of re-entry, you can see how the pressure actually
increases as you get further in the atmosphere, as one
would expect. This was taken from a body point forward
on the vehicle surface.
Next slide. I wanted to touch base in a
little more detail on some heating and some very
specific locations. These are some of the more extreme
environments that our TPS, our tile systems see. A
body point on the very forward edge of the nose landing
gear door, Body Point 1024, sees a peak heating of
about 2300 degrees Fahrenheit. On the door itself, the
temperatures start to decrease as we move aft. We're
still getting extremes around close to 2100 degrees
there. We do have a very hot region in between the two
elevons, the inner and outer elevon. In this region we
get some additional heating that causes us to push that
tile system upwards to 2500 degrees.
There are two lines on each
of those graphs. What do they mean?
MR. BELL: I don't think I have the background on this specific slide to answer your
question correctly. So we'll get you that data. I do
know that the lines that were listed there are the
actual temps, though, that were measured at those body
Let me go to the next slide. The TPS
system is very extremely part-count heavy. We have
very high numbers of parts that we have to deal with on
a daily basis. Our high-temperature reusable, our
black tiles, what's listed on the first line there, is
two different systems. One is our LI-900 system, which
makes up the majority of the components,
9-pounds-per-cubic-foot tiles. Then our LI-2200 tiles
make up a smaller subset of that, and we'll get to
those locations on some later charts.
You can look there just with those
systems alone. There's about 20,000 tiles on each
vehicle. TUFI tiles, which we'll talk about, are our
newer introduction to the vehicle; and we have about
306 of those installed on the vehicle. Those primarily
take up the base heat shield and upper body flap
section of the vehicle at this time.
FRCI tiles, which were an introduction
sometime in mid-program, we have almost 3,000 of those
installed. Again, now getting to the upper surface, the upper surface tiles, our LRSI, about 700, actually
800 tiles with varying density of substrates. Then if
we look at the amount of area occupied by our FIB or
AFRSI blankets and then our FRSI, we're talking over
2,000 square feet for each one of those systems. It's
a lot of parts to deal with.
Next page, please. I wanted to touch on
how our system goes together, and it's primarily for
our tiles. Well, let's start at the top of our system.
The tiles are a substrate, which three of the
components that we are currently using up there are
listed. LI-900, LI-2200, two of the original
substrates from Day 1 on the program, still occupy the
majority of our substrate material. We have a material
called FRCI 12 which was introduced at a later time.
It's got some benefits from a strength standpoint.
Then we have what's not listed up there, an AETB-8
material, an 8-pound-per-cubic-foot material that
accommodates us the use of a TUFI coating on that
These three substrates have the same
coating, our RCG coating, reaction-cured glass coating,
over the surface of that. We then take that substrate,
the base of the material is densified, and we bond onto
that what we call SIP. It's a strain isolation pad. That is bonded to the base of the tile with an RTV
system, which is a silicone. It's a two-part silicone
system, and that two-part silicone system is then
bonded to the structure. We have multiple types of
structure that we actually bond to.
One of the features of our design system,
as you can see, is this component. This is what we
call filler bar. Filler bar allows us to have a seal
in between two adjacent tiles. So if you can
imagine -- you kind of see in this gap here. If we had
another tile that would sit into this hole here, this
piece of filler bar would be covered by this tile and
then its adjacent tile.
Next page, please. When we talked about
the different types of substrates that we have on our
vehicle -- and this is a little archaic as far as it's
a demonstration of where those parts are located -- the
9-pound material, our LI-900 material, as you can see,
makes up the majority of our lower surface of the
vehicle. It's our primary workhorse from an acreage
standpoint. FRCI 12 -- and this is 102, so it has
actually less FRCI 12 than do the other vehicles. We
have instituted some locations where FRCI 12 has been
installed for different reasons.
LI-2200 material is a higher density material that we use in LESS regions, generally around
penetrations and a highly-loaded region. It's also
used quite a bit around the nose of the vehicle itself.
AETB-8 obviously isn't shown here because
it's on the base heat shield and upper body flap of the
Next slide, please.
GEN. BARRY: One question. Could you
tell us what percentage of the tiles on the bottom are
MR. BELL: We have that data. It's a
pretty substantial number. Most of our tiles. I
believe the number is about 60 percent. We certainly
can get you some accurate data, and I think we have
those charts available and we'll make those available
GEN. BARRY: Thank you.
DR. RIDE: Could I just ask how you chose
the areas on 102 to put the FRCI tile on? You said
that it's less than the other orbiters.
MR. BELL: Sure. The FRCI 12 tiles are
an introduction that occurred after the build of 102.
From a design standpoint, those tiles give us some
benefit because they have some added strength characteristics that allowed low-margin tiles to be
upgraded and in some cases we went forward and upgraded
specific areas of low-margin tiles that would benefit
from that strength.
DR. RIDE: So it looked like the doors of
the wheel wells, the inboard doors of both wheel wells?
MR. BELL: Actually this forward edge,
there's a seam that exists under this edge. I don't
think it's really driven by the fact that the doors are
at that location. Yes. And there's some other very
specific areas. FRCI allowed introduction of a
stronger substrate that can accommodate relieving some
of those low-margin areas that we've had to deal with
for 102. We simply installed more of them on the other
vehicles to deal with that, but there was still
attrition mods where FRCI, on the books, that 102 would
have had upgraded at points this time.
Next slide, please. This kind of gives
you a feel. You know, you take a look at the bottom of
our vehicle and you think that it's a nice, flat
surface; but it's really not. We have various
thicknesses of our tiles; and our tiles provide some
contour to the vehicle, as well. You can see in some
of our thinner areas we get down to less than an inch
in thickness; and back on the very base of the body flap, we're talking about tile thicknesses approaching
4 inches in thickness. So a significant variation
across the vehicle.
And the reds are thicker?
MR. BELL: The red ones would be thinner.
Thinner. Then the blues
and purples are thicker?
MR. SPARKS: That's right.
I can't read the numbers
MR. BELL: Next chart, please. Talking a
little bit more detail about our lower-temperature
systems that are used on the upper surface. I talked
about AFRSI or FIB blanket. What we have is two glass
fabrics, an outer OML fabric which is a quartz,
astroquartz material, and S-class IML fabric on the
lower surface; and that surrounds a
6-pounds-per-cubic-foot-density batting. This is the
insulating characteristics of the blankets themselves.
Then just as you would stitch a blanket, we actually
stitch, using quartz thread, through the entirety of
the blanket itself to hold those together.
Now, a little bit different approach is
our FRSI material. Our FRSI material is specifically
fiber that is felted. This is a Nomex fiber. It is felted together and produces these sheets. Then we
apply a silicone coating to the surface of that, and
that is bonded then to the structure itself. We have
vent holes, too, for obvious reasons. A little lower
density. This material is very good around the work
force. Very durable. We actually walk on this
material. This is the only TPS component that we
actually can walk on.
You can see the difference in the
materials is driven by -- we'd love to use this
material everywhere, but we can't because of these
temperature requirements. That's really what defines
those locations where we can put those materials.
Next slide, please. A little more
detail. I'm not sure we want to go into a whole lot of
this. A couple of features. You know, how do we close
out the edges of the blankets? Simply the fabric is
wrapped around the edges and then the stitches that we
talked about are provided all the way through the
blanket itself. Another feature that is interesting
about this design is the actual loop part of the
stitches occurs at the very bottom of the blanket.
That allows this bond line; or when we bond this
blanket, these stitches and overlaps are included in
that bond line. So if we ever lost -- let's say we broke a thread. We wouldn't be subjected to an
unravelling situation where the blanket could unravel
Next slide. When we talk about our tile
systems, you'd be negligent to not include our
gap-filler systems. In between our tiles, we have a
gap. If that gap is deemed to be out of tolerance or
specifically designed to be large, then we would come
in and include what we call a pillow-type or pad-type
gap-filler which, simply stated, it's batting with
fabric wrapped around it, similar Nextel or quartz
fabrics that we talked about for the AFRSI blankets
We include a strip of Inconel foil. This
Inconel foil provides some stiffness that allows us to
handle these parts and install them. We have some
features that we include in specific areas for design
purposes where we would add a piece of sleeving to the
surface of that.
We get down to where we would have design
cases. In some areas we want to protect that gap a
little more. We actually build into our tile system
this lip. This lip protects the gap-filler in that gap
a little more, and then we come in with our gap-filler
underneath it. And there's what we call a double lip and single lip type of installation.
On the acreage portion of the vehicle, we
utilize a lot of -- and you'll see a lot of these --
what we call RTV or ceramic-coated Ames gap-fillers.
These Ames gap-fillers, you can think of them as almost
like playing cards; and we can include up to six layers
of these Ames gap-fillers to deal with either
out-of-tolerance gaps or to deal with flow conditions
that we've witnessed and inspected down the cavity
itself. So we'll install those on an as-needed basis.
Next slide, please. The penetrations.
Penetrations are a difficult thing to deal with. An
ideal vehicle would have no penetrations on the lower
surface of the vehicle. Obviously, for many reasons,
we don't have that luxury. The major penetrations that
we're talking about here are the nose landing gear
door, a very critical area because it's very hot in
that region, as well; the mains, which everybody has
had a lot of attention on; the ET doors; body flap
seals; and then elevon cove seals. On the upper
surface, we have our rudder speed brake, we have around
our thruster, the forward RCS thruster module, around
the hatch, and then around our hinge line. There are
places that TPS needs to be included. It certainly
doesn't get the attention that the big acreage stuff that you can see, but it is probably as or more
critical than the other systems.
Let's go to the next slide and talk more
detailed about that. There's a lot that goes into
dealing with how we keep heat out of these locations
where we have penetrations. The nose landing gear
door, again, I touched on it being a very critical
area. It's very critical because this is in a very hot
area, and actually for this nose we have a
triple-redundancy NR seal on the forward edge of the
nose. There's an OML thermal barrier, what we call a
primary thermal barrier, and then an IML thermal
barrier; and that is backed up by a pressure seal that
we have or an environmental seal, if you will, that
seals the surface of the structure together, closing
that door itself. This kind of shows the three
barriers in place. The reason we have the redundancy
here obviously is because of the extreme environments
Let's go to the next slide and talk main
landing gear door thermal barrier. This shows a
difference between an old and new design. It's a
pretty good example of what the barrier is itself. We
start with a Nextel sleeving and Nextel fabric wrapped
around an Inconel spring tube. This Inconel spring tube supplies stiffness into the part that allows it to
retain some compressibility. If it was just batting or
other material, we wouldn't get a spring-back that we
need to maintain our seal.
We used to come and bond in. Every time
we had to replace a barrier, we actually had to bond in
this barrier into place. Very, very time-consuming.
Very labor-intensive. Difficult bonds to make in situ.
A redesign that occurred included a standoff, if you
will, that had an attach plate; and this aluminum
attach plate snaps into place. So now we have piece
parts that we can apply much quicker to include into
the design of the vehicle. Helped maintenance
When we start to talk about elevon cove
and even the body flap cove, it's a very difficult area
to deal with because it's a dynamic environment while
the heating is occurring. We have moving parts here
occurring that we have to protect. It all centers
around what we call our hinge tube. We have a primary
seal here and then a secondary curtain seal on the back
side of that. The tiles are designed to protect the
seal itself here and here, and then we have actually
AFRSI blankets installed inside this cove to deal with
any heating that might get through and into that panel itself. The rest of the components obviously have to
move in situ with any movement around that part.
Next slide. I wanted to go into a little
bit about damage history as far as our vehicle goes and
what we typically have seen as far as impacts to our
vehicle. We use this greater than 1 inch as kind of a
criteria that we track our larger impacts. There is no
significance about that size in particular. For the
fleet average, we have about 30 impacts of that size
every mission and with a total number of impacts,
including the ones that are less than an inch, of about
144 per flight. The average tiles --
MR. WALLACE: Can I interrupt you with a
question, Mr. Bell? This fleet average of 30 impacts,
can you give an historical perspective on at the very
beginning of the program? I mean, was there an
expectation that there would be a number of impacts?
MR. BELL: Obviously you're probably
pre-dating me with that question, but I certainly can
go back and know that the requirement for TPS is that
there would be no impacts to that system. That's in
our OVEI document and that still exists today. That
has not changed. So early on in the system -- and I've
gotten this from those that have preceded me -- early
flights, they were even concerned about having cracks in tiles and obviously having to deal with those type
of changes and evolving into where we are now.
MR. WALLACE: We've seen these sort of
numbers, and they seem to be fairly level. I mean,
while there are some extreme cases, the trend is fairly
flat. I mean, can you tell me sort of from a
standpoint of the TPS program is this something that
has just sort of become -- and I know that you don't
cause these impacts, you're the victim of these
MR. BELL: Sure.
MR. WALLACE: But you work with the other
elements. Is this just like an ongoing effort to lower
MR. BELL: From the TPS standpoint, we
are primarily looking at these numbers and these
numbers come out of our post-flight reports that we
generate every flight if we see a movement in these
numbers or these have been treated as our baseline.
Now, what we really look for is anomalies, very large
damages, or a case where you would have a significant
number of damages that are out of the norm; and that
drives us generally to go and pursue that further.
I think if we'll go to the next slide,
what you'll see is -- next slide, please. If you look at these impacts, you know, there's a variation from
flight to flight. You know, here's a significant case;
and I've got another slide that will kind of point out
those events. Generally, what we're using this data
for is to point out, say, significant event or changes
from that baseline that you kind of defined.
This slide here is actually
MR. BELL: This is 102.
This is OV 102. This is
Columbia minus her first five flights, which I guess
were considered to be test flights.
MR. BELL: Test flights. And I'm not
sure we had collected the data in the same fashion for
those flights. That may be why it's missing from the
slide. You'll notice that Columbia actually had a
lower average of impacts than the fleet from a 1-inch
standpoint. The location of these impacts is pretty
consistent. It doesn't really vary a whole lot from
the vehicle itself. The TPS system is actually quite
resilient. Even though it's quite easily damaged, it
absorbs these type of impacts very well. It certainly
is a maintenance issue, these sizes of impacts that
we're talking about.
GEN. BARRY: Let me ask a question. We discussed a little yesterday about, of course, foam.
Really the question came up: Can you design an
external tank that will not shed foam? I think most
conclusions are that it's going to be very hard to do
that. If you take that assumption and accept the fact
that you are going to take some hits, you've already
alluded to this design spec originally for the tiles
was not to accept any hits.
MR. BELL: That's correct.
GEN. BARRY: Now, if you have history on
where these things are traditionally hit, you've
already just stated that they kind of reside in the
same areas, for the most part. Are there any designs
right now to strengthen the tiles so the specifications
can be stated as having an ability to accept hits? I
understand there's a BI-8 kind of tile. Can you talk a
little bit more about that?
MR. BELL: Sure. It's kind of been an
evolved process. We started out with our AETB-8 TUFI
tiles, and I've got some charts that will actually show
you. It's pretty dramatic what these tiles have done
for us on the base heat shield as far as reducing
impact damage. Again, let me emphasize that impact
damage was being driven by a maintenance issue. It
wasn't considered a safety issue back on the base heat shield that we were trying to fix, primarily driving
towards that. The implementation from that was very
Now, the issue with that substrate is
that substrate, the AETB-8, does not have a thermal
conductivity or it's not as good an insulator as the
base system that we have on the rest of the vehicle.
So we cannot go in and simply implement that material
because then our thermal load to the structure would
have issues from a gradient standpoint or a local
thermal impact standpoint.
In 1999, we initiated an upgrades effort
to go forward and try to create or design a system that
would accommodate a tough coating that would have the
ability to insulate where we needed to on the lower
surface of the vehicle itself; and what you had
mentioned, that BI-8, or in some cases it's called
BRI-8, it's still in development. It's actually very
close to being completed, and that's something that
we'd like to have that tool in our bag if the program
deems that we need to go and do this type of
replacement. It's not available today.
GEN. BARRY: The bottom line is the
question that could be asked is: What will it take for
the orbiter tile, the TPS tile, to be able to accept hits?
MR. BELL: Well, I think you could
approach this in two ways. Certainly we can imagine
that these type of ascent hits, we can take those hits
now, the typical hits that we have; and we've
demonstrated that if we get the sizes of impacts that
are typical, our system can deal with those very well.
We do have still a maintenance issue that we would have
to deal with. From a TPS standpoint, we would love to
Now, if you're talking about
substantially larger impacts than we are accustomed to
seeing, then we have to do more homework even to
evaluate whether this BRI material installed in these
specific locations would provide us the benefit that I
think you're looking for.
GEN. BARRY: We've been told there are
about 200 to 400 of the 22,000 tiles on the bottom that
are "critical." Is there any attempt to beef those up?
Maybe you could explain why those are identified as
MR. BELL: If I could try to clarify,
there's probably more like 18,000 tiles on the bottom
of the vehicle that are "critical." I would hesitate
to be the person that has to pick out one tile to leave off for the next launch. The tiles I think that keep
coming up, these 2 to 4 hundred tiles, they're
primarily the ones around the penetrations. Those are
already beefed up per se because those are the
higher-density materials. That's not to say that we
aren't pursuing higher-density materials that can
accommodate a stronger substrate, just like we are on
the BRI-8. That work is in process, as well. But
really to accommodate increased toughness of that lower
surface system, it would be difficult to pick out a
specific location. I can kind of take a step back and
say which is the critical tile; the critical tile is
going to be the tile that takes the impact. If you can
figure out what is going to be the location of that
next impact, I can fix or increase that durability or
certainly approach the vehicle as a whole. But I don't
think that you can simply say -- certainly we would
make gains by any replacements. I hate to be very
specific on one location as being critical.
DR. OSHEROFF: You talk about tile hits
that are an inch. I assume that's in diameter at the
surface. How deep are these typically?
MR. BELL: And I'm talking in
generalities here. Lower-surface impacts are generally
very low-angle impacts. So when you're talking about for most of the lower surface -- and I know with some
of the work that we've had going on, if you start to
look at the acreage impacts, you're talking about less
than 10 degrees of angle of incident at various
velocities. So generally the crater depth is very much
driven by the length of the damage or the degree or
mass that impacts it. So generally they're not very
deep. We have seen some deeper ones. I would say, you
know, a half inch would be deep. Most of the damages
that are listed out on the vehicle are typically not
DR. OSHEROFF: And how deep are the
MR. BELL: That would be data that I
would have to go back and pull for you. Certainly we
have not just the foam impacts, we've had an impact,
STS 27, where we lost half of a tile. A cavity in that
one, I would say, would go full depth.
DR. OSHEROFF: Can you say a little
bit -- I think it's pretty clear that most of the tiles
are repaired rather than replaced. Could you describe
a little bit that process, or are you going to do that?
MR. BELL: I wasn't planning on it, but I
would be happy to. We really have three basic repairs.
We have what we call a coating repair. We could think of it as a coating repair. The coating gets removed
from the part. No depth to it really at all. We come
in and apply an additional coating over the surface of
it to preserve our erosion resistance and emissivity
for the next flight. It's a very benign repair.
Then we start to get into different
depths or quantities of, how I can say this, volumes of
damages that we are allowed to repair. Those are
simply a ceramic slurry is mixed up and applied to the
cavity, and what you end up with a high-density putty.
We call them our putty repairs in that surface.
Our next level of repair is, if we exceed
our putty level requirements as far as sizes that we
can repair, we replace the tile.
DR. OSHEROFF: How difficult would it be
to apply this putty in space, from a chemical point of
view? Forget about gravity.
MR. BELL: Any application in space
obviously has its challenges. I think that I would
probably like to not answer that question since we have
an entire team out there driving towards an on-orbit
repair. Certainly the approaches that have been dealt
with previously have not been along the lines of a
ceramic putty repair like we're dealing with.
Let me approach this from a different question. I think I can answer your question without
going somewhere where it's outside of my realm. The
putty repairs that we're dealing with, if our damage is
that we have returned from space with them, typically
they're ascent damages. So those damages existed prior
to the re-entry or thermal cycle. So we would really
have no driver or no need to go and repair that prior
to a re-entry case.
Now, if you're talking about going in and
trying to repair a much larger volume, potentially even
a full tile replacement, the ceramic system that we're
talking about would be way too massive from a mass
standpoint alone, I think, to accommodate that, as well
as it would not necessarily stick to a fractured tile
surface the way that we need to. Generally, we
mechanically lock in those repairs, as well as we get
some chemical attachment. So I don't think that would
be a very good approach, sir.
DR. OSHEROFF: The point is that they
are, in fact, working on how to do this. Is that
MR. BELL: There is a flight techniques
panel which includes 12 subteams, of which obviously
TPS is a big part, that are pursuing this effort.
DR. RIDE: Just a question where you've got this particular slide up. You said that the
patterns of debris hits tend to vary from flight to
flight. I was wondering whether you had seen any
patterns in the hits from certain types of debris. For
example, I think these are the products that you guys
put together, is that right, so you're probably pretty
used to looking at these. I'm just curious whether,
for example, foam coming off the bipods has certain
patterns that you would recognize when you just went
out and started counting these up and looking around
the vehicle and putting together a chart like this.
Where I'm going is that there are a lot of flights
where we don't really have ascent imagery and we don't
know where the foam came off. I'm wondering whether,
just from your experience with the patterns here, one
could go back and take a look at the drawings like this
that you've made for each flight and kind of estimate
where the foam came from.
MR. BELL: The effort that goes into
putting this data together, there's actually a parallel
effort that goes into it by an actual debris group.
They actually build something very similar to this and
they take specific sizes and they are looking for
exactly what you're talking about. They're looking for
anomalies that they can trace back to sources, and they do a better job than TPS by themselves to integrate
those different pieces of data and try to bring that
You know, the bipod ramp is challenging
from a transport standpoint and where it comes off
within the launch and where it would actually impact
the vehicle. The one piece of data that we have been
able to go back in, we had a significant damage on
STS 50; and that STS 50 damage was related back to the
bipod. I believe, if I'm right, that damage occurred
back here. It was, again, a very low angle of impact.
We really don't know what the size of the foam debris
was. All that we know is there was a relationship
between when that came off and the damage that we had.
The damage, I believe, was about 14 inches long, if I
am pulling numbers out of the air here, if I remember
DR. RIDE: Thanks.
MR. BELL: Again, not very deep because
the angle of incidence is very low.
You've got total impacts
and you've got impacts greater than an inch. If in any
of those flights the OV 102 came back missing a tile,
would it have been annotated on there or would that
have made your chart somehow?
MR. BELL: We don't have that
relationship here. The only tile that I know that we
had lost from an impact case was half of a tile, and
that was that STS 27 case. I know of no other losses
of tiles due to impact. We've had significant damages;
but if you're talking about loss of tiles, that is the
case. Now, that case, I have to be very specific.
That case was related back not to foam but SRB ablator,
so a much more dynamic projectile than foam is.
That was Atlantis.
MR. BELL: Yes. Correct.
Would you pull up the next chart. I
think it will kind of go down the path of what you're
talking about. This is primarily to demonstrate that
when we have something that is out of the norm as far
as debris impacts, we normally go back or we have gone
back and related that to a specific event that was
significant. You can see the STS 27 flight, I believe,
is in here somewhere and we're talking about those cone
ablator and the SRB cork. I'm having almost as hard a
time reading it as you.
I think one of my
colleagues here previously mentioned that even if you
take out the spikes, that the trend is flat here.
We're not getting any better at preventing damage to your TPS.
MR. BELL: That is correct. We have not
seen any significant change in that.
Next slide. This is a demonstration. We
really didn't talk about TUFI tiles because it really
isn't applied to the lower surface at this time. I
wanted to show you what it did for us on the lower
surface. On the case on the left, it's not as easy to
see; but all of the tiles had been replaced except for
this tile in the center. You can see the damages that
occurred on that specific tile. On the right-hand
side. These two tiles were replaced. And you can see
the gray marks are previous damages. So these are
repairs that we had done from flight to flight, all the
gray in this photograph.
These are your putty
MR. BELL: These are actually what we
would call slurry repairs, sir, where we simply paint
the slurry on to eliminate the erosion resistance. We
don't really have an aero issue on the base heat shield
of the vehicle. What's significant here that you can
see is all the little white marks. Those are from a
single flight. Those are damages that we would have
had to repair from a single flight. The TUFI tiles have virtually eliminated our need to do repairs like
that. So from an operations standpoint, it was
significant for us.
GEN. BARRY: I understand also the TUFI
tiles shrink. Is that correct?
MR. BELL: That's incorrect.
GEN. BARRY: Incorrect.
MR. BELL: The TUFI tiles, if we were to
put that TUFI coating on our existing substrates, those
substrates, when we would fire them, cannot handle this
type coating and those parts would shrink to something
that would not be usable for us as a system.
GEN. BARRY: So with the coating, they do
MR. BELL: Our AETB-8 substrate with the
TUFI coating on it, it's a very stable material.
Next slide. Okay. This is the point
that, unless you have any more questions about TPS,
I'll hand this over to Gary.
GEN. BARRY: Just one other question. Do
you know of any systematic studies to identify critical
damage scenarios? It really alludes to the fact that
if you can trace where the hits have been and we can
get some kind of data base, which we've asked for, to
be able to say, okay, 80 percent of the hits have occurred on this part of the underside of the orbiter,
then we can take up maybe the issue of how you want to
strengthen it even further to be able to accept hits.
So we're really talking about damage scenarios. To
your knowledge, is there any damage scenarios that have
MR. BELL: I don't know of any, sir.
GEN. BARRY: We still have that question
out. So we're looking for the answer.
DR. OSHEROFF: Can you tell me how much
would it increase the weight of the orbiter if you were
to replace, let's say, the 500 -- I know you don't like
the word "most critical" tiles -- with TUFI tiles?
Roughly speak, how much extra weight is it per tile?
MR. BELL: From a weight standpoint,
these new tiles that we're talking about do not include
a weight penalty.
DR. OSHEROFF: Really.
MR. BELL: Yes. We're actually closely
approaching the weight. So if you ask me if it would
be significant, I think it would be very insignificant.
GEN. BARRY: But there is a difference
between LI-900 and TUFI tile.
MR. BELL: Well, the LI-900 is the
substrate density, 9 pounds per cubic foot. We have an RCT coating on that which applies mass to that system,
and you get a weight. We started out with our AETB-8
or a BRI-8 material, which is 8 pounds per cubic foot
substrate. It's a lower-density substrate to start
off, and we're adding our mass at the coating where we
get the benefit out of the impact resistance. Does
that make sense to you?
Yes. So it's close to the
MR. BELL: Very close. The new BRI-8
system is very close.
GEN. BARRY: Now, there's a difference in
BRI-8 and TUFI. I guess that's the question.
MR. BELL: TUFI. You can think of
TUFI -- the Ames guys might get upset with me here, but
AETB-8 and TUFI coating is intended to be a system.
That system was intended to be used as a single product
and we kind of have gone away from that and looked at
applying that TUFI, which we really refer to it
primarily as a coating and not an article, and we're
looking to apply that material to another substrate
per se that allows us to utilize this in different
DR. LOGSDON: Let me see if I can
reconstruct and understand something you said early on in your presentation, which is that most of the
integrator damage to tiles that you've seen has
happened on ascent and, since the vehicle has survived
successfully re-entry, you do not treat these as flight
safety issues but as maintenance issues. Is that a
fair summary of what you said?
MR. BELL: These are ascent impacts that
we have no control over fixing them on orbit, from the
standpoint of when these parts get back to Kennedy
Space Center, whether that's through Edwards or landing
directly, it is an operations issue to have to do and
deal with the maintenance associated with that. We
have a baseline of impacts that we have seen
historically that fall into that category.
DR. LOGSDON: Even though you have a
stated requirement of zero impacts, that's at this
point kind of irrelevant to reality. The baseline is
30 or so inch impacts expected per mission and a
judgment that that's acceptable.
MR. BELL: That judgment is probably not
one that I should address. All I can tell you is what
we've dealt with from a typical standpoint as far as
operations go, and you've seen the numbers and that's
demonstrated to have been, looks like, my
interpretation, something that has been longstanding.
MR. WALLACE: As we've learned a lot
about the shuttle system, even the parts of it that may
have originally seemed fairly simple and
straightforward turn out to be very, very complex; and
we talked this morning earlier, as witness,
Mr. Blomberg, about incremental improvements. My
question is if you were to design -- let's just assume
that we're going to build a space shuttle again that's
going to be essentially the same vehicle but we have a
clean sheet of paper and today's technology to design
the thermal protection system. Any general thoughts on
what it might look like and if it might, in fact, be a
lot simpler than what we have now? Either of you can
answer that question.
MR. BELL: Let me take a stab first. The
vehicles, as you see them, are in evolution. If you
look at the vehicles and say that vehicle, that was the
design originally -- there's been several iterations
and changes to the vehicle through time. So as the TPS
community, we continually make modifications and
changes to improve both safety and operations.
Maintenance drivers, those changes occur continuously.
And there are requests for changes on the books today
that we will continue to pursue and you will see this
vehicle evolve from what it is now. If we had to start from a clean slate, that allows us to do other things
that we wouldn't necessarily have an opportunity to do,
given our current configuration and some of our tiles.
Your specific question, I think,
referenced the complexity of the design. Sitting here,
thinking about the complexity of the design, I do not
see any major changes unless you would start to
approach the structural part of the vehicle and the way
that the penetrations are originally designed that
would benefit TPS necessarily. Certainly you'd have to
integrate TPS into your design up front so that we are
just not the insulation system going over a door.
You'd have to design and think differently how you
would approach the seals.
Let me give you an example. Maybe Gary's
a better one to look at this. The chin panel is an
add-on to the vehicle. The chin panel is an RCC
component that attaches up -- it lays against the nose
cap of the vehicle. That was an add-on. Well, the
interface between those two components has created a
gap-filler that is just very maintenance-driven for us;
and certainly if we had the opportunity to start over,
we would design that out, design a different interface
there. But, you know, what we've got now is an
evolution of TPS that you see. Is that a good synopsis, Gary?
MR. GRANT: To take a step back from like
what Dan's saying, I think if we were to do something
different, we'd look at the most maintenance-intensive
areas from a standpoint of refurbishment and from the
interface end. It would require more than just a
change in the thermal protection system. So inputs
that we have may also drive changes in the way that the
penetrations, doors, or seals would function. But the
chin panel is a good example and it may be something
that we talk about. But at the time that that
interface was designed, there was talk of putting
another seal which would basically bridge those two
together. Unfortunately the maintenance, you know,
downfall wasn't seen in the future; but that would be a
good example of something that we could change without
causing another change to the rest of the function of
Please go ahead, Gary.
MR. GRANT: Okay. So then we'll talk
about the leading edge structural subsystem.
Next slide, please. As Dan alluded to,
although it is a subsystem unto itself, it is part of
the overall thermal protection system of the orbiter.
In this first slide, we talk about some of the basic requirements. It was put in areas where you do have
the higher temperatures. So we've got multi- and
single-mission limits that were posed to the design
element. Part of it also is not just, of course, for
example, on the wing leading edge to provide a shape
there but, of course, you have to protect the internal
also. So internal insulation is part of the design
Of course, being that most of the parts
other than the aero head are on leading edge areas, the
aerodynamic shape's important. The air foil shape
needed to be maintained for flight; and also on these
leading edges where we have the highest heating, it's
roughness- and waviness-critical. The system needed to
be able to distribute loads amongst the system itself
and to the structure, the supporting structure.
The impact resistance. The main
component or actually the only component that was
really designed to withstand a very adverse impact was
the forward ET attach plate, which actually in the
original design was tiles, and then they ended up doing
a functional test of the explosive bolt and found tile
damage and this actually ended up being somewhat of an
afterthought retrofit. RCC was already in place and in
development for the nose cap and the wing leading edge. When we talk about impact resistance, that's the one
element of our subsystem that was designed to take a
known or expected heavy load or shock.
GEN. BARRY: Do you know what the
measurement of that is? I understood it was like
.006 foot pounds. Do you know that?
MR. GRANT: I think we might get to that.
There's some slides that talk about the impact testing
that was done in the development.
GEN. BARRY: Which was very small, by the
MR. GRANT: Yes. I guess the point is
that impact resistance, you know, other than the
forward ET, was more for foreseen handling damages and
kind of rain impingement and bugs and things like that,
as opposed to real protective shield.
Then the last thing is that the parts
being new and really not much of a way to test, they
had to be certified by analysis; and in that process
it's found that they are limited life, which in the
orbiter, actually space transportation system, whatever
element you're talking about, limited life or cycle
means that it's not something that you can install and
it's good for the hundred missions or 20,000 cycles
it's going to see in its life.
What does certification by
MR. GRANT: Well, these parts, you know,
some of the portions were tested and rated at
facilities and/or checks, but the actual parts
themselves were not able to demonstrated on any other
type of vehicle.
DR. WIDNALL: I have a question. I don't
know whether you're going to get to this later, but are
you going to talk about things like the fatigue life of
these panels and vibratory loads and things like that?
MR. GRANT: Yes. If we don't -- I mean,
if the charts don't cover what you need. Then the
final thing is that the parts need to be
Next slide, please. The LESS consists of
more than the carbon. In the investigation and
discussions, we've really focused on the RCC,
reinforced carbon-carbon parts themselves. In the
system there's a nose cap that has three expansion
seals and five TEE seals to make up the nose cap
assembly. The wing leading edge is made up of 22 panel
seals sets per side, or 44 per orbiter. And as Dan
mentioned, a chin panel was retrofitted on the panels. It was in an area where we ended up having a lot of
tile and gap-filler rework, and this actually spans
between the nose cap and leading edge of the nose
landing gear door and the forward external tank
For the carbon to work, it has to have
attachments, internal insulation to protect the
structure that the parts are attached to, the attach
fittings themselves; and then in all cases other than
the external tank aero head, we have to be able to
access our fasteners. So we use reusable surface
insulation tiles and gap-fillers to make access panels.
In general, the basic design goal was to
provide thermal structural capabilities for the areas
that exceeded 2300 degrees.
Next slide, please. Let's talk about the
RCC now. In general, the makeup of the reinforced
carbon-carbon, there's three breakdowns. So there's
actually kind of two main ways of viewing it or two
main entities. One is the actual load-carrying part
itself, which is the carbon substrate. It's made up of
a rayon fabric that's impregnated with great amounts of
graphite and then there's a resonance used to help it
lay up in a rigid fashion and then there's a very
detailed three-stage process that's used to convert it to a carbon matrix.
In and of itself, you could almost be
complete with your parts right there except that we
have an environment that is going to attack that
substrate through oxidation. So that's where the
silicone carbide coating and the TEOS and the other
sealants come in. So the purpose for the silicone
carbide coating is to protect the underlaying
impregnated carbon fabric.
This is actually not a coating that's
applied. It's actually a transformation. It's
accomplished by a dry pack in a powder that's made up
of silicone carbide, silicone, and aluminum powder.
Ideally, our coating is about 20 to 30 mils thick. Of
course, it gets thicker when you get to some of the
sharp edge and the bends, just due to the geometry, the
way the shape is.
Unfortunately, during the cool-down, due to the difference in the thermal expansion between the carbon substrate and the newly converted silicone carbide coating, there's a difference in the thermal expansion coefficients and the silicon carbide contracts more during the cooling and we get craze cracks, if you will, which affects the substrates, potential oxidation. So the next element, that's added to help this. First the TEOS is applied, which leaches down through the craze cracks into the carbon areas to help form a harden or another way of protecting the carbon substrate. Then once this is completed, a Type A sealant, as we call it, a glass sealant is applied which helps to fill in some of the craze crack areas also and, again, give additional oxidation protection. The early design had just a single application of this coating, and it was discovered about the time 105 was being built that actually a second application of this coating would be beneficial for mission life. So some of the 105 and then subsequent spare parts have actually a double Type A coating.
DR. WIDNALL: What's the density of the
MR. GRANT: You know, I don't have the
actual number. It's, on the order of tiles, you know,
magnitudes greater. I don't know the actual number of
DR. WIDNALL: I mean, it's got to be a
heavier density than tiles.
MR. GRANT: Yes. By magnitudes.
Down at the bottom right, you see a typical acreage is on the order of a quarter-inch
thick. Then as you transition to lug areas where the
parts are actually attached or some of the areas where
you get the curves due to an actual geometry change,
you actually get quite a bit thicker. In some of the
lug areas, you're close to a half an inch thick.
Next slide, please. This is a good
snapshot at all the parts installed on the vehicle. Of
course, we have the nose cap and associated seals.
Behind this, there's a row of access tiles; and it
actually allows us, if we need to, to change
gap-fillers behind this area. The chin panel, which
actually here you can see just the edge of it, access
panels located out on the edges and then actually you
reach through the nose landing gear door, which you
barely see here, to reach in to get the attachments and
then you get a view of the chin panel and the seals,
just on the edge.
Up on the right, we see the wing leading
edge panel attached to the ship. This actually is a
photo of a 103, and so its configuration is a one-piece
spar fitting. In another slide that's coming up, you
actually see the two-piece spar that 102 had. But you
get a good look at the leading edge rib of an RCC panel
there. You can actually see many of the insulators and some of pieces we're looking at. The Koropon-coated
spar is shown there.
Then the forward ET, actually you can see
the forward ET attach point. This is evidently a
post-flight photo on the runway. This is what that
installation looks like on the runway, and there's
actually an aft plate and then a forward plate and then
that interfaces with the nose landing gear door.
Next slide, please. Here's a little more
detail of the system itself. The nose cap is actually
somewhat of a self-contained unit. The nose cap
actually has its own bulkhead, own structural bulkhead,
which is the nose cap and the seals. Internal
insulation of the conic blankets, which you see a
cross-section of here. Of course, it's attached by way
of Inconel fittings to the actual nose cap bulkhead,
which then the whole assembly is put onto the orbiter
vehicle and attached to the forward fuselage structure.
Interface panels which actually go all
the way around and interface with the forward fuselage
and then a bulkhead door which allows access into the
nose cap and then the conic blanket internal insulation
assemblies are actually broken down into four
quadrants. And that's the way that you get those in
and install them to the nose cap bulkhead itself. Next slide, please. Wing leading edge
parts. You see here, sitting on the bench, a panel
with attached T seals. This is a panel T seal set.
You can see the attached lugs here. T seals are
attached to the actual lug fittings on the panel, not
directly to the ship.
As you can see, this is a cross-section.
The purple is the RCC itself. Upper access panels that
allow us to get to the -- these attach points here.
Upper panel. Lower access panel shown and installed
here, which again allow us to get to the attach
The spar fittings -- and this picture
here does show the 102 configuration. There's a
separate upper and a lower spar fitting, and those are
shown by red in the sketch here. Then once
everything's installed and complete, before access
panels are put on, the spar insulation in the
different -- the earmuff insulators here -- again, this
is 102 configuration -- actually go over and cover the
spar fittings so that once everything's completed on
the internal, all parts are protected from radiation.
DR. WIDNALL: Are you going to talk about
any structural testing that was done on these RCC
MR. GRANT: I think the slides that we'll
talk about have some of the impact testing. I don't
DR. WIDNALL: Well, let me just ask a
question. Are you surprised? The thing that surprised
me about it is that in recovering the debris, we found
half of the RCC panels. In other words, they broke at
the center. Now, looking at that, I'm asking myself,
if I grabbed ahold of that panel and, you know, pulled
it out, where would it break? The rib is a little
thinner in the center. I mean, do you have an
understanding? When you saw that debris, did you say,
uh-huh, or are you as confused as I am about why they
broke where they broke?
MR. GRANT: I think the loads those parts
saw -- you know, I don't think it's surprising that
they broke there; and one of the things that we saw the
parts, you know, broke at the lugs, too.
DR. WIDNALL: That's fine; but, I mean,
really every single panel we have is broken at the
MR. GRANT: Yes. You know, if you
notice, we don't have any -- we have some T seals or
gap seals --
DR. WIDNALL: Right, but I'm talking about the big panels.
MR. GRANT: -- in somewhat good
condition, but the panels themselves, I don't know that
any of them --
DR. WIDNALL: Well, we have a lot of
MR. GRANT: Yes. You know, I don't have
that specific information. I know there had to have
been compressive and stress testing, and that's
something that I could take an action and make sure you
see that data.
DR. WIDNALL: I'd be interested in that.
DR. OSHEROFF: This is pursuant to
Sheila's question. Certainly looking at the debris, it
was my impression that a lot of these things had to
have been broken. They didn't break upon striking the
DR. WIDNALL: No, I don't think so.
DR. OSHEROFF: Well, part of it at least
was still attached to the wing. That seems to be
more -- because you could see that there would be
spatter on one half and not on the other half.
MR. GRANT: Well, I've been somewhat
involved in the reconstruction. One of the things that
we tried to not do -- I mean, other than, like the doctor was saying, you know, of course, thoughts are
running through your mind -- but we've specifically
tried not to speculate on where did they find these
parts -- you know, "Oh, my God, this is the one right
here." We really tried to systematically place them;
and, as you know, it's an important part of
investigation to make sure we get the correct parts
correctly located on the floor.
In general, observation-wise, I've
personally seen very few parts that show a lot of
ablation to the actual substrate. I mean, it's really
impossible to speculate as to when they broke; but a
lot of them, I'm not seeing a degradation of that, the
carbon and the fabric substrate that you would see, you
know, had it broken early in the re-entry attempt.
Why don't you go ahead.
MR. GRANT: So I think this covers the
basic assembly of the wing leading edge system.
Next slide, please. The parts were
procured to a spec that was developed through NASA and
the vendor. Performance is that they should be
structurally sound, maintain a positive margin of
safety -- which, of course, the factor of safety
baseline is 1.4 -- be able to withstand 100 missions
with minimum refurbishment and replacement, be able to withstand rain impingement. Physically the system, the
goal was 1699 pounds. Of course, you had to maintain
and be able to have step-and-gap control adjustment,
which is built into the design; and the surface
roughness within any part had to be less than the
figure shown there.
Impact resistance was really more of a
goal from the standpoint of, you know, if you talked to
the vendor today, their biggest concern is handling
damages on these. So, in general, the goal there was
to create some type of impact resistance if somebody
dropped a nut or a wrench or some of the things that
would happen in normal processing -- other than, like I
mentioned before, providing a protective shield.
The maintainability. The visual
inspection would give you clues into any concerns you
have with the parts. Part removal should be somewhat
straightforward and simple and shouldn't take very
long. Less than 15 minutes was used as a number. And
again, that they should be interchangeable.
Predicted temperatures that were
presented to critical design review in March of '77
showed the maximum temperatures on the nose cap were
around 2500 degrees and, wing leading edge, 2600. On
the panels, the gap seals actually are a little bit hotter at 2800, close to 2900 degrees.
GEN. BARRY: Can you go back a slide,
please? The 100 missions. My understanding is that
certain panels are a lot lower than that, like Panel
No. 9 on the lower part is only cleared to 50.
MR. GRANT: That's correct. So part of
what's integrated here is that, you know, your spares
or your extra parts on hand actually are necessary to
help you achieve that. I mean, obviously the design
for the orbiter was 100 missions. So the reality of
the RCC and the leading edge structural subsystem was
that individual parts -- you know, one part, without
being replaced, was not going to get you there.
GEN. BARRY: That's an appreciation for,
I guess, an analysis that has been subsequent to the
original design spec that you've concluded that, okay,
for 9. Then it varies, too. I mean, 10, I think, is
63; and then it goes out and gets to 100 on the outer.
MR. GRANT: Yes.
GEN. BARRY: Let me ask you a question on
mass loss. There is mass loss to these RCCs over time.
MR. GRANT: Yes.
GEN. BARRY: Okay. Can you talk a little
about that and how we talk about ageing? I mean, there
is an effect over time on these RCCs.
MR. GRANT: Yes. Well, actually the
early mission lives on these parts was quite a bit
lower than what you've seen in our current
requirements. Initially the Type A sealant was not a
part of the system; and then once the sealant was added
and then the double Type A was added, we actually began
to get the parts to where they were more robust. Then
since then we've had to go through performance
enhancements and different types of things where the
capabilities of the orbiter were expanded. So, you
know, over time those things tended to jostle around
the actual mission life itself. So initially the
flight lives were actually a little lower than what you
had -- I'm sorry, what was the question again?
GEN. BARRY: Well, I guess it really
comes down to the fact --
MR. GRANT: Talking about mass loss.
GEN. BARRY: The RCC's a quarter of an
MR. GRANT: Yes.
GEN. BARRY: I mean, if you add the
Type A sealant, the TEOS, of course, the substrate, the
silicone carbide. Now we introduce mass loss of about
.003 pounds per square foot, right? The thing is how
do you measure this ageing, you know, for the mass loss?
MR. GRANT: Well, what we've done over
time -- the biggest thing that we have that really
corroborates some of the assessments on that is
destructive tests that we've done, and we're able to
take a look at that. Mass loss, of course, is related
to oxidation; and in looking at that, one of the things
that came out of some of those early destructive tests
was the sealant refurbishment which we have instituted.
I think it was around the 1992 time frame where every
other LMDP on the wing leading edge panels that are in
the areas where you have the highest convective mass
loss get their sealant refurbished, in a sense, really
kind of reset those parts in the way of having a higher
resistance to the convective mass loss.
I think one of the backup charts I have
shows, if you never do a seal quantity refurbishment,
how that mass loss increases with time. As you do it,
it actually brings that number back down, not quite to
the design but a lot to something that's manageable.
And our every other LMDP effectivity that we have on
that's actually a little bit conservative by a few
So I guess the destructive tests and the
evaluations on the parts that we've had -- and most of the models that were used to predict the actual life,
you know, using the extrapolation of the mass loss,
were very conservative. The trajectories that were
used for those -- like the initial flight lives are
using abort trajectory, which, of course -- you know,
and they basically ran a hundred abort trajectories.
So that's very conservative to what we're actually
flying, which is normal mission with a re-entry.
At KSC, do you do any
acceptance testings of the parts from the vendors to
see if they meet these criteria?
MR. GRANT: Well, they have this
procurement spec that's something that they are held to
and that we are, too. The actual receiving and
inspection is something that's done in the logistics
area. So from an engineering standpoint, you know, we
would do our normal maintenance inspections before
parts are installed; but we don't actually make a
decision to accept the part. Obviously if we saw
something that concerned us that may have --
Obviously. So to pursue
the business of the acceptance inspection, we've got to
pursue that someplace else.
Dr. Logsdon had a question.
DR. LOGSDON: Just a quick question. A couple of weeks ago, ten days ago, there was some
suggestion in some press accounts of the primer from
the launch tower having an oxidation effect on the RCC.
Did you, in fact, see evidence of that?
MR. GRANT: Specifically on Columbia?
DR. LOGSDON: No. In general.
MR. GRANT: Yes. I guess that's
something that we eventually would have gotten to.
You're referring to the pinholes. When we first saw
the phenomenon, we obviously didn't know what we were
dealing with; but through quite a bit of time, study,
tracking these, we were very concerned about them. We
spent hours and hours looking at them, mapping them,
measuring them, just dissecting them every which way
you could. We were trying to narrow in on there was a
point in time -- and I believe it was STS 50 -- where
from that point on we found them, we found them only on
certain parts, and we somewhat -- you know, trying to
find a cause for this, we ended up finding out that
there was a change to the way that the pad was being
refurbished. And I think some of the other members of
the board that have been in contact with us have quite
extensive reports on this. But we found there was a
zinc-based primer that was being used and then an
overcoat -- and I'm not familiar with the materials on it. But at that time the change was to not apply that
overcoat. And the zinc was one of the elements that we
were finding in the glass deposits that were coming out
of these pinholes, so to speak.
So basically what happens, the zinc does
break down the matrix of the silicone carbide and
actually gives us a little path down; and the nature of
it, too, is that it follows the paths of the craze
cracks and imperfections. So it's not necessarily a
straight hole down in, once we actually took some
destructive tests. But the zinc was the key to us
actually linking it to what had changed on the pad.
But that fell into line with all the other findings
that we didn't really see them on the nose cap or chin
panels and it was in the wing leading edge in certain
areas that were covered by the rain protection.
DR. LOGSDON: Have you done anything
MR. GRANT: The procedure to the pad
DR. LOGSDON: No, the --
MR. GRANT: To the parts.
DR. LOGSDON: Have we covered the primer?
MR. GRANT: So, I mean, are you talking
about to our parts?
DR. LOGSDON: The launch pad.
MR. GRANT: Yes. At that time -- and I
don't have the information -- but we were able to get
in touch with the facilities crew and basically the
procedure was changed again. And as we continued to
analyze and track the parts, the pinholes, they
actually formed somewhat of a glass coating down the
actual path that leads to the substrate, which actually
gives, itself, some protection to oxidation. So we've
done quite a bit of studying and set criteria for the
size of the pinholes that are acceptable and the cycle
time that we review them.
DR. LOGSDON: My question was: Have you
now painted the launch pad to cover the primer?
MR. GRANT: Yes. Once that was
identified positively as a source, that was immediately
taken care of.
DR. OSHEROFF: Can you estimate how much
mass loss occurred as a result of oxidation due to the
MR. GRANT: The actual oxidation is
preferential to the silicone carbide and carbon
substrate interface. So what we've found in the few
that we've seen that actually go down to the substrate,
because that pinhole actually forms a glass coating around it, what we're concerned about is the oxidation
that would actually separate the coating from the
substrate itself. So because of that glass lining, so
to speak, it somewhat protects those edges from
actually getting the attack that we're concerned about.
I didn't hear an answer to
the question there. Have you ever measured the mass
MR. GRANT: Well, what we've seen is that
we are not getting any additional attacking of the
interface of the silicone carbide to the carbon, based
on the pinholes. That's one of the reasons why we go
and do a sealant refurbishment, which somewhat fills in
that pinhole temporarily; but once the zinc is present
in that matrix, it's impossible to get it actually
GEN. BARRY: But right now you're doing
MR. GRANT: Yes.
GEN. BARRY: The board is very
interested, of course, in further NDI, you know, to get
verification on what that mass loss would be, and not
just do it on a visual indication, to be able to look
down there and see if there are voids underneath those
pinholes to see if, in fact, there has been, in the admiral's term, the termites that have dug holes
Why don't we go ahead.
We're a little bit over time here.
MR. GRANT: Next slide, please. This
shows a predicted trajectory temperature pressure curve
for a space station mission, one showing wing leading
edge Panel 9, which is our highest-temperature wing
leading edge panel, and the nose cap, which itself is a
very high-temperature part.
Next slide, please. The design
allowables for impact resistance. A test was
performed. LTV is the vendor for the parts. Tests
were done with a spherical steel ball; and for a
typical 19-ply acreage area, it was found that the
threshold for not seeing cracks or damage to the
coating or substrate was 1.4 foot pounds, which is
approximately the 16-inch pound design goal that they
There were hypervelocity impacts that was
done in '77. They used nylon cylinders and glass
spheres and, again, the lower-energy impacts produced
some front face damage, the higher energy produced a
front and back face damage, and the glass spheres only
produced front face damage. Next slide, please. Ice impact tests
were performed at Southwest Research and, as you can
see, again, as the energy goes up, you start to get
cracks into the coating and then, finally, at a high
enough energy, the specimens were actually destroyed.
The low-velocity impact tests are probably the most
consistent or useful data, and these are actually
things that are used when we have concerns on damage
that may create a hole in a panel or whatever. But the
results here, again you see, as you get the higher
energy, you get damage to the front and rear face. And
with the lower energy, you get some damage to the
coating on the outside.
Next slide, please. A low-velocity
impact test was performed on a right-hand Panel No. 10,
which was actually a panel that we did sustain a couple
of impact damages while we were on orbit. Once it was
removed, there were tests done by Rockwell and NASA on
this. The Rockwell tests used a BB and a lead bullet.
The idea there was to kind of demonstrate the effect of
the hardness of whatever the projectile was. The lead,
of course, is soft, did not produce any damage; and the
BB actually saw front and rear damage to this panel.
Next slide, please. Some of the issues
that we've had over the years. This panel that I alluded to, the 104, STS 45, we actually sustained two
damages on the upper surface of this panel. An
evaluation was done to determine, you know, the
micrometeoroid orbital debris effects. Concern, of
course, is that a potential such damage could actually
create a hole in the RCC panel which would very quickly
compromise your wing spar. Of course, the burn-through
would be a potential loss of crew and vehicle.
The resolution was that a study was done
to enhance the internal insulation and to provide a
little more margin there, where if you actually had a
hole that was a quarter inch or smaller, although the
hole would grow during re-entry, your cavity heating
would increase, but the actual spar itself would remain
protected by a more robust internal. Inside the
Inconel foil, there's actually some fabric,
high-temperature glass fabric layers that were added to
essentially just give you enough margin to return
safely. That's one of the things that came out of that
Next slide, please. I think we have some
pictures of it. Actual pictures of the OML or the
outer mold line and then the underlying damage. On the
left you see what's called Impact 1 here. It's about
2 inches by an inch and a half wide. And then an associated back face damage, which you can barely see
some of the cracking that happened on the back face.
On this side, this edge is a little stronger since it's
close to an actual rib of the panel. Damage wasn't
very big on the front; but then the actual back face,
some of the coating actually was dislodged there.
Next slide, please. This demonstrates
some of the pieces that were used for the testing. Of
course, with a quarter-inch hole, we're trying to
provide -- just a little bit extra protection here. So
some specimens were created with a hole of such size.
You see what the hole grew to and you see what the
actual -- this is the material that's used that covers
the internal insulators. And this has the Nextel
fabric around it and you can see at the end of the
test, you actually still had some protection there.
Next slide, please.
In one of your first
viewgraphs up there where you showed the cross-section
of the RCC wing leading edge panel, you referred to the
matrix and then the way the outer few mils are treated
to provide -- your viewgraph said that the carbon is
there for the strength and the outer piece is there for
the protection. We mentioned oxidation, but is it correct to characterize the outer treatment also as the
major part of the thermal protection also?
MR. GRANT: No. Again, the --
The whole thing is for the
MR. GRANT: To protect for oxidation,
MR. GRANT: Well, the primary elements
that actually provide the thermal protection to the
orbiter are the internal components that protect the
wing leading edge spar from the radiation of the parts.
The parts themselves, since they can sustain
temperatures up to, you know, 3,000 degrees, the parts
themselves, you know, that coating is not the primary
protection for the actual RCC.
Unlike the tiles, which are
nearly perfect radiators, the RCC is not.
MR. GRANT: Yes.
It's just supposed to take
the heat and stay structurally intact.
MR. GRANT: Yes. That's correct.
DR. WIDNALL: You actually didn't say
very much about the requirement, the fatigue
requirement and how that was tested, what the requirement actually was in terms of vibration levels
or whatever. I recognize you don't have that on
slides, but I'd be very interested to see the kinds of
requirements that were set for basically the fatigue
life of the panels in that environment.
MR. GRANT: Okay. You know, the details
on the type of cycle testing, obviously the parts were
designed to withstand the thermal, vibroacoustic, all
the stress. So all those environments, you know, were
things that the parts were designed for; and I'd have
to get that.
DR. WIDNALL: I'd be interested in
knowing what that was.
All right. Gentlemen, thank you very
much. Your depth of knowledge on this is very
impressive; and we appreciate you bearing with us as we
work our way through this. I know you want to get to
the bottom of this as much as we do, and we thank you
for dialoguing with us and being patient with us as we
work our way through this. You've been very helpful.
Thank you very much.
Okay. We are finished. We're going to
have a press conference right here in 30 minutes.
(Hearing concluded at 12:28 p.m.)
Back to Event