Columbia Accident Investigation Board
Home Board Charter Board Members News Photos Events Contact The CAIB
Columbia Accident Investigation Board Public Hearing
Tuesday, April 8, 2003

9:00 a.m. - 12:00 noon
Hilton Houston Clear Lake
3000 NASA Road One
Houston, Texas

Board Members Present:
Admiral Hal Gehman
Brigadier General Duane Deal
Dr. Sally Ride
Dr. Sheila Widnall
Dr. Douglas Osheroff
Dr. John Logsdon
Mr. Steven Wallace

Witnesses Testifying:
Mr. Richard Blomberg
Mr. Dan Bell
Mr. Gary Grant
Columbia Accident Investigation Board
Public Hearing - April 8, 2003

ADM. GEHMAN: Good morning, ladies and gentlemen. This public hearing of the Columbia Accident Investigation Board is in session. We're going to continue learning about various parts of NASA's handling of safety items, safety issues. This morning we're privileged to have in our company Mr. Richard Blomberg. Mr. Richard Blomberg used to be the chairman of the Aerospace Safety Advisory Panel and has looked at these issues for many years and probably is as knowledgeable as anybody. So we're delighted to have you with us and thank you very much for helping us.

Before we get started, I would like to ask you to affirm to this panel that the information you're giving us today is correct and accurate, to the best of your current belief and knowledge.

THE WITNESS: I affirm that.

ADM. GEHMAN: Thank you very much. If you would introduce yourself and give us a little bit of a biographical comment, and then we'll ask you to make an opening comment.

RICHARD BLOMBERG testified as follows:

MR. BLOMBERG: Thank you, Mr. Chairman and members of the board. I am currently the president of Dunlap Associates, Incorporated, which is one of the oldest human factors consulting firms in the world. I have been with Dunlap for 35 years. My work focuses on transportation safety and particularly on how humans, hardware, and software can work together to prevent accidents. I've also been extensively involved in accident analyses.

From August 1987 through March 2002, I was associated with NASA's Aerospace Safety Advisory Panel as a consultant member, deputy chair, and chair. The ASAP, as it is sometimes called, was formed by an act of Congress after the Apollo fire in the late 1960s, to be an independent safety adviser to the NASA administrator and the Congress itself. Although the panel dealt with the full range of NASA's aeronautics and space activities, the space shuttle was obviously a main focal area.

For much of my 15-year tenure, I was the team leader of the panel's subgroup that examined activities at the Kennedy Space Center. As the panel's human factors expert and then its deputy chair and chair, I participated on most of the other fact-finding teams and visited all of the NASA human space flight facilities and major contractors on a regular basis. Since leaving the Aerospace Safety Advisory Panel, I have continued my involvement with the space shuttle as an independent consultant to some of the contractors.

ADM. GEHMAN: Thank you very much.

MR. BLOMBERG: You're welcome.

ADM. GEHMAN: Very impressive. Let me ask the first question, and then we'll pass it around to the panel. I noticed that the ASAP has been concerned over the years about NASA's investment in basic infrastructure and test equipment and things like that, based on an assumption that there would be a system that followed the shuttle; and then there were some announcements that the shuttle is going to be extended much longer, to 2012 or maybe even 2020. So that takes care of that problem. I mean, now we've got enough time to amortize investments in infrastructure and test equipment and things like that, which is good. Now we've got a problem about ageing aircraft and whether that's a reasonable engineering goal so the shuttle can operate safely until 2020 or 2012 or whatever the number is. Do you have views on that issue about how we would determine what is the proper life for a research-and-development vehicle like the shuttle?

MR. BLOMBERG: Yes, I do. The panel looked at that very carefully, both from the top down, so to speak, and from the bottom up. In other words, we looked at the total system and tried to consider its ability to fly to 2020 or beyond, because we were firmly convinced that it had to. Even with the rhetoric concerning a new vehicle, we didn't see the capability to develop such new vehicle on the time frame that people were talking about. So the notion of having a new human-rated space vehicle, for example, within eight years just was unrealistic, by the time you go through all the funding cycles and approvals; and, further, there were no new enabling technologies. We felt that there were two main areas where you would need some breakthroughs before you would have a better vehicle than the space shuttle, and those areas were propulsion and materials. We didn't see anything out there that was notably better than what was being used in the shuttle.

So we really came to the conclusion that if you built a new vehicle, what you'd end up with is an upgraded shuttle-type vehicle, so why not upgrade what you have and follow the models that commercial aircraft and military aircraft had used for years. So we felt very strongly that the vehicle was capable of flying as long as NASA needed it and was capable of doing the job safely. What concerned us was that there was no investment in the future and therefore there was no ability to take advantage of new safety improvements that could make the vehicle even safer. And it was an opportunity loss that really, really concerned us more than a degradation of safety. Because we were absolutely confident that the NASA folks and the contractors would never fly the vehicle if safety deteriorated. It's a requirements-driven system. They either met requirements or they didn't fly. And in my experience, I've never seen a program and a work force as dedicated to safety as the shuttle and its contractors. But they also were dedicated to achieving their goals and sometimes those two objectives can clash if you don't have sufficient budget.

So what was happening and what concerned me and what I reported to the Congress last year was that they were deferring a lot of safety upgrades and deferring investments that were needed for the future. That wasn't sacrificing safety immediately because all the requirements were being met, but they were pulling in the funding needed for long-term improvements in order to fly safely today and they would not be able to recover from that down the road.

ADM. GEHMAN: Would you comment? What are your views on how you get out of that loop? As the shuttle gets older, it requires more maintenance and, as you mentioned, it's a requirements-driven system, but the requirements of today are not the same as the requirements in the early Seventies and so essentially every flight gets more expensive. You have to start making infrastructure upgrades and safety upgrades; and metal which was not designed to last 25 or 30 years, you have chronological problems. So I think it's not hard to imagine that while you could continue flying the shuttle safely as long as you invested in the things that you mentioned, essentially it keeps getting more expensive every flight. So you're in a loop where you can't invest in the things that you need to to get out of this -- that is, the next program. I hate to use the word "gracefully degrade," but how do you break this loop?

MR. BLOMBERG: Well, I don't think the loop is quite as difficult to break as you're characterizing it, Admiral. I think, first of all, if expense is the issue -- expense and safety, first of all, are not necessarily tied. There can be things that are expensive to deal with that are not safety related; but if you have an obsolescence issue and you're dealing with expensive parts, that's when an upgrade is called for. And in most cases with the space shuttle, there were upgrades identified that would deal with the cost issues. Now, you were never going to deal with the basic problem that the vehicle is very difficult to maintain. It's very labor-intensive and it takes a lot of care and feeding, even when it's brand-new, but that's inherent in the design.

In terms of safety, I think the two things that were needed, as I mentioned, one was upgrades, where you've got new technology that's safer. An example, the general-purpose computers. The space shuttle's computers are back literally from the dark ages. They're performing very well, but there's additional capability -- for example, giving the crew predictor information -- that they don't have right now, that the new electronic displays are capable of doing if they had computer power behind them. I mean, that's an upgrade that would improve safety. The other area is additional analyses.

The analyses on which the design was based, as you point out, were quite old and they were based on flying a hundred missions but over a relatively short period of time. So it's time to go back and find out where those analyses break down when you extend the life. The hydrogen line on the pad, for example, that failed and delayed a launch was an example of something that, had one said this has to last for 40 years, there would have been weld inspections on that line; but since the requirements weren't stated for 40 years, nobody inspected the line. So I think you have to revisit those requirements and change them as necessary to fit the age of the vehicle; but if you do that, I think you could fly the space shuttle at a reasonable cost for the space shuttle and certainly at an increased level of safety from where it was being flown.

MR. WALLACE: I'm from the civil aviation sector. You mentioned the sort of civil aviation model. I'd like to pursue that a bit further, as to whether or not there are advances to be made that would be sort of in the nature of what we call a derivative aircraft. I mean, the Boeing 737 was designed over 40 years ago and it's still being produced at a great rate although what's produced today, in many respects, just aerodynamics and engines, bears little resemblance to what was produced 40 years ago. Is there likely to be derivative or incremental improvements to the shuttle, or is it time to start with a clean sheet of paper?

MR. BLOMBERG: Well, as I mentioned earlier, Mr. Wallace, I think that starting with a clean sheet of paper means going back to do some basic research in propulsion and materials that hasn't been done yet. So if we were to start a new vehicle today, I think a derivative vehicle would be the way to proceed because we have a lot of operational experience with the shuttle and it's well characterized. I think the civil model that you're pointing out, I think there are two variants of that. One is the derivative aircraft like the new generation 737, which takes advantage of all the operational experience of the older generation. The other is retrofitting the actual old vehicles, which some of the airlines, for example, have done about the DC9 and gotten a very efficient and passenger-friendly and pilot-friendly vehicle. I think both could be done.

There was an example of that. Endeavor is a derivative of the space shuttle. It was not certainly the same as Columbia or Challenger or the earlier vehicles, but it was based on them and then putting the multifunctional electronic display system in the space shuttle has upgraded the flight deck quite a bit. There were other derivative kinds of proposals on the table, some of which may have been worth doing and others may not have been; but it would have taken some more R&D to determine whether they were valid or not. So I think both of those models would have worked; and from my opinion, I think the space shuttle could fly well into the 2020s without any problem if it were the subject of a program such as the airlines or the military do with their older aircraft.

MR. WALLACE: Would you point to any particular guiding principles for driving the derivative upgrade process? I'm thinking about the current ASAP report which just came out in the last couple of weeks which identifies the current human-rated requirement of a crew escape system which will function through the full range of powered flight and recommends that that be retroactively applied to the shuttle. Could you speak to that?

MR. BLOMBERG: Well, that was something that we started working on; I guess it was three years ago now. This is the third year that that's been in the ASAP's report -- two years when I was chair and now this year. I think that's tied to the themes that we had also of the reality of the service life of the space shuttle. The government -- and I won't say NASA because NASA is not master of its own destiny when it comes to budgets -- the government had made decisions at first that the space shuttle was only going to fly to 2006 and that the new vehicle was going to be on the drawing board. Then when that didn't happen, it kept creeping out in two-year-or-so increments; and so there was never a payback period that would warrant looking at an upgrade as significant as a crew escape system, which is clearly in the billions of dollars, not millions of dollars.

What the panel started saying three years ago was, look, this vehicle is going to be flying for 25 years more probably, that's the reality, and the lead time for anything -- and you've picked an extreme example -- the lead time to get a full crew escape system into the vehicle is maybe a decade under current engineering. Maybe you can move it down to eight years; but in reality the new brakes when they were put in, took eight years. The last upgrade to the general-purpose computer took eight years from authorization-to-proceed to first flight. So something as complex as a crew escape system, assuming a decade is not unreasonable. We were saying, "But you've got a decade. If you get it in there in a decade, you've still got probably 15 years to use it; and that's very beneficial."

That's what we were trying to get everyone -- the Congress, the Office of Management and Budget, and NASA -- to listen to, that you can't creep up on these things because it takes too long to respond. The latency, the response time in the shuttle system, even for just procurement -- if you just decide to buy spare parts of the same vintage that you have now, many of the critical components can take three to five years to acquire. That's not counting the paperwork and the authorizations and the contract. That's just from the time you sign the contract. Some of the turbine wheels, for example, take 13 or 15 months to machine. So you've got to stay ahead of this, and they were not, because they didn't have the budget.

So the budget shortfall was forcing them to take a very short-term view in order to maintain safety. They had to meet all the current requirements, and so every cent they had, just about, was going into meeting the short-term requirements with Band-Aid solutions.

DR. OSHEROFF: Well, we now know that there are only three shuttles left; and I dare say that if we lost another one, I suspect that the entire manned space shuttle program would be in jeopardy. I'm not wishing to predict something. Do you consider the design of the shuttle to be an intrinsically safe design?

MR. BLOMBERG: Well, Doctor, as a safety professional, I never say anything is or isn't safe. I think you're dealing with a risk-management issue and what is safe under certain circumstances or acceptable under certain circumstances may not be under others. As an example, this country is at war right now and the military will be flying aircraft in conditions that they'd never fly them on training missions, because of the risk trade-offs of not flying them. If we had a crew stranded in space and we needed to launch a space shuttle right now, my recommendation would be to go ahead and launch it because I think it is inherently as low-risk a vehicle as we have to carry humans into space and do the job.

Can it be less risky? Yes. Absolutely.

There are identified risk-reduction measures that can make it safer or less risky to fly the space shuttle, but we're still dealing with an inherently dangerous environment. We've got 7 million pounds of thrust at liftoff. The analogy I like to use when I speak to people is that's on the order of 45 to 55 Boeing 747s stacked end-to-end, at full thrust. That's a lot of power. The re-entry conditions are extremely hostile. No atmospheric aircraft comes close to meeting those conditions.

So we're never going to have a perfectly safe vehicle. We're never going to have a vehicle, at least with the current technology, that's as safe as the airliners we all fly on; but I think for a human-rated vehicle, the space shuttle is a good design, a risk-manageable design. It's a design that is well understood, that the folks can manage well enough to keep the risk as low as is humanly possible for that environment. I think that's all you can ask for when you're dealing with a dangerous situation.

DR. OSHEROFF: Well, let me ask another question, then. That is, how would you characterize the safety record of the shuttle, given that it is, in fact, an experimental craft?

MR. BLOMBERG: Well, I don't want to be flip about it, but I would use two terms, "magnificent" and "unacceptable," because any accident is unacceptable but given what the space shuttle has had to do and has been asked to do and the environment in which it flies, I think its safety record has been actually very good. Again, I'm not saying that two accidents is an acceptable number by any means; but it is a very, very dangerous situation. If you look back at the history of military aircraft test flights in all of the services and you look at the loss rates -- in the Fifties, for example, a jet aircraft, which is about the same maturity level that we're talking about human space flight -- the loss level and the accident level was much, much higher.

DR. OSHEROFF: Then you would characterize this more as a vehicle under development rather than a ready-for-flight vehicle. Is that correct?

MR. BLOMBERG: Well, I think the chairman described it as an experimental vehicle; and I think it is an experimental vehicle and will remain an experimental vehicle certainly for our lifetime. You cannot fly six times a year, let's say, on average -- it's actually less than that -- in any environment and call a vehicle operational. That's just not realistic. I don't know care if it's a submarine, an aircraft, a ship, an airplane, or a space plane. If you're only flying it a few times a year, it is an experimental vehicle.

DR. OSHEROFF: Thank you.

GEN. BARRY: Mr. Blomberg, good to see you again.

MR. BLOMBERG: Nice seeing you.

GEN. BARRY: Two questions, if I can.

ADM. GEHMAN: John, pull the microphone over to you. There you go.

GEN. BARRY: I'd like to afford you an opportunity to comment on your testimony last year. You were quoted -- and I'm paraphrasing -- in April that you were more worried than you've ever been before on the safety of the shuttle program -- not the exact words you used, but I'd like you to give the full context behind that comment. I know you've already commented on a few things; but if you could give us a full context, that would be helpful.

The second question that I'd like to just have you comment on is when you were in charge of the ASAP, under your purview you reviewed the movement from Palmdale to KSC and JSC and then also the movement from Huntington Beach to JSC and KSC -- Palmdale to KSC and Huntington Beach to Kennedy and Johnson. If you could give us a little background on your views on those moves and how significant they were.

MR. BLOMBERG: Okay. Well, as to your first question, General, my remarks to the Congress were, I think, almost verbatim what you said. I said in all the years I've been involved, I've never been as concerned as I am right now. I went on, though, to say I'm not concerned for this flight or the next flight or perhaps the one after that but I am concerned in the long term. You can light a fuse that is slow-burning and takes a long time; and my concern was, as I've stated earlier, that the failure to put some money into the long term and to plan for flying this vehicle in the years 2012, 2015, and beyond, was sowing the seeds for a decrease in safety or an increase in risk out in those years and doing it in a way from which you could not recover because there was no way to just go down to the spare parts supplier and buy new parts, that you had to take action and it had to be done quickly.

I was trying to get their attention, frankly, and say, look, you've got to act now. This is not something you can argue about for two or three years because if you argue about it for two or three years, you run the risk that the safety level of the space shuttle is going to decrease over time; and that's unacceptable to all of us. It's unacceptable, I know, to NASA, it's unacceptable to the contractors, and certainly it was unacceptable to the ASAP to see the safety level slide backwards when there, in fact, were identified ways to have it move forward.

So what I was saying was, please, act now because the really dedicated people who are maintaining this vehicle are getting to the limit of what they can do with ingenuity. Sooner or later they're going to need cash; and it's really sooner, not later. So that's what I was saying to the Congress.

If you take the quote out of context, as has been done, it sounds as if I was predicting this tragedy; and I certainly was not. I was as surprised as everyone else that there was an accident and I still do not see necessarily a connection that something they failed to spend money on in the past caused this. When your board comes up with a probable cause, it may show that. It may show that there was something that could have been done if some research money had been spent that was identified early on, but we won't know that until you come to a conclusion.

As for your second question, I think it relates very strongly to what we on the panel identified as one of the three major components of safety for the space shuttle; and that is work force. The space shuttle is a very labor-intensive vehicle, and it requires people who fully understand how it operates and its care and feeding and, also, the differences among what was then the four vehicles. While they are similar, they're by no means identical. The folks at Palmdale, to take your first example, were experienced initially in building the vehicles and then in doing the major overhauls, the orbiter maintenance and down periods and the upgrades, installing the electronic displays and so forth. That heavy maintenance experience was somewhat different from the line experience that the folks had at the Kennedy Space Center; and, in particular, the management of heavy maintenance in the aircraft industry and aerospace industry is somewhat different than line maintenance management.

On a line maintenance basis, you want to get your aircraft back into service as quickly as possible and as safely as possible for the next set of flights. You want to meet your passengers the next morning. When you deal with heavy maintenance, you're talking about rolling a vehicle out that's got another five years of service life and is as close to zero time as you can get it.

From a management standpoint, those philosophies are quite different; from the floor work force, it's not so different. They get a job card to do a particular job, and they do it. We felt that Palmdale had unique experience in the heavy maintenance arena and therefore maintaining that experience was an asset to the program, although an expensive asset. It was a luxury.

What ended up happening with the budget cutbacks was that the work force at Palmdale kept getting cut back. Every time an orbiter rolled out, a major proportion of the work force was laid off; and each time they recalled them, they were getting about 75 percent and then 60 percent coming back. So you were dealing with new work force anyway, and that was a difficulty.

The program decided to move the heavy maintenance to KSC, or considered that. We looked at it very, very carefully on the ASAP; and we concluded that under the then-prevailing circumstances with this loss of work force and capability in Palmdale that, as long as the requirements were maintained, as long as there was no cutting back on the requirements, that the work could be pursued as safely at KSC as it could at Palmdale. We did not delve into the cost issues because that was not within our purview. We took it at face value that it was going to produce a cost saving. With respect to the move from Huntington Beach to JSC, I think many of the same things applied. We were very concerned about the potential loss of engineering talent and experience that was in the Huntington Beach work force, which had already moved once from Downey to Huntington Beach -- and that was a move that was more easily controlled because it was basically local, you just changed your commute. This was requiring people to uproot their families and move from the Los Angeles area to the Houston area.

We had numerous exchanges with the Boeing folks about this and got reassurance that the process they were dealing with was sensitive to this and that while there would definitely be a perturbation in the system that everybody acknowledged, they were aware of it and knew its dangers and would therefore track it. So we were comfortable that if it was the right thing to do economically and from a program standpoint, that the people were on top of it and it would settle down eventually and it would not compromise safety because nobody would allow it to. In other words, if they didn't have the engineering talent to make the decision, they just wouldn't fly.

DR. WIDNALL: I have a couple of questions. You mentioned earlier that you saw no new enabling technologies, say, in the area of propulsion and material that would really justify starting a new program. Do you see new technologies that are related to ease of maintenance, because you also mentioned how expensive the shuttle program was? And part of that is do you think the new technologies related to ease of maintenance would be viewed as exciting by the researchers and the engineers who would be pursuing such technologies?

MR. BLOMBERG: Well, Dr. Widnall, I think the answer's very clearly that there were lots of new technologies or new applications of technologies that would help both maintenance/obsolescence issues and safety, would improve incrementally safety, not a breakthrough, not a hundred times, but certainly meaningful breakthroughs in many areas. In terms of the romance of it and the excitement of it, I wish you could have been, for example, on our visit when we went out to meet with the people who were looking at new technology for an electric auxillary power unit, just as an example. Those people were so excited about what they were doing and so involved that it was really impressive.

I think the people involved in the space shuttle -- and I know in aerospace in general, because I work all sides of aerospace -- are very, very caught up in the field. I sometimes refer to it as an addiction. Those of us who are involved in aerospace don't do it for the money. Certainly it's not the most highly-paid industry around. It's because of the romance. It's because it's the only way to deal with your interest. If you're interested in human space flight, there's one program. That's it. You're on the space shuttle. If you're interested in building the next generation of commercial aircraft, really right now there are two or three manufacturers.

So I think there was more than adequate romance and more than adequate enthusiasm even for the smallest components down to literally 30 and 40 thousand-dollar changes in processes that the people really believed in, suggestion box items. I've been out to third-tier suppliers for which the shuttle is a very, very small proportion of their income, it's not a financial issue, but where they really want to make an improvement and have been thwarted because there's just no budget for it.

DR. WIDNALL: I guess another part of my question is -- because we have talked about this strain on resource and balancing the future with the present. Do you think there's a minimum number of shuttle flights per year that could be conducted safely? I'm talking about work force issues and facility issues and, you know, dropping below a sort of certain critical number.

MR. BLOMBERG: Yes. I personally believe that, and I think most of the members of the ASAP believe that there was a floor. As I recall, the National Research Council Committee said the floor was four; and we resonated pretty well with that. Clearly, if you go below some level as yet to be specified, you lose capability. You also aren't really saving all that much money because if you keep your work force around, your cost is there and they're just idle and that's not particularly beneficial.

So my own feeling personally, not speaking for the panel or anyone else, is I would certainly not want to see it go below four unless there was some compensatory development programs going on simultaneously. For example, if you were building a new orbiter, you could then fly maybe three or two and still keep capability. But it's just absolutely essential to keep that experienced work force involved, engaged, and working on the vehicle to keep their skills up.

DR. WIDNALL: Let me challenge you just a little bit on this issue of culture because, as you know, I'm a professor at MIT and so I'm dealing with our students. I can only imagine the discussion if I went into the class of these students and told them that they weren't going to go to Mars but they were going to develop a new pump. I think there is a discontinuity there that would affect many of the sort of what I would call aerospace advocates, and I believe very strongly that we have to kind of make that cultural change to emphasize the importance of doing the job right and doing it reliably. So I really resonate with what you say.

MR. BLOMBERG: Well, and I resonate with your comment. It's been quite a few years since I taught at the university level, but I do give guest lectures every once in a while and I've met with a lot of students. You're right, but part of that -- and I'm not saying this in a pejorative way -- is the naivety of youth.

DR. WIDNALL: Thank God for it.

MR. BLOMBERG: Thank God for it. Absolutely. But part of it is also the lack of a firm objective. When we had the Apollo program, the nation was committed to putting humans on the moon; and everybody was caught up in that. Right now we have that spirit within the NASA programs because everybody is caught up in the space shuttle and the international space station; but when you back that up to the university level, it looks as if it's mundane. When those folks come out, however -- and I would recommend to you, if you haven't done it, that you track some of your five-year-ago graduates, even from an elite university such as MIT, that have gone into the space program and find out what they're doing. You'll find out they are working on what they would have considered minutia back in school and they're loving it because they can see their involvement in the total program and the criticality of it.

So I think we need both. We need to have a mandate for a national commitment to a space program with some reasonable short-, medium-, and long-term objectives; and we also need to support our current flight programs better than we're doing. They can't be done on the cheap, and they can't be done based on just the ingenuity of the work force. It can't go on forever.

DR. WIDNALL: Thank you.

DR. RIDE: Just a little while ago, you mentioned that there are some numbers of identified risk-reduction measures that could be put into place. I wonder if you could discuss those.

MR. BLOMBERG: I could discuss a few of them. I didn't bring a list of them and, of course, not all of them will prove out by any means; but I think I mentioned one that's near and dear to my heart because it's a research area that I've done a lot of work in, which is adding predictor information to the display so the crew have a better situational awareness of what's going on. It's great to have all the ground support for the flights, but still it's the crew that are on the leading edge, the cutting edge of what's going on, and they have to know what the vehicle is doing. Right now they're not getting the best information that they could get. So that's a safety improvement I would like to see.

The general-purpose computers was another area where the program has been forced to work out ways to extend the current GPCs as long as the program lasts, which is just not taking advantage of modern technology.

The auxiliary power units. Right now they're hydrazine powered, which causes significant explosive risk during flight and significant risk to the work force on the ground. Electric APUs were looked at. They were very close to a reality. They were expensive. That was a fairly expensive retrofit. They were lacking a little bit of battery technology development which the industry said was, as I recall, something on a less-than-two-year time frame with a reasonable development program. They could have had the battery technology.

There's health monitoring of the main engines that I recall, better health monitoring systems which would get you out of a lot of first-stage difficulties, first- and second-stage difficulties in the launch. For example, you would not have premature shutdowns of a healthy engine which could get you into an abort profile situation when you could actually reach orbit. The panel was very concerned about aborts. They're not something that you want to fly. I'm just thinking through the vehicle.

There were TPS improvements that were probably more in the area of obsolescence and cost but also toughened the tiles a bit against impact damage. The foam that everybody has been speaking of. There were programs looking at different blowing agents that were on the drawing boards.

Then there were the larger-scale things that were longer-term, like adding a fifth segment to the solid rocket motors so that you could reach orbit with a main engine failure right off the pad, and other things such as that that were on a larger scale. So there were things -- and I didn't dig out my list of all these things that were briefed to us -- but there were things literally from the 50,000-dollar kind of level up to the 5 billion-dollar level, I guess probably the most expensive one being the full crew escape system, that were all at various stages of conceptualization and development. Some were actually developed and virtually ready to go in. GPS navigation is an example. We just kept after that on the panel because it just never got in. There were some antenna problems and some minor difficulties; but with a concerted effort with the smart engineers around, those could have been solved. Again, they took money; and there just was no money available.

DR. RIDE: What about in the area of risk assessment?

MR. BLOMBERG: There were some advances in risk assessment. NASA had used risk assessment, we thought, pretty well. The risk assessment models that were developed at headquarters were used appropriately. From a safety panel's viewpoint, one of the things that concerned us was that people have a tendency to use probabilistic risk assessment numbers as gospel, and they are really a relative design tool. You know, whatever numbers comes out of your model is not an absolute. It depends on all the assumptions that you put in. So we looked at that and we followed the development of the new risk model at headquarters and we were rather satisfied it was being used at an appropriate level and used also appropriately to supplement the engineering judgment of the people who knew and understood the vehicle very well.

ADM. GEHMAN: I'd like to follow up on -- go ahead, Dr. Logsdon. I'm sorry. Go ahead.

DR. LOGSDON: Earlier you said, Mr. Blomberg -- and I think I've got the quote right -- that budget shortfalls forced meeting short-term requirements with Band-Aid solutions. Could you give a few examples of Band-Aid solutions?

MR. BLOMBERG: Well, one that comes to mind -- and this is certainly not, by any means, at the top of the list of most important or most significant from the safety standpoint -- is the data cables that run from the data center out to the pads at Kennedy Space Center. These are old paper-jacketed cables, metal cables, into which water has intruded; and they keep losing pairs over and over again. The solution is to put air pumps on at various places along the cable and flow air in to keep the water out, as opposed to spending the money -- and it was not an enormous amount of money in the scheme of things -- to put fiber optic cables in and replace them completely, which inevitably will be needed.

Now, the argument was -- the rationalization, I should say, was that it's probably not safety related. If the cables fail, we just don't launch; but it doesn't take much imagination to say if the cables fail at just the wrong time, just the worst situation, that it could be a safety problem. So it all depends on how you look at it. If you look at worst case, then maybe it was. Was it Priority 1? Absolutely not. But is it an example? Sure.

The siding on the Vehicle Assembly Building, which blows off in the wind and is a problem, is another example of something that really needed attention that was just Band-Aided, just stick it back on for now. The roof of the VAB.

Then lots of things, mostly in the infrastructure. Test equipment. There's still cathode ray tube test equipment, even when the systems that they're testing have been upgraded once or even more than once; but the test equipment was never upgraded with it.

Dr. Widnall was talking about her engineers. I would venture that she doesn't have too many engineers who understand vacuum tube technology too well coming out of MIT right now or who can program in HAL. So those are the kinds of things we're talking about.

DR. LOGSDON: Let me go to the other end of that quote: "In the days after the accident, there were a fair number of press reports that the shuttle's safety budget had been cut by 40 percent." Does that comment make any sense to you? Is there an identifiable shuttle safety budget, and where would that 40 percent number have come from?

MR. BLOMBERG: Well, my guess -- and I haven't analyzed it -- but my guess would be that it comes from the budget for the Safety and Mission Assurance office and function within NASA and probably within the contractors. Again, that has to be placed in context because after Challenger, there was an enormous expenditure in that arena for things such as redundant inspections; and the aerospace industry has realized in recent years that redundant inspections not only don't improve safety but they can actually be detrimental to safety. So a lot of that reduction in budget, I would assume, having not looked at the press' numbers; came from what were rational and reasonable cutbacks in excessive expenditures for things like redundant inspections and for things that were passed over to the contractor to do and were still being done.

So we did not on the panel see that level of cut. We did comment several times and expressed concerns several times about the degree of work force cutback across NASA, which included the safety and mission assurance function but also included the engineering functions and the training functions and everything else. We felt very strongly that they were going down way too far and way too fast; and we spoke, I think, loud enough and long enough that we got heard and turned the curve around and got it to go back up. Because, again, of the experience level you need. This is not an industry where you can go out and just hire new people when you need them and have them be productive immediately.

DR. LOGSDON: Did you look at the mentoring relationship between the new folks coming into the shuttle processing world and the people that had that experience?

MR. BLOMBERG: We sure did. Not only that, we looked at that very carefully in the context of giving more responsibility to the contractor, because we said that the new NASA folks coming in in a smaller work force were not going to have the ability to learn on the job and get that hands-on experience. And we argued very strongly for a mentoring program across the two groups so that NASA folks could mentor with contractor folks and vice versa because unless you kick the tires, so to speak, you really can't understand this vehicle. There were programs such as that in the works. So we were pleased with the response to our recommendations in that area and the actions that were taken.

DR. LOGSDON: You say programs in the work. Did they happen?

MR. BLOMBERG: Yes. A lot of times the ASAP made recommendations to NASA and they were concurred with, but the following year we'd look at them and it was a concurrence in name only, there was no budget, nobody did anything. In that area, the area of mentoring and the area of training, there were some very, very positive steps taken to correct the issues that we raised.

DR. LOGSDON: Did ASAP have a view on the privatization effort and its impact on shuttle safety?

MR. BLOMBERG: We probably had about 30 views on it, Dr. Logsdon.

DR. LOGSDON: Well, you're here today. Let's hear yours.

MR. BLOMBERG: Okay. Well, first of all, it depends on how privatization is defined. Privatization was initially defined as going to the Space Flight Operations Contract, the current contract; and we had some concerns about the form of the contract that, frankly, turned out to be unfounded. They were theoretical concerns, and they were very well handled by both sides in the transition.

In recent years there's been talk about a total privatization, essentially giving the vehicles and the infrastructure to a private contractor and just letting them operate; and, very frankly, I feel that that is very naive, very unrealistic, and will never happen. I mean, there is nobody out there, I think, who would want to take on that responsibility unless they're indemnified; and if they're fully indemnified, then the government is gaining nothing except the contractor's fee.

So the cost is going to go up. So if there's some political reason why you don't want government work force working on it, then I think that can work; but you'd have to be very, very careful of the transition. It's not the steady state that you worry about in those things; it's the transition from one state to another. You've got a program that's over 20 years old, 25 years old really. It's been flying for over 20 years; and to try to change its culture overnight by saying it's totally privatized and removing the checks and balances that everybody has become accustomed to could entail some increased risk. It could be done. I would prefer to see it done in the next program and design it from the ground up.

If you want a privatized program, then design it from the ground up; but with one customer, the government, and a limited number of flights and an unknown liability for things like the infrastructure -- you know, what does it cost to change a roof on the VAB or the side panels or to meet environmental concerns if they should come up -- I just don't see it being realistic to transfer to a private contractor completely.

DR. LOGSDON: Under SFOC, there are a particular set of incentives. Was there any concern that those incentives diminished the emphasis on safety by USA or were you -- you, I guess, as an individual in this case -- confident that USA could operate the vehicle as safely as the civil servants had done in the first 20 years?

MR. BLOMBERG: Well, my answer on that has to be time-dependent. When I read the Statement of Work for the contract to USA, I had great concerns. I was concerned, for example, about the incentive fee for meeting launch on time. I thought that was ill-advised because the last thing you want to do is tie some money to a launch decision. That has to be made purely on risk grounds. I was also concerned that the safety measures against which the contractor was going to be evaluated were defined by the contractor, and so you could end up with a situation where you managed to the metrics rather than managed to the safety of the vehicle. That was in theory.

In practice, we looked at USA's performance very closely. I know the folks there very well and have followed their performance, and I think it's been exemplary. They have called launch halts whenever necessary -- in fact, at points where I probably would not have called them personally because I thought it was ultraconservative, but it's better to be ultraconservative than the other way around. So I think the performance has been right on what you would want. They have the safety culture that is necessary. That doesn't mean it's a hundred percent effective. That doesn't mean it can't be improved, but my concerns at the outset really did go away.

DR. LOGSDON: One final question. This is, I think, a giant extrapolation from what you have said this morning; but let me ask you about it. You've said you see no progress in materials or propulsion that would justify investment in a new vehicle, that the shuttle has to fly past 2020, and that there are lots of improvements that could be put into the shuttle. Would you recommend building an updated version of the shuttle design, one or two?

MR. BLOMBERG: Again, without knowing the full budget picture, just from an operational safety standpoint for the space shuttle program, I would absolutely recommend that. I think the finest thing that could be done right now would be to take all of the knowledge that the people have of the space shuttle system and all the additional knowledge that your board is going to produce, which is scrutinizing the system more than it's ever been scrutinized in recent years, and put that into one or two additional orbiters and when those come on line, maybe retire the oldest of the current ones. I think that would be the best thing that we could possibly do both for the safety of flight and for expanding our knowledge of human space vehicles.

Absent that, I would certainly like to see the existing vehicles upgraded with as many of those things as is reasonable to put in. We were talking about escape, for example. It might be a lot easier and more cost-effective to put an escape system into a new shuttle vehicle than to try to retrofit the existing vehicles and cut through the existing mold lines.

So I would certainly love to see that and I think it's a way to go while simultaneously commencing the basic research-and-development programs that you need to have a radically new vehicle. Because it's not just going to happen. There's no market out there for building efficient reusable rocket engines unless it's for a human space vehicle. So NASA and the country are going to have to do that and work on the materials side, but it's unclear how long it will take to get the breakthrough you need to have a significantly better vehicle than the upgraded shuttle that you're talking about, the shuttle derivative, would be.

DR. LOGSDON: Thank you.

ADM. GEHMAN: Mr. Blomberg, among the other tasks that this board has, including finding the direct cause of this accident and making recommendations to prevent it, we also have to place our report, in terms that I've used, "in context." As the chairman, that's one of my specific problems is to place our recommendations in context.

One of the contexts is the life of the shuttle program, which is something that we've talked about before. If we're near the end of the shuttle program, our recommendations would have a certain flavor to them. If we are only 50 percent of the way through the shuttle program, as has been suggested that we're going to be flying shuttles until 2020, we're at the halfway point. We've lost 40 percent of our vehicles at the halfway point.

This problem of putting it in context is weighing on my shoulders; and I was struck by some words in the last ASAP report that you signed, which was last year's, technically, 2001's. I would like to read something here. I'm not going to throw these things back in your face, but I want to allow you to talk to us about it.

This was finding and recommendation No. 1. "Last year, concern arose that the planning horizon for the space shuttle and the international space program was too short, imperiling the development, advancement, and adaptation of safety improvements" because you couldn't amortize them or you couldn't justify them -- my words. "It is now recognized that the space shuttle will be used well beyond 2012, a longer life span than was originally anticipated. Now serious safety concerns are currently ranged around the potential for lost opportunities in safety improvements which can lead to safety problems as ageing systems deteriorate." In other words, now we've got a new set of problems. "The panel believes that the space shuttle is fully capable of supporting the ISS for its entire life."

So my understanding of what I just read is that by extending the program life, we now have eliminated the excuses for not making infrastructure upgrades and all the safety things that you have mentioned, which I value that as a good thing -- that is, if there's money there -- but now we have a new problem and the problem is, of course, ageing and deteriorating systems. My first question is: Have I characterized that approximately correctly?

MR. BLOMBERG: Yes, I think you have, although I think it's a matter of emphasis. I don't think the ageing issue per se is anywhere near as great as the other issues, the issues of not upgrading the vehicle. I think the ageing issues could very likely give you some graceful deterioration, whereas the upgrades could give you some quantum jumps in safety or reductions in risk.

ADM. GEHMAN: The reason why the ageing problem is stuck on my forehead so well is because of the theory of the unknown unknowns, that it's turned out that the parts of the shuttle program, the parts of the STS which were viewed to be the most dangerous have not failed -- it's always something else which has gotten us, it seems -- and we feel that if you're going to continue to fly this thing for twice as long as it's already flown, there has to be an aggressive program out there looking for what we call the unknown unknowns. In other words, you've got to start looking for trouble. I believe that can be done, that we have other examples of aircraft that are working kind of at the edges of their margins, that are old and things like that -- military aircraft and civilian aircraft. The second part of my question, though, gets to the comment about the relationship between the shuttle and the ISS. Do you believe that they are linked?

MR. BLOMBERG: Absolutely. I mean, the ISS was designed to the shuttle's capabilities, with some help from the Russian vehicles and a little bit from the European vehicles, but basically to the shuttle's capabilities. Frankly, from my own perspective, it would probably be a poor economic decision for the country to build another vehicle to service the ISS because the next-generation vehicle might have a totally different mission. So why not, as long as the space shuttle is capable of servicing the ISS throughout its entire life, keep that symbiotic relationship going. I mean, it was designed to re-boost the space station. They were designed to exchange consumables in both directions, if necessary.

So I think just a very simple answer is to keep the space shuttle flying as safely as possible as long as you are doing the space station and then think about what the mission is for the next vehicle, whether it's the support journey to Mars or some other purpose. Going back to your first remarks also, I would like to point out that the kinds of safety improvements that we're talking about are not only hardware, software, and even ground infrastructure.

We're talking about training. We're talking about re-analyses to understand and characterize the vehicle better for its now realistic lifetime. So that while there were life limits placed on every component -- you could only keep an external tank in storage for so many years and you could only keep a solid rocket motor segment in storage -- those limits are no longer realistic, and it's time to redo those analyses.

Well, as Dr. Widnall was saying, that's not romantic -- romantic from the Congressional standpoint. "Why do I have to redo an analysis? Did you get it wrong the first time?" It's millions and millions of dollars, but really that's what's necessary. It was done after Challenger. The failure modes and effects analyses were all redone. The critical items list were all redone, based on experience.

Well, now we have a lot of additional experience in both directions. We know that there are things that were originally characterized as Critical 1 items that aren't Critical 1. They're not Criticality 1, and there are other things maybe that were not categorized as Crit 1 that are now, because of ageing conditions, and either should be changed out or made redundant or some other changes. We need to recharacterize that.

All of the computer models that were used to develop the space shuttle in the late 1970s have been upgraded multiple times, the materials models, the flow models and so forth. What are the implications of those on the vehicle in both directions? Were we too conservative with those things, or were we too liberal? Did we misunderstand?

I believe that the requirements, down to the most minute requirements, need to be revisited by the people who understand the system, to determine whether they need to be upgraded. The simple example that the program went through, I don't know, about five or six years ago with a new pressure-sensitive adhesive in the solid rocket motors -- they couldn't use the one that was spec'ed, because of environmental concerns, and they had a requirement of a certain peel strength.

They went out and found another adhesive that met the requirement. It was right in the middle of the range of the requirement, and it didn't work. When they went and re-analyzed it, now scrutinizing it, they found out that they had been flying at two or three times the requirement and they really needed it. They bought the best off-the-shelf stuff and it was much higher than the requirement, and that was absolutely necessary.

So falling back on a spec that was written before you flew the vehicle doesn't have a lot of meaning. You now have over a hundred flights. It's time to re-do that. It's a costly process, it's not a romantic process, it doesn't produce things that are impressive to the public, but it is absolutely what goes on with commercial aircraft, with military aircraft, and it should be going on with the space shuttle.

ADM. GEHMAN: You are aware, of course, of NASA's budget and the kind of limitations on their budget. As I understand it, you are recommending that we consider upgrades to the shuttle to keep it fully capable of flying for another 20 years, given certain conditions that you've outlined here; but we also have to get to work on the next manned spacecraft. This is going to be a tremendous pressure on a budget.

MR. BLOMBERG: Well, maybe. You know, there was a lot of money spent in the NASA budget, during the 15 years I was on the ASAP, that was not productive. Billions were spent on the advanced solid rocket motor. It never flew. Millions or billions -- I'm not a budget expert -- were spent on the X-33 and the X-34. They never flew. I think that even within the present budget confines, it's possible to support the international space station and the space shuttle to the fullest extent that they need and have a technology development program that will support a next generation; but if you try to initiate a new vehicle program, to develop a vehicle from scratch when you don't have the technology -- so you're doing the technology development and the vehicle development at the same time -- then you're not going to have enough budget. That's what happened, I think, with X-33.

Instead of going and working on the technology areas that were clearly needed to make X-33 work, they embarked on building a test vehicle. I just am a believer in finishing what's on your plate before you take more, and I think supporting the ISS and shuttle adequately is first priority for the country.

MR. WALLACE: Let me switch to sort of a pure human factors type of question. We're a little over two months in this effort, and I have to say there are no lack of processes at NASA. I mean Flight Readiness Reviews and COFRs and Launch Readiness Reviews and all the processes leading up to that; and every time we ask a question, we get lots of paper.

Really, I mean it's a tremendously methodical, thorough set of processes; yet the investigation has raised some troubling questions about sort of communications and decision-making and flow of information up and down. My question is sort of human factors. Is there a point at which people find too much comfort in processes, where processes might actually stop thinking? Admiral Gehman talked about the unknown unknowns.

MR. BLOMBERG: You certainly can be over-proceduralized and can be process-bound. That is one of the things that can happen to an organization. I don't think it has happened to NASA. However, any big organization, any organization as large as NASA will have some communications issues and it is always difficult to determine how much should bubble all the way up to the top, to the administrator's level, for example. Frankly, there is a real question of whether you want the administrator making ultimate technical decisions because the administrator is just that, an administrator.

I think in the 15 years I observed NASA, I think the processes were not perfect but certainly as good as you could expect from a large organization, and improving. It's an overused phrase, but continuous improvement was there. Now, not everything that was done was an improvement; but people were watching it. I think the processes are sincere. I think everyone within the system is truly dedicated to safety; and the big change that I saw over the 15 years on both sides, contractor and NASA side, was when I first joined the panel, I would say that the likelihood of a randomly picked person in the system standing up and saying, "Time out. We're not going to fly. I'm stopping the flight," was very low. Today I would say it's virtually a hundred percent, that anyone out there, from somebody turning a wrench to a middle manager to a senior manager, would feel absolutely empowered, if they were uncertain, to say, "Stop," and they would be listened to, that it would not be something that they would say, "No, you don't know what you're talking about." It would be at least run to ground very professionally before a decision was made; and certainly if time was of the essence, they would not fly. That, to me, is the essence of a good safety system.

MR. WALLACE: Well, I didn't mean to suggest that more decisions needed to go to the administrator's level at all. I understand. But just to follow up on your answer where you say anybody can stop the process, in your experience, is there any change, post launch, in terms of that sort of thing?

MR. BLOMBERG: Well, of course, the options available to you post launch are fairly limited. The post-launch environment and the launch countdown environment, I think once you start into a launch countdown and then you go on from there to the post launch, you really do want to be procedurally bound. You want to be requirements-driven. You do not want to be defining waivers on the fly.

A waiver sounds like a terrible thing. I know when I first got into the aerospace business, I said, "You mean you're waiving a requirement? You're agreeing to fly in an unsafe condition?" Well, that's not the case, in virtually every situation. A waiver is a carefully thought-out process by which you decide that something is an acceptable risk. You don't do that under time pressure while you're in the middle of a launch count. You don't do that while you have a crew up in orbit and make decisions on the fly.

So, you know, if the flight rules say, "If such and such happens, you come home," you come home. Then you work it out. You know, if it turns out that you were wrong, that it was a sensor failure rather than a true failure of the system, you've taken the conservative approach. So I think that that's where you have to draw the line in this is when do you have to be procedure-bound and when can people have some leeway in the system and call it.

Even though it might sound conservative, I would not want somebody, while a flight was in process to say, "Time out. Bring it back." That's not the way to go; but, "Time out. We ought to study this and see whether we ought to bring it back tomorrow," that's what the Mission Management Team is for and things will get elevated to that team very rapidly. It depends on the context of what you're dealing with.

GEN. BARRY: One of the things we're trying to understand is a little bit about the management structure, and I'd like to see if this resonates with you. We're going to talk pre-launch and post launch. Pre-launch, obviously Challenger, a lot of focus has been spent on improving the process, particularly in a certification of flight readiness.

If we characterize that and we said, okay, pre-launch is centralized, it is focused on competition between centers a little bit, where all the centers are involved in certification of flight readiness, and there is, some would some argue, an attitude that you've got to prove there is no problem. Post launch is more de-centralized. It is only really one center primarily involved and that's the Johnson Space Center and, as some would argue -- and we're trying to figure this out -- that you have to prove there is a problem. Does any of that resonate with you insofar as pre- and post-launch considerations are?

MR. BLOMBERG: Well, it does resonate; but I think, General, that it may be a bit of a simplification. Pre-launch, I think you have a whole series of what I would call challenge-and-response meetings that culminate in the combined Flight Readiness Review, but really every element and every subsystem has its own Flight Readiness Review that start way before that and it's a series of challenges based on what you know about the system and its recent performance. So if there was a hiccough on a previous flight or during processing or the previous flight of that vehicle, then you've got to clear that; and that starts way down with the sub-tier people, each of whom goes through a bunch of challenges. I would agree with your characterization that it's "Prove to me that it's safe to fly," but it's an incremental process.

Once the flight is up, the focus shifts to JSC for sure, but, remember, there's a Mission Evaluation Room operating not only at every human space flight center but at all the major contractors and those rooms are there specifically to support their elements and the issues. So I guess my short answer is I agree with you except with the caveat that it has to be clear that the JSC folks are not trying to make technical decisions that are outside of their technical areas. They rely completely on the technical specialists. If it's a propulsion issue on the thrusters, for example, they would go to the thruster specialists. What they are specialists in is mission operations and once you're operational and once you're flying, they know all of these requirements and the rules and so they know to really turn to you and say, "You told me from your analysis that if this happens, if so many of these fail, we have to come back. We're coming back because you told me that." And if the specialists were to say, "Well, we really didn't mean that. It's okay to go on," then -- I can't recall a situation where that's happened and they've won; but if it were to happen, they would certainly have to produce some very, very compelling analyses and produce them virtually instantaneously. For example, they probably have had to have a change request in the system already for that to happen. So my take on it is that your characterization is a good one and the system is a good one. That's about the way it should go.

GEN. BARRY: Let me follow up on that, if I may. If it is a rather structured process going up prior to launch with the Certification of Flight Readiness -- and I think the next hundred flights for the shuttle are programmed to go to the space station, a couple are going to Hubble, so other than just the space station -- some have proposed an idea of having a certification of re-entry readiness. In other words, you have an associate administrator who signs off on the Certification of Flight Readiness and we have a de-centralized focus with the Mission Management Team, the MER, and you have also, of course, the flight director involvement. If we are on the space station, should there be a more centralized focus on re-entry?

MR. BLOMBERG: That's actually a very complex question because the first thought I have is it depends on what countermeasures you have available that would make that certification a valid certification. If you have no ability to fix the vehicle or to bring the crew back any other way, then it's kind of a moot point. If there are things you can do, if there are alternatives, then that has a lot of appeal as long as it doesn't get in the way of all of the other things that are necessary for safe mission operations. Re-entry is not just getting in and pushing a button and saying, "Let's go down." There's a lot of crew preparation. There's a lot of support needed from the ground; and as long as that review doesn't get in the way of those things or supplant any of them, I don't see where it would hurt; and it might help.

ADM. GEHMAN: Mr. Blomberg, I was thinking here to myself that in support of one of your comments here when we were talking about re-entry -- having looked at re-entry things, checklists and things like that -- I was reminded that one of the things on the re-entry checklist is to put all the laptops away, which supports your argument that we've got to upgrade the computer systems because what we're doing is we're carrying a lot of laptops up there because the computer systems won't handle it. Earlier we had this discussion about whether or not the shuttle is a research-and-development or an operational vehicle and I think I heard you say -- and I'll give you a chance to comment -- it's closer to being an R&D vehicle than a transportation system.

MR. BLOMBERG: Well, I don't even think it's close. I mean, it is an experimental vehicle. Just the fact that it's flown over a hundred times doesn't change its nature. Every flight is an experiment. Every flight is gaining knowledge. It's not an airline, by any means.

ADM. GEHMAN: We may be using the terms loosely here as to whether it's an experimental vehicle or an engineering development model vehicle or something like that; but in any case, we are in agreement that this is an experimental vehicle. But it is being used in an operational sense.

MR. BLOMBERG: Well, that's true and I don't think those things -- I think that's a semantic issue more than a technical issue. It's being used for the repetitive support of the international space station and for flying humans into space on a regular basis, but that doesn't change the nature of the vehicle. That nature arises, for example, from things such as you've got multiple copies and they're not all identical by any means, that the technology that's being used in the vehicle is not widely-used technology, or much of that technology. It doesn't come from the nature of the mission.

ADM. GEHMAN: Of course, there's no law against using an engineering development model or an experimental vehicle in operational use. In the first Gulf War, the military's JSTARS was still an engineering development and was used. The Predator unmanned aerial vehicle was used in Bosnia that was still technically under engineering development. So there's no law that says you can't do that. I'm still working on this context thing, and I want to get your views. I want to get this thing clarified. So it's an experimental vehicle and we're still learning about the environment in which it operates and particularly this Mach 24, 300,000-foot altitude environment which we know precious little about for a winged manned vehicle, but it is being used for operational purposes also. Now, the question I have relates to your building another one. If we're in agreement on those two points, do you think it's reasonable for an experimental vehicle to have a 40-year life?

MR. BLOMBERG: I don't see anything that precludes it. I mean, I don't think we have any models to follow for that. This is a unique situation, probably one that we've never been in before; but given the care that went into the design of the vehicle and that has gone into its operation, I don't see anything that precludes that.

ADM. GEHMAN: Let me rephrase the question, then. Let's forget about NASA and forget about the shuttle program. Do you think the United States should evolve into manned flight into space by not evolving itself for 40 years?

MR. BLOMBERG: Well, Admiral, you know, if you ask me do I think that the United States made a poor decision perhaps 20 years ago in not spending the money to have a shuttle replacement ongoing, I would say yes; but if you also ask me would the country be better served by not having human space flight until a shuttle replacement is produced, I would vehemently say no, I mean, that human space flight is important, we are learning a great deal from it, we are accomplishing things in space, and the shuttle is fully capable of supporting that at an acceptable, albeit not perfect, level of risk.

Now, would we have been better if we had Shuttle 2 now or some other vehicle? Probably. But we didn't make that decision. So right now we have to play the cards that we're dealt. The cards that we're dealt is the only human-rated vehicles that we know of on this planet are Soyuz and Shuttle, and Soyuz can't do the job. So it's going to be Shuttle.

DR. OSHEROFF: Well, first let me say that your team won last night. I'm sure you're happy about that. I noticed that. I have no stake in that. Stanford did not make it in that part.

I wanted to bring up a question. When my graduate students do something with a cryostat, which is actually a kind of extreme environment and things go wrong and they end up having to warm up and fix things, I always tell them that they learn far more from their failures than they do from their successes. I think that goes well beyond graduate students doing research projects, as well.

I think it is fair to say that we have some good ideas as to what led to the loss of the Columbia and her crew. We certainly don't know for sure and we're not willing to identify anything at this point; but assuming that we've done that, can you give me some ideas as to what the lessons are that we need to learn? I guess I'm particularly interested in the issues of risk management and risk abatement.

MR. BLOMBERG: Well, this is an area which I've examined quite thoroughly, not only for the shuttle but particularly aircraft accidents that I've been involved in. The reality is that the sequence of events is that whenever you have a human vehicle, a vehicle that's going to transport humans, you do as much analysis as you can possibly do -- and I'm including testing in that -- to make it as safe as possible before you operate it. But as the vehicle gets more and more complex, it is absolutely impossible to check out every interaction and every type of failure and every situation that the vehicle will encounter. Therefore, in those places that you consider to be most risky, you build in redundancy, you do whatever you can, and you hope that your operational experience, the closed-loop feedback, will give you that additional experience, as you operate the vehicle, to upgrade it.

Mr. Wallace was talking about the airline industry. This goes on all the time, whether it's brakes or various components of aircraft that reports come back from operators saying, "We're having trouble with this." The manufacturer looks at it and says, "Oops, we missed that." We didn't miss it because of dereliction of duty. We missed it because it's a maybe a second or third order of interaction, but now we can fix it. We've got this operational experience. Unfortunately, part of our operational experience in any vehicle is accidents. We hope it never gets to that, but it is part of the reality of operating, particularly in a high-risk environment. When there is an accident, we get a spinoff benefit; and the benefit is that we get the resources to focus in on the area that was involved in the accident and then a wider part of the vehicle. Challenger is a perfect example. There was a focus in on virtually every high-risk component of the vehicle, and a lot of improvements were put in.

I think that is the natural progression of things; and your students, when they destroy an experiment or have a problem with the laboratory, learn from that. You'd hope that they don't learn by someone getting injured or a high-cost destruction of property; but regardless, as long as we close the loop and as long as we didn't do anything intentional, deliberate, or uncaring -- we are fallible. I mean, I'm a human factors person, and I'm the first one to tell you that humans are perhaps the most fallible part of any system. We design the systems, we operate the system, we make the decisions to go, and so somewhere in whatever you're going to find for Columbia, humans failed.

The question that I would want to ask is: Did we fail through malice, did we fail through neglect, or did we fail through ignorance? If we failed through ignorance, let's learn from it, let's increase our vigilance, and make the system better and keep that closed loop going. That's all we can do in any vehicle.

DR. OSHEROFF: I would suggest that there's another possibility and that is that the failure was through a faulty process which did not properly identify some of the risks and which would then have allowed NASA to take steps to minimize those risks.

MR. BLOMBERG: Absolutely. That is certainly a possibility; but if that's the possibility, I would speculate that that process failed because we didn't understand it, not because we short-circuited it or because anybody deliberately said, "Oh, it's okay. Let's go full speed ahead." That's part of the understanding. It's not only characterization of the materials and the software and so forth, it's characterization of how people and processes work. That's an integral part of it, and the whole shuttle program has been struggling with that now for years and doing a pretty good job of process control and understanding that processes are, in many cases, as important as products, as the hardware and software that results from them. So they've developed a process failure modes and effects analysis technique and some other things.

It's very likely that -- it's assured -- I mean, I am sure that whatever caused the accident escaped a process at some point. It had to have, because it flew. So at some point in the process, somebody missed it; and it may have been my panel. We may have been staring it in the face and missed it, but it wasn't for lack of trying, I'm convinced, on the part of all concerned, because, as I said in my opening remarks, I just have never seen a system more safety conscious and people more dedicated to safety. That's not a hundred percent assurance; it just says that their hearts are in the right place.

DR. OSHEROFF: Well, I fully agree with you, but I think that we really have to look at what processes may need improvement and I'm sure you agree with me on that.

MR. BLOMBERG: I do, Doctor, but with one variation. I think that the time to do that is after you've decided what the proximate cause was. The processes are in the root cause domain, and right now my understanding from your statement is you're still struggling with understanding the proximate cause. Once you understand that, then I think that's the time to step back and say how did that slip through all of the defenses.

DR. OSHEROFF: Well, let me suggest -- and I think that NASA's already suggested this -- inspection of the shuttles in orbit, with the ability to repair at least the tiles, if not the RCC panels.

MR. BLOMBERG: Well, even if that doesn't turn out to be the cause of the accident, that may be a positive outcome of the investigation, saying here is a technique, is an ability that we had that we weren't making maximum use of. That's the kind of improvement that I was talking about that comes out of this intense scrutiny. Again, I don't think that we're dealing with an escape here that anybody can be faulted for not having realized, because the operational experience just didn't point to it.

DR. OSHEROFF: I'm sorry, I have absolutely no intention of assigning fault to anyone. This is an extremely complicated vehicle and the process of certifying it for flight readiness is extremely complicated, but I think we have to set aside the issue of fault and, in fact, not identify that but recognize the processes that must be changed.

MR. BLOMBERG: I fully agree with you. I'm just saying I think it's a matter of timing, and I think that is done most effectively after you understand the causes and, you know, you have to work backwards from the effects and then say what processes were there that could have caught this and are reasonable to perform. I venture that you will find in some of your blind alleys, some of the theories that you've checked out that don't turn out to be the cause of this accident, you will still be able to back those out to improved process because you've scrutinized those so much. That's a terrific benefit of the kind of investigation that you're doing. It's just the question of when to do it.

DR. OSHEROFF: So the idea of minimizing risk is certainly one that's very valuable.

MR. BLOMBERG: That has to be the overriding principle of the entire operation is risk management and minimizing risk and understanding the risk you're accepting. It's not only minimizing the risks but it's understanding the risk that you've accepted.

DR. OSHEROFF: Thank you.

DR. WIDNALL: I'd like to follow up a little bit on some of the words you've used. I didn't write them all down, but you said, you know, we know it wasn't due to malice. Then you had this rather large catch-all category called ignorance, and I guess I'm just not willing to allow so much to be in this category of ignorance. Being a poor engineer, I don't have a rich vocabulary in organizational theory; but it seems to me to me words like denial, organizational structure in the way the various levels work together, issues of unconscious trade-offs that various parts of an organization make, I think somehow that vocabulary has to get into any kind of framework which otherwise might be called ignorance. I mean, I think we really need to think deeply about how one organizes an effective, you know, as you mentioned earlier, large organization for the whole question of making good decisions in the safety area.

MR. BLOMBERG: Well, I agree with you completely; and probably the word "ignorance" was unfortunate. Being a poor engineer myself, I couldn't think of a better term. But I wrap in that the clear issues of things like we don't have the technical knowledge to understand how a material performs under certain circumstances because it's never been tested in that environment and we never looked at it because we never thought it was a problem, which is another form of what I'm saying, in quotes, is ignorance.

My own concern is that, with the best of intentions, any organization -- and I think NASA and its contractors may have fallen into this -- when you're so goal-oriented and you're so budget-limited, you tend to put blinders on and you tend to look at -- in my experience here, they tended to look at the next flight, let's look at getting this next flight off as well as we can. Maybe the old not seeing the forest for the trees comes into play. That's one of the reasons, for example, why we try to get engineers and managers in any organization to understand the end-to-end system so they understand where their portion fits in and maybe will see some of the interactions that go beyond just the performance of their subset. That clearly could have been a problem here.

The space shuttle people were under enormous stress, stress from one side of supporting the international space station and not being the weak link in the international effort to put a space station up and, on the other side, the very real knowledge that if they could not perform within the budget, there was a risk to the entire program and, therefore, to their lives, to what they had dedicated themselves to. I'm absolutely convinced that nobody said, "Well, we've got to go ahead. I know we're increasing the risk; but if we don't do that, we could lose the whole program." That I would be very sure of, knowing the people; but whether they inadvertently missed something because of their zeal and because of their innovative capabilities remains to be seen.

Certainly they need relief. They're not going to be able to fly for another 20 years under the stress levels that they've been asked to fly under for the last seven or eight. I would liken it to a very taut rubber band. You can only pull that rubber band just so far, and eventually it's going to snap. These folks are being asked to continually pull rabbits out of hats, and you can't do that forever. I am convinced that if they knew they couldn't pull the rabbit out of the hat, they would stop the flight; but as you're saying, sometimes you think you've pulled the rabbit out of the hat and all your analyses say that and you just don't have the tools to give you the proper insight.

DR. WIDNALL: Or you don't really want to know the rabbit is in the hat.

MR. BLOMBERG: Well, I think there's very little of that. I honestly do believe that the folks on both sides, NASA and the contractor, do want to know if the rabbit's still in the hat. They understand the implications of failure. They are very dedicated to the crews and to keeping everybody safe. So I think if there's uncertainty, they err on the side of conservatism; but sometimes zeal can say that you're certain when perhaps you should have said you're uncertain.

ADM. GEHMAN: Mr. Blomberg, on behalf of the panel, we want to thank you very much for your help here today. You've been looking at this for over 20 years, and your views are very helpful to us. We appreciate your very frank answers. We appreciate your willingness to dialogue with us as we attempt to bring our level of knowledge up to yours. Your views are very helpful to us, will make a big difference in the report, and we want to thank you for your contribution. So thank you very much. We'll take about a ten-minute break here while we seat the next panel. (Recess taken)

ADM. GEHMAN: All right. Ladies and gentlemen, we're ready to resume here. We're privileged to have join us today a panel. Mr. Gary Grant is the systems engineer in the Thermal Management Group for Boeing; and Mr. Dan Bell is in the TPS, subsystem manager for Boeing. I'll invite you to make a statement and give us a briefing or whatever you want to do; but before we begin, let me ask you to affirm that the information you will provide to the board today will be accurate and complete, to the best of your current knowledge and belief.

THE WITNESSES: I affirm that.

ADM. GEHMAN: Thank you very much. Would you introduce yourselves. Tell us your background and what your current position is.

DAN BELL and GARY GRANT testified as follows:

MR. BELL: My name is Dan Bell. I am the TPS subsystem manager for the Boeing Company. I've got 15 years of experience in TPS, TPS installations, materials. Prior to becoming the TPS subsystem manager, I was the manager in the Thermal Management Systems Group in the Huntington Beach facility, also Boeing.

MR. GRANT: My name is Gary Grant. I'm also in the Thermal Protection System. I have 14 years experience, primarily in the operational and turn-around area and requirements. I'm an active member of the LASS subsystem, and I'm acting as an assistant subsystem manager in that capacity.

ADM. GEHMAN: Thank you very much. We're delighted to have you join us today, and we invite you to make a presentation or a statement.

MR. BELL: I think we're here to give you guys a presentation.

ADM. GEHMAN: Go ahead.

MR. BELL: I want to bring up the charts.

Next slide, please. We're here to kind of bring the board and give an overview of our TPS and RCC systems. In this presentation we're going to talk in some detail about the reinforced carbon-carbon system, the leading edge of the vehicle and some other components, what we call our high-temperature reusable insulation. I think you all know them better as these are the black tiles on our vehicle. Our low-temperature reusable surface insulation, these are the white tiles. AFRSI or FIB -- each of those are kind of interchangeable names -- those are kind of quilted soft goods that we use primarily on the upper surface of the vehicle. We have FRSI, flexible reusable surface insulation. These components are a needled felt material that's used on the upper surface of the vehicle, more durable than our AFRSI material. Then we're going to go into some penetrations and seals, those locations on our vehicle where we have areas that need to be closed out with different thermal barriers and sealing systems.

Next slide, please. Just to demonstrate on a very high level where the RCC and these different components exist. RCC makes up the leading edge components. The nose cap and what's not shown here on the lower surface. We also have the chin panel and what we call the aero head, and that's the forward attach point for the vehicle itself.
Next slide. When we talk about our high-temperature reusable surface insulation tile, those are the black tiles, the upper surface tiles that are shown here. Most have seen the lower surface -- and we'll get into that -- but the entire lower surface of the vehicle is covered by those components.

Next slide, please. Our LRSI tile. As you can see, right around the forward windows and on the forward edge of the OMS pods themselves, we have our low-temperature surface insulation tiles. Next slide. Our AFRSI blankets or FIB blankets that we have cover a large acreage of the upper surface. These components are lower maintenance than are LRSI tiles, and that's the primary reason those were selected over the tile system for that upper surface.

If we go to the next slide. This fills in the puzzle with our FRSI system. This is a felt system, very durable and very maintenance friendly, having workers in and around that vehicle. The penetration seals and thermal barriers, we're going to get to on some later charts.

Next slide, please. When we talk about the environments that our vehicles are exposed to, the first thing everybody asks is what kind of temperature, thermal environments we're exposed to. What's shown here are some data that came off a compilation of data taken from three flights early on in the program. It shows you a variation in temperatures from the very forward edge of the vehicle, lower surface, ranging from 1900 degrees. Then we have some areas on the vehicle that we'll talk about a little later on that get upwards into the 2500-degree range. These isotherms vary across the vehicle. Our upper surface of the vehicle sees much lower temperatures, generally less than a thousand degrees, and varies, depending upon the location, to as low as 300 or 350 degrees at the top of the payload bay doors.

Next slide. Now, when we go through a re-entry cycle, what we wanted to demonstrate here is the change in pressure; and pressure is an important part of the equation on re-entry. Starting from the time of re-entry, you can see how the pressure actually increases as you get further in the atmosphere, as one would expect. This was taken from a body point forward on the vehicle surface.

Next slide. I wanted to touch base in a little more detail on some heating and some very specific locations. These are some of the more extreme environments that our TPS, our tile systems see. A body point on the very forward edge of the nose landing gear door, Body Point 1024, sees a peak heating of about 2300 degrees Fahrenheit. On the door itself, the temperatures start to decrease as we move aft. We're still getting extremes around close to 2100 degrees there. We do have a very hot region in between the two elevons, the inner and outer elevon. In this region we get some additional heating that causes us to push that tile system upwards to 2500 degrees.

ADM. GEHMAN: There are two lines on each of those graphs. What do they mean?

MR. BELL: I don't think I have the background on this specific slide to answer your question correctly. So we'll get you that data. I do know that the lines that were listed there are the actual temps, though, that were measured at those body points.

Let me go to the next slide. The TPS system is very extremely part-count heavy. We have very high numbers of parts that we have to deal with on a daily basis. Our high-temperature reusable, our black tiles, what's listed on the first line there, is two different systems. One is our LI-900 system, which makes up the majority of the components, 9-pounds-per-cubic-foot tiles. Then our LI-2200 tiles make up a smaller subset of that, and we'll get to those locations on some later charts.

You can look there just with those systems alone. There's about 20,000 tiles on each vehicle. TUFI tiles, which we'll talk about, are our newer introduction to the vehicle; and we have about 306 of those installed on the vehicle. Those primarily take up the base heat shield and upper body flap section of the vehicle at this time.

FRCI tiles, which were an introduction sometime in mid-program, we have almost 3,000 of those installed. Again, now getting to the upper surface, the upper surface tiles, our LRSI, about 700, actually 800 tiles with varying density of substrates. Then if we look at the amount of area occupied by our FIB or AFRSI blankets and then our FRSI, we're talking over 2,000 square feet for each one of those systems. It's a lot of parts to deal with.

Next page, please. I wanted to touch on how our system goes together, and it's primarily for our tiles. Well, let's start at the top of our system. The tiles are a substrate, which three of the components that we are currently using up there are listed. LI-900, LI-2200, two of the original substrates from Day 1 on the program, still occupy the majority of our substrate material. We have a material called FRCI 12 which was introduced at a later time. It's got some benefits from a strength standpoint. Then we have what's not listed up there, an AETB-8 material, an 8-pound-per-cubic-foot material that accommodates us the use of a TUFI coating on that surface.

These three substrates have the same coating, our RCG coating, reaction-cured glass coating, over the surface of that. We then take that substrate, the base of the material is densified, and we bond onto that what we call SIP. It's a strain isolation pad. That is bonded to the base of the tile with an RTV system, which is a silicone. It's a two-part silicone system, and that two-part silicone system is then bonded to the structure. We have multiple types of structure that we actually bond to.

One of the features of our design system, as you can see, is this component. This is what we call filler bar. Filler bar allows us to have a seal in between two adjacent tiles. So if you can imagine -- you kind of see in this gap here. If we had another tile that would sit into this hole here, this piece of filler bar would be covered by this tile and then its adjacent tile.

Next page, please. When we talked about the different types of substrates that we have on our vehicle -- and this is a little archaic as far as it's a demonstration of where those parts are located -- the 9-pound material, our LI-900 material, as you can see, makes up the majority of our lower surface of the vehicle. It's our primary workhorse from an acreage standpoint. FRCI 12 -- and this is 102, so it has actually less FRCI 12 than do the other vehicles. We have instituted some locations where FRCI 12 has been installed for different reasons.

LI-2200 material is a higher density material that we use in LESS regions, generally around penetrations and a highly-loaded region. It's also used quite a bit around the nose of the vehicle itself. AETB-8 obviously isn't shown here because it's on the base heat shield and upper body flap of the vehicle.


Next slide, please.

GEN. BARRY: One question. Could you tell us what percentage of the tiles on the bottom are original tiles?

MR. BELL: We have that data. It's a pretty substantial number. Most of our tiles. I believe the number is about 60 percent. We certainly can get you some accurate data, and I think we have those charts available and we'll make those available to you.

GEN. BARRY: Thank you.

DR. RIDE: Could I just ask how you chose the areas on 102 to put the FRCI tile on? You said that it's less than the other orbiters.

MR. BELL: Sure. The FRCI 12 tiles are an introduction that occurred after the build of 102. From a design standpoint, those tiles give us some benefit because they have some added strength characteristics that allowed low-margin tiles to be upgraded and in some cases we went forward and upgraded specific areas of low-margin tiles that would benefit from that strength.

DR. RIDE: So it looked like the doors of the wheel wells, the inboard doors of both wheel wells?

MR. BELL: Actually this forward edge, there's a seam that exists under this edge. I don't think it's really driven by the fact that the doors are at that location. Yes. And there's some other very specific areas. FRCI allowed introduction of a stronger substrate that can accommodate relieving some of those low-margin areas that we've had to deal with for 102. We simply installed more of them on the other vehicles to deal with that, but there was still attrition mods where FRCI, on the books, that 102 would have had upgraded at points this time.

Next slide, please. This kind of gives you a feel. You know, you take a look at the bottom of our vehicle and you think that it's a nice, flat surface; but it's really not. We have various thicknesses of our tiles; and our tiles provide some contour to the vehicle, as well. You can see in some of our thinner areas we get down to less than an inch in thickness; and back on the very base of the body flap, we're talking about tile thicknesses approaching 4 inches in thickness. So a significant variation across the vehicle.

ADM. GEHMAN: And the reds are thicker?

MR. BELL: The red ones would be thinner.

ADM. GEHMAN: Thinner. Then the blues and purples are thicker? MR. SPARKS: That's right.

ADM. GEHMAN: I can't read the numbers over there.

MR. BELL: Next chart, please. Talking a little bit more detail about our lower-temperature systems that are used on the upper surface. I talked about AFRSI or FIB blanket. What we have is two glass fabrics, an outer OML fabric which is a quartz, astroquartz material, and S-class IML fabric on the lower surface; and that surrounds a 6-pounds-per-cubic-foot-density batting. This is the insulating characteristics of the blankets themselves. Then just as you would stitch a blanket, we actually stitch, using quartz thread, through the entirety of the blanket itself to hold those together.

Now, a little bit different approach is our FRSI material. Our FRSI material is specifically fiber that is felted. This is a Nomex fiber. It is felted together and produces these sheets. Then we apply a silicone coating to the surface of that, and that is bonded then to the structure itself. We have vent holes, too, for obvious reasons. A little lower density. This material is very good around the work force. Very durable. We actually walk on this material. This is the only TPS component that we actually can walk on.

You can see the difference in the materials is driven by -- we'd love to use this material everywhere, but we can't because of these temperature requirements. That's really what defines those locations where we can put those materials.

Next slide, please. A little more detail. I'm not sure we want to go into a whole lot of this. A couple of features. You know, how do we close out the edges of the blankets? Simply the fabric is wrapped around the edges and then the stitches that we talked about are provided all the way through the blanket itself. Another feature that is interesting about this design is the actual loop part of the stitches occurs at the very bottom of the blanket. That allows this bond line; or when we bond this blanket, these stitches and overlaps are included in that bond line. So if we ever lost -- let's say we broke a thread. We wouldn't be subjected to an unravelling situation where the blanket could unravel itself.

Next slide. When we talk about our tile systems, you'd be negligent to not include our gap-filler systems. In between our tiles, we have a gap. If that gap is deemed to be out of tolerance or specifically designed to be large, then we would come in and include what we call a pillow-type or pad-type gap-filler which, simply stated, it's batting with fabric wrapped around it, similar Nextel or quartz fabrics that we talked about for the AFRSI blankets themselves.
We include a strip of Inconel foil. This Inconel foil provides some stiffness that allows us to handle these parts and install them. We have some features that we include in specific areas for design purposes where we would add a piece of sleeving to the surface of that.

We get down to where we would have design cases. In some areas we want to protect that gap a little more. We actually build into our tile system this lip. This lip protects the gap-filler in that gap a little more, and then we come in with our gap-filler underneath it. And there's what we call a double lip and single lip type of installation. On the acreage portion of the vehicle, we utilize a lot of -- and you'll see a lot of these -- what we call RTV or ceramic-coated Ames gap-fillers. These Ames gap-fillers, you can think of them as almost like playing cards; and we can include up to six layers of these Ames gap-fillers to deal with either out-of-tolerance gaps or to deal with flow conditions that we've witnessed and inspected down the cavity itself. So we'll install those on an as-needed basis.

Next slide, please. The penetrations. Penetrations are a difficult thing to deal with. An ideal vehicle would have no penetrations on the lower surface of the vehicle. Obviously, for many reasons, we don't have that luxury. The major penetrations that we're talking about here are the nose landing gear door, a very critical area because it's very hot in that region, as well; the mains, which everybody has had a lot of attention on; the ET doors; body flap seals; and then elevon cove seals. On the upper surface, we have our rudder speed brake, we have around our thruster, the forward RCS thruster module, around the hatch, and then around our hinge line. There are places that TPS needs to be included. It certainly doesn't get the attention that the big acreage stuff that you can see, but it is probably as or more critical than the other systems.

Let's go to the next slide and talk more detailed about that. There's a lot that goes into dealing with how we keep heat out of these locations where we have penetrations. The nose landing gear door, again, I touched on it being a very critical area. It's very critical because this is in a very hot area, and actually for this nose we have a triple-redundancy NR seal on the forward edge of the nose. There's an OML thermal barrier, what we call a primary thermal barrier, and then an IML thermal barrier; and that is backed up by a pressure seal that we have or an environmental seal, if you will, that seals the surface of the structure together, closing that door itself. This kind of shows the three barriers in place. The reason we have the redundancy here obviously is because of the extreme environments and heating.

Let's go to the next slide and talk main landing gear door thermal barrier. This shows a difference between an old and new design. It's a pretty good example of what the barrier is itself. We start with a Nextel sleeving and Nextel fabric wrapped around an Inconel spring tube. This Inconel spring tube supplies stiffness into the part that allows it to retain some compressibility. If it was just batting or other material, we wouldn't get a spring-back that we need to maintain our seal.

We used to come and bond in. Every time we had to replace a barrier, we actually had to bond in this barrier into place. Very, very time-consuming. Very labor-intensive. Difficult bonds to make in situ. A redesign that occurred included a standoff, if you will, that had an attach plate; and this aluminum attach plate snaps into place. So now we have piece parts that we can apply much quicker to include into the design of the vehicle. Helped maintenance significantly.

When we start to talk about elevon cove and even the body flap cove, it's a very difficult area to deal with because it's a dynamic environment while the heating is occurring. We have moving parts here occurring that we have to protect. It all centers around what we call our hinge tube. We have a primary seal here and then a secondary curtain seal on the back side of that. The tiles are designed to protect the seal itself here and here, and then we have actually AFRSI blankets installed inside this cove to deal with any heating that might get through and into that panel itself. The rest of the components obviously have to move in situ with any movement around that part.

Next slide. I wanted to go into a little bit about damage history as far as our vehicle goes and what we typically have seen as far as impacts to our vehicle. We use this greater than 1 inch as kind of a criteria that we track our larger impacts. There is no significance about that size in particular. For the fleet average, we have about 30 impacts of that size every mission and with a total number of impacts, including the ones that are less than an inch, of about 144 per flight. The average tiles --

MR. WALLACE: Can I interrupt you with a question, Mr. Bell? This fleet average of 30 impacts, can you give an historical perspective on at the very beginning of the program? I mean, was there an expectation that there would be a number of impacts?

MR. BELL: Obviously you're probably pre-dating me with that question, but I certainly can go back and know that the requirement for TPS is that there would be no impacts to that system. That's in our OVEI document and that still exists today. That has not changed. So early on in the system -- and I've gotten this from those that have preceded me -- early flights, they were even concerned about having cracks in tiles and obviously having to deal with those type of changes and evolving into where we are now.

MR. WALLACE: We've seen these sort of numbers, and they seem to be fairly level. I mean, while there are some extreme cases, the trend is fairly flat. I mean, can you tell me sort of from a standpoint of the TPS program is this something that has just sort of become -- and I know that you don't cause these impacts, you're the victim of these impacts.

MR. BELL: Sure.

MR. WALLACE: But you work with the other elements. Is this just like an ongoing effort to lower this number?

MR. BELL: From the TPS standpoint, we are primarily looking at these numbers and these numbers come out of our post-flight reports that we generate every flight if we see a movement in these numbers or these have been treated as our baseline. Now, what we really look for is anomalies, very large damages, or a case where you would have a significant number of damages that are out of the norm; and that drives us generally to go and pursue that further.

I think if we'll go to the next slide, what you'll see is -- next slide, please. If you look at these impacts, you know, there's a variation from flight to flight. You know, here's a significant case; and I've got another slide that will kind of point out those events. Generally, what we're using this data for is to point out, say, significant event or changes from that baseline that you kind of defined.

ADM. GEHMAN: This slide here is actually Columbia?

MR. BELL: This is 102.

ADM. GEHMAN: This is OV 102. This is Columbia minus her first five flights, which I guess were considered to be test flights.

MR. BELL: Test flights. And I'm not sure we had collected the data in the same fashion for those flights. That may be why it's missing from the slide. You'll notice that Columbia actually had a lower average of impacts than the fleet from a 1-inch standpoint. The location of these impacts is pretty consistent. It doesn't really vary a whole lot from the vehicle itself. The TPS system is actually quite resilient. Even though it's quite easily damaged, it absorbs these type of impacts very well. It certainly is a maintenance issue, these sizes of impacts that we're talking about.

GEN. BARRY: Let me ask a question. We discussed a little yesterday about, of course, foam. Really the question came up: Can you design an external tank that will not shed foam? I think most conclusions are that it's going to be very hard to do that. If you take that assumption and accept the fact that you are going to take some hits, you've already alluded to this design spec originally for the tiles was not to accept any hits.

MR. BELL: That's correct.

GEN. BARRY: Now, if you have history on where these things are traditionally hit, you've already just stated that they kind of reside in the same areas, for the most part. Are there any designs right now to strengthen the tiles so the specifications can be stated as having an ability to accept hits? I understand there's a BI-8 kind of tile. Can you talk a little bit more about that?

MR. BELL: Sure. It's kind of been an evolved process. We started out with our AETB-8 TUFI tiles, and I've got some charts that will actually show you. It's pretty dramatic what these tiles have done for us on the base heat shield as far as reducing impact damage. Again, let me emphasize that impact damage was being driven by a maintenance issue. It wasn't considered a safety issue back on the base heat shield that we were trying to fix, primarily driving towards that. The implementation from that was very positive.

Now, the issue with that substrate is that substrate, the AETB-8, does not have a thermal conductivity or it's not as good an insulator as the base system that we have on the rest of the vehicle. So we cannot go in and simply implement that material because then our thermal load to the structure would have issues from a gradient standpoint or a local thermal impact standpoint.

In 1999, we initiated an upgrades effort to go forward and try to create or design a system that would accommodate a tough coating that would have the ability to insulate where we needed to on the lower surface of the vehicle itself; and what you had mentioned, that BI-8, or in some cases it's called BRI-8, it's still in development. It's actually very close to being completed, and that's something that we'd like to have that tool in our bag if the program deems that we need to go and do this type of replacement. It's not available today.

GEN. BARRY: The bottom line is the question that could be asked is: What will it take for the orbiter tile, the TPS tile, to be able to accept hits?

MR. BELL: Well, I think you could approach this in two ways. Certainly we can imagine that these type of ascent hits, we can take those hits now, the typical hits that we have; and we've demonstrated that if we get the sizes of impacts that are typical, our system can deal with those very well. We do have still a maintenance issue that we would have to deal with. From a TPS standpoint, we would love to eliminate it.

Now, if you're talking about substantially larger impacts than we are accustomed to seeing, then we have to do more homework even to evaluate whether this BRI material installed in these specific locations would provide us the benefit that I think you're looking for.

GEN. BARRY: We've been told there are about 200 to 400 of the 22,000 tiles on the bottom that are "critical." Is there any attempt to beef those up? Maybe you could explain why those are identified as critical.

MR. BELL: If I could try to clarify, there's probably more like 18,000 tiles on the bottom of the vehicle that are "critical." I would hesitate to be the person that has to pick out one tile to leave off for the next launch. The tiles I think that keep coming up, these 2 to 4 hundred tiles, they're primarily the ones around the penetrations. Those are already beefed up per se because those are the higher-density materials. That's not to say that we aren't pursuing higher-density materials that can accommodate a stronger substrate, just like we are on the BRI-8. That work is in process, as well. But really to accommodate increased toughness of that lower surface system, it would be difficult to pick out a specific location. I can kind of take a step back and say which is the critical tile; the critical tile is going to be the tile that takes the impact. If you can figure out what is going to be the location of that next impact, I can fix or increase that durability or certainly approach the vehicle as a whole. But I don't think that you can simply say -- certainly we would make gains by any replacements. I hate to be very specific on one location as being critical.

DR. OSHEROFF: You talk about tile hits that are an inch. I assume that's in diameter at the surface. How deep are these typically?

MR. BELL: And I'm talking in generalities here. Lower-surface impacts are generally very low-angle impacts. So when you're talking about for most of the lower surface -- and I know with some of the work that we've had going on, if you start to look at the acreage impacts, you're talking about less than 10 degrees of angle of incident at various velocities. So generally the crater depth is very much driven by the length of the damage or the degree or mass that impacts it. So generally they're not very deep. We have seen some deeper ones. I would say, you know, a half inch would be deep. Most of the damages that are listed out on the vehicle are typically not very deep.

DR. OSHEROFF: And how deep are the deepest ones?

MR. BELL: That would be data that I would have to go back and pull for you. Certainly we have not just the foam impacts, we've had an impact, STS 27, where we lost half of a tile. A cavity in that one, I would say, would go full depth.

DR. OSHEROFF: Can you say a little bit -- I think it's pretty clear that most of the tiles are repaired rather than replaced. Could you describe a little bit that process, or are you going to do that?

MR. BELL: I wasn't planning on it, but I would be happy to. We really have three basic repairs. We have what we call a coating repair. We could think of it as a coating repair. The coating gets removed from the part. No depth to it really at all. We come in and apply an additional coating over the surface of it to preserve our erosion resistance and emissivity for the next flight. It's a very benign repair.

Then we start to get into different depths or quantities of, how I can say this, volumes of damages that we are allowed to repair. Those are simply a ceramic slurry is mixed up and applied to the cavity, and what you end up with a high-density putty. We call them our putty repairs in that surface. Our next level of repair is, if we exceed our putty level requirements as far as sizes that we can repair, we replace the tile.

DR. OSHEROFF: How difficult would it be to apply this putty in space, from a chemical point of view? Forget about gravity.

MR. BELL: Any application in space obviously has its challenges. I think that I would probably like to not answer that question since we have an entire team out there driving towards an on-orbit repair. Certainly the approaches that have been dealt with previously have not been along the lines of a ceramic putty repair like we're dealing with.

Let me approach this from a different question. I think I can answer your question without going somewhere where it's outside of my realm. The putty repairs that we're dealing with, if our damage is that we have returned from space with them, typically they're ascent damages. So those damages existed prior to the re-entry or thermal cycle. So we would really have no driver or no need to go and repair that prior to a re-entry case.

Now, if you're talking about going in and trying to repair a much larger volume, potentially even a full tile replacement, the ceramic system that we're talking about would be way too massive from a mass standpoint alone, I think, to accommodate that, as well as it would not necessarily stick to a fractured tile surface the way that we need to. Generally, we mechanically lock in those repairs, as well as we get some chemical attachment. So I don't think that would be a very good approach, sir.

DR. OSHEROFF: The point is that they are, in fact, working on how to do this. Is that correct?

MR. BELL: There is a flight techniques panel which includes 12 subteams, of which obviously TPS is a big part, that are pursuing this effort.

DR. RIDE: Just a question where you've got this particular slide up. You said that the patterns of debris hits tend to vary from flight to flight. I was wondering whether you had seen any patterns in the hits from certain types of debris. For example, I think these are the products that you guys put together, is that right, so you're probably pretty used to looking at these. I'm just curious whether, for example, foam coming off the bipods has certain patterns that you would recognize when you just went out and started counting these up and looking around the vehicle and putting together a chart like this. Where I'm going is that there are a lot of flights where we don't really have ascent imagery and we don't know where the foam came off. I'm wondering whether, just from your experience with the patterns here, one could go back and take a look at the drawings like this that you've made for each flight and kind of estimate where the foam came from.

MR. BELL: The effort that goes into putting this data together, there's actually a parallel effort that goes into it by an actual debris group. They actually build something very similar to this and they take specific sizes and they are looking for exactly what you're talking about. They're looking for anomalies that they can trace back to sources, and they do a better job than TPS by themselves to integrate those different pieces of data and try to bring that information forward.

You know, the bipod ramp is challenging from a transport standpoint and where it comes off within the launch and where it would actually impact the vehicle. The one piece of data that we have been able to go back in, we had a significant damage on STS 50; and that STS 50 damage was related back to the bipod. I believe, if I'm right, that damage occurred back here. It was, again, a very low angle of impact. We really don't know what the size of the foam debris was. All that we know is there was a relationship between when that came off and the damage that we had. The damage, I believe, was about 14 inches long, if I am pulling numbers out of the air here, if I remember correctly.

DR. RIDE: Thanks.

MR. BELL: Again, not very deep because the angle of incidence is very low.

ADM. GEHMAN: You've got total impacts and you've got impacts greater than an inch. If in any of those flights the OV 102 came back missing a tile, would it have been annotated on there or would that have made your chart somehow?

MR. BELL: We don't have that relationship here. The only tile that I know that we had lost from an impact case was half of a tile, and that was that STS 27 case. I know of no other losses of tiles due to impact. We've had significant damages; but if you're talking about loss of tiles, that is the case. Now, that case, I have to be very specific. That case was related back not to foam but SRB ablator, so a much more dynamic projectile than foam is.

ADM. GEHMAN: That was Atlantis.

MR. BELL: Yes. Correct. Would you pull up the next chart. I think it will kind of go down the path of what you're talking about. This is primarily to demonstrate that when we have something that is out of the norm as far as debris impacts, we normally go back or we have gone back and related that to a specific event that was significant. You can see the STS 27 flight, I believe, is in here somewhere and we're talking about those cone ablator and the SRB cork. I'm having almost as hard a time reading it as you.

ADM. GEHMAN: I think one of my colleagues here previously mentioned that even if you take out the spikes, that the trend is flat here. We're not getting any better at preventing damage to your TPS.

MR. BELL: That is correct. We have not seen any significant change in that. Next slide. This is a demonstration. We really didn't talk about TUFI tiles because it really isn't applied to the lower surface at this time. I wanted to show you what it did for us on the lower surface. On the case on the left, it's not as easy to see; but all of the tiles had been replaced except for this tile in the center. You can see the damages that occurred on that specific tile. On the right-hand side. These two tiles were replaced. And you can see the gray marks are previous damages. So these are repairs that we had done from flight to flight, all the gray in this photograph.

ADM. GEHMAN: These are your putty repairs?

MR. BELL: These are actually what we would call slurry repairs, sir, where we simply paint the slurry on to eliminate the erosion resistance. We don't really have an aero issue on the base heat shield of the vehicle. What's significant here that you can see is all the little white marks. Those are from a single flight. Those are damages that we would have had to repair from a single flight. The TUFI tiles have virtually eliminated our need to do repairs like that. So from an operations standpoint, it was significant for us.

GEN. BARRY: I understand also the TUFI tiles shrink. Is that correct?

MR. BELL: That's incorrect.

GEN. BARRY: Incorrect.

MR. BELL: The TUFI tiles, if we were to put that TUFI coating on our existing substrates, those substrates, when we would fire them, cannot handle this type coating and those parts would shrink to something that would not be usable for us as a system.

GEN. BARRY: So with the coating, they do not shrink.

MR. BELL: Our AETB-8 substrate with the TUFI coating on it, it's a very stable material. Next slide. Okay. This is the point that, unless you have any more questions about TPS, I'll hand this over to Gary.

GEN. BARRY: Just one other question. Do you know of any systematic studies to identify critical damage scenarios? It really alludes to the fact that if you can trace where the hits have been and we can get some kind of data base, which we've asked for, to be able to say, okay, 80 percent of the hits have occurred on this part of the underside of the orbiter, then we can take up maybe the issue of how you want to strengthen it even further to be able to accept hits. So we're really talking about damage scenarios. To your knowledge, is there any damage scenarios that have been done?

MR. BELL: I don't know of any, sir.

GEN. BARRY: We still have that question out. So we're looking for the answer.

DR. OSHEROFF: Can you tell me how much would it increase the weight of the orbiter if you were to replace, let's say, the 500 -- I know you don't like the word "most critical" tiles -- with TUFI tiles? Roughly speak, how much extra weight is it per tile?

MR. BELL: From a weight standpoint, these new tiles that we're talking about do not include a weight penalty.


MR. BELL: Yes. We're actually closely approaching the weight. So if you ask me if it would be significant, I think it would be very insignificant.

GEN. BARRY: But there is a difference between LI-900 and TUFI tile.

MR. BELL: Well, the LI-900 is the substrate density, 9 pounds per cubic foot. We have an RCT coating on that which applies mass to that system, and you get a weight. We started out with our AETB-8 or a BRI-8 material, which is 8 pounds per cubic foot substrate. It's a lower-density substrate to start off, and we're adding our mass at the coating where we get the benefit out of the impact resistance. Does that make sense to you?

ADM. GEHMAN: Yes. So it's close to the LI-900.

MR. BELL: Very close. The new BRI-8 system is very close.

GEN. BARRY: Now, there's a difference in BRI-8 and TUFI. I guess that's the question.

MR. BELL: TUFI. You can think of TUFI -- the Ames guys might get upset with me here, but AETB-8 and TUFI coating is intended to be a system. That system was intended to be used as a single product and we kind of have gone away from that and looked at applying that TUFI, which we really refer to it primarily as a coating and not an article, and we're looking to apply that material to another substrate per se that allows us to utilize this in different locations.

DR. LOGSDON: Let me see if I can reconstruct and understand something you said early on in your presentation, which is that most of the integrator damage to tiles that you've seen has happened on ascent and, since the vehicle has survived successfully re-entry, you do not treat these as flight safety issues but as maintenance issues. Is that a fair summary of what you said?

MR. BELL: These are ascent impacts that we have no control over fixing them on orbit, from the standpoint of when these parts get back to Kennedy Space Center, whether that's through Edwards or landing directly, it is an operations issue to have to do and deal with the maintenance associated with that. We have a baseline of impacts that we have seen historically that fall into that category.

DR. LOGSDON: Even though you have a stated requirement of zero impacts, that's at this point kind of irrelevant to reality. The baseline is 30 or so inch impacts expected per mission and a judgment that that's acceptable.

MR. BELL: That judgment is probably not one that I should address. All I can tell you is what we've dealt with from a typical standpoint as far as operations go, and you've seen the numbers and that's demonstrated to have been, looks like, my interpretation, something that has been longstanding.

MR. WALLACE: As we've learned a lot about the shuttle system, even the parts of it that may have originally seemed fairly simple and straightforward turn out to be very, very complex; and we talked this morning earlier, as witness, Mr. Blomberg, about incremental improvements. My question is if you were to design -- let's just assume that we're going to build a space shuttle again that's going to be essentially the same vehicle but we have a clean sheet of paper and today's technology to design the thermal protection system. Any general thoughts on what it might look like and if it might, in fact, be a lot simpler than what we have now? Either of you can answer that question.

MR. BELL: Let me take a stab first. The vehicles, as you see them, are in evolution. If you look at the vehicles and say that vehicle, that was the design originally -- there's been several iterations and changes to the vehicle through time. So as the TPS community, we continually make modifications and changes to improve both safety and operations.

Maintenance drivers, those changes occur continuously. And there are requests for changes on the books today that we will continue to pursue and you will see this vehicle evolve from what it is now. If we had to start from a clean slate, that allows us to do other things that we wouldn't necessarily have an opportunity to do, given our current configuration and some of our tiles.

Your specific question, I think, referenced the complexity of the design. Sitting here, thinking about the complexity of the design, I do not see any major changes unless you would start to approach the structural part of the vehicle and the way that the penetrations are originally designed that would benefit TPS necessarily. Certainly you'd have to integrate TPS into your design up front so that we are just not the insulation system going over a door. You'd have to design and think differently how you would approach the seals.

Let me give you an example. Maybe Gary's a better one to look at this. The chin panel is an add-on to the vehicle. The chin panel is an RCC component that attaches up -- it lays against the nose cap of the vehicle. That was an add-on. Well, the interface between those two components has created a gap-filler that is just very maintenance-driven for us; and certainly if we had the opportunity to start over, we would design that out, design a different interface there. But, you know, what we've got now is an evolution of TPS that you see. Is that a good synopsis, Gary?

MR. GRANT: To take a step back from like what Dan's saying, I think if we were to do something different, we'd look at the most maintenance-intensive areas from a standpoint of refurbishment and from the interface end. It would require more than just a change in the thermal protection system. So inputs that we have may also drive changes in the way that the penetrations, doors, or seals would function. But the chin panel is a good example and it may be something that we talk about. But at the time that that interface was designed, there was talk of putting another seal which would basically bridge those two together. Unfortunately the maintenance, you know, downfall wasn't seen in the future; but that would be a good example of something that we could change without causing another change to the rest of the function of the orbiter.

ADM. GEHMAN: Please go ahead, Gary.

MR. GRANT: Okay. So then we'll talk about the leading edge structural subsystem. Next slide, please. As Dan alluded to, although it is a subsystem unto itself, it is part of the overall thermal protection system of the orbiter. In this first slide, we talk about some of the basic requirements. It was put in areas where you do have the higher temperatures. So we've got multi- and single-mission limits that were posed to the design element. Part of it also is not just, of course, for example, on the wing leading edge to provide a shape there but, of course, you have to protect the internal also. So internal insulation is part of the design requirements.

Of course, being that most of the parts other than the aero head are on leading edge areas, the aerodynamic shape's important. The air foil shape needed to be maintained for flight; and also on these leading edges where we have the highest heating, it's roughness- and waviness-critical. The system needed to be able to distribute loads amongst the system itself and to the structure, the supporting structure.

The impact resistance. The main component or actually the only component that was really designed to withstand a very adverse impact was the forward ET attach plate, which actually in the original design was tiles, and then they ended up doing a functional test of the explosive bolt and found tile damage and this actually ended up being somewhat of an afterthought retrofit. RCC was already in place and in development for the nose cap and the wing leading edge. When we talk about impact resistance, that's the one element of our subsystem that was designed to take a known or expected heavy load or shock.

GEN. BARRY: Do you know what the measurement of that is? I understood it was like .006 foot pounds. Do you know that?

MR. GRANT: I think we might get to that. There's some slides that talk about the impact testing that was done in the development.

GEN. BARRY: Which was very small, by the way.

MR. GRANT: Yes. I guess the point is that impact resistance, you know, other than the forward ET, was more for foreseen handling damages and kind of rain impingement and bugs and things like that, as opposed to real protective shield. Then the last thing is that the parts being new and really not much of a way to test, they had to be certified by analysis; and in that process it's found that they are limited life, which in the orbiter, actually space transportation system, whatever element you're talking about, limited life or cycle means that it's not something that you can install and it's good for the hundred missions or 20,000 cycles it's going to see in its life.

ADM. GEHMAN: What does certification by analysis mean?

MR. GRANT: Well, these parts, you know, some of the portions were tested and rated at facilities and/or checks, but the actual parts themselves were not able to demonstrated on any other type of vehicle.

ADM. GEHMAN: All right.

DR. WIDNALL: I have a question. I don't know whether you're going to get to this later, but are you going to talk about things like the fatigue life of these panels and vibratory loads and things like that?

MR. GRANT: Yes. If we don't -- I mean, if the charts don't cover what you need. Then the final thing is that the parts need to be interchangeable.

Next slide, please. The LESS consists of more than the carbon. In the investigation and discussions, we've really focused on the RCC, reinforced carbon-carbon parts themselves. In the system there's a nose cap that has three expansion seals and five TEE seals to make up the nose cap assembly. The wing leading edge is made up of 22 panel seals sets per side, or 44 per orbiter. And as Dan mentioned, a chin panel was retrofitted on the panels. It was in an area where we ended up having a lot of tile and gap-filler rework, and this actually spans between the nose cap and leading edge of the nose landing gear door and the forward external tank attachment plates.

For the carbon to work, it has to have attachments, internal insulation to protect the structure that the parts are attached to, the attach fittings themselves; and then in all cases other than the external tank aero head, we have to be able to access our fasteners. So we use reusable surface insulation tiles and gap-fillers to make access panels. In general, the basic design goal was to provide thermal structural capabilities for the areas that exceeded 2300 degrees.

Next slide, please. Let's talk about the RCC now. In general, the makeup of the reinforced carbon-carbon, there's three breakdowns. So there's actually kind of two main ways of viewing it or two main entities. One is the actual load-carrying part itself, which is the carbon substrate. It's made up of a rayon fabric that's impregnated with great amounts of graphite and then there's a resonance used to help it lay up in a rigid fashion and then there's a very detailed three-stage process that's used to convert it to a carbon matrix. In and of itself, you could almost be complete with your parts right there except that we have an environment that is going to attack that substrate through oxidation. So that's where the silicone carbide coating and the TEOS and the other sealants come in. So the purpose for the silicone carbide coating is to protect the underlaying impregnated carbon fabric.

This is actually not a coating that's applied. It's actually a transformation. It's accomplished by a dry pack in a powder that's made up of silicone carbide, silicone, and aluminum powder. Ideally, our coating is about 20 to 30 mils thick. Of course, it gets thicker when you get to some of the sharp edge and the bends, just due to the geometry, the way the shape is.

Unfortunately, during the cool-down, due to the difference in the thermal expansion between the carbon substrate and the newly converted silicone carbide coating, there's a difference in the thermal expansion coefficients and the silicon carbide contracts more during the cooling and we get craze cracks, if you will, which affects the substrates, potential oxidation. So the next element, that's added to help this. First the TEOS is applied, which leaches down through the craze cracks into the carbon areas to help form a harden or another way of protecting the carbon substrate. Then once this is completed, a Type A sealant, as we call it, a glass sealant is applied which helps to fill in some of the craze crack areas also and, again, give additional oxidation protection. The early design had just a single application of this coating, and it was discovered about the time 105 was being built that actually a second application of this coating would be beneficial for mission life. So some of the 105 and then subsequent spare parts have actually a double Type A coating.

DR. WIDNALL: What's the density of the material?

MR. GRANT: You know, I don't have the actual number. It's, on the order of tiles, you know, magnitudes greater. I don't know the actual number of the density.

DR. WIDNALL: I mean, it's got to be a heavier density than tiles.

MR. GRANT: Yes. By magnitudes. Down at the bottom right, you see a typical acreage is on the order of a quarter-inch thick. Then as you transition to lug areas where the parts are actually attached or some of the areas where you get the curves due to an actual geometry change, you actually get quite a bit thicker. In some of the lug areas, you're close to a half an inch thick.

Next slide, please. This is a good snapshot at all the parts installed on the vehicle. Of course, we have the nose cap and associated seals. Behind this, there's a row of access tiles; and it actually allows us, if we need to, to change gap-fillers behind this area. The chin panel, which actually here you can see just the edge of it, access panels located out on the edges and then actually you reach through the nose landing gear door, which you barely see here, to reach in to get the attachments and then you get a view of the chin panel and the seals, just on the edge.

Up on the right, we see the wing leading edge panel attached to the ship. This actually is a photo of a 103, and so its configuration is a one-piece spar fitting. In another slide that's coming up, you actually see the two-piece spar that 102 had. But you get a good look at the leading edge rib of an RCC panel there. You can actually see many of the insulators and some of pieces we're looking at. The Koropon-coated spar is shown there.

Then the forward ET, actually you can see the forward ET attach point. This is evidently a post-flight photo on the runway. This is what that installation looks like on the runway, and there's actually an aft plate and then a forward plate and then that interfaces with the nose landing gear door.

Next slide, please. Here's a little more detail of the system itself. The nose cap is actually somewhat of a self-contained unit. The nose cap actually has its own bulkhead, own structural bulkhead, which is the nose cap and the seals. Internal insulation of the conic blankets, which you see a cross-section of here. Of course, it's attached by way of Inconel fittings to the actual nose cap bulkhead, which then the whole assembly is put onto the orbiter vehicle and attached to the forward fuselage structure. Interface panels which actually go all the way around and interface with the forward fuselage and then a bulkhead door which allows access into the nose cap and then the conic blanket internal insulation assemblies are actually broken down into four quadrants. And that's the way that you get those in and install them to the nose cap bulkhead itself. Next slide, please. Wing leading edge parts. You see here, sitting on the bench, a panel with attached T seals. This is a panel T seal set. You can see the attached lugs here. T seals are attached to the actual lug fittings on the panel, not directly to the ship.

As you can see, this is a cross-section. The purple is the RCC itself. Upper access panels that allow us to get to the -- these attach points here. Upper panel. Lower access panel shown and installed here, which again allow us to get to the attach fittings.

The spar fittings -- and this picture here does show the 102 configuration. There's a separate upper and a lower spar fitting, and those are shown by red in the sketch here. Then once everything's installed and complete, before access panels are put on, the spar insulation in the different -- the earmuff insulators here -- again, this is 102 configuration -- actually go over and cover the spar fittings so that once everything's completed on the internal, all parts are protected from radiation.

DR. WIDNALL: Are you going to talk about any structural testing that was done on these RCC panels?

MR. GRANT: I think the slides that we'll talk about have some of the impact testing. I don't know --

DR. WIDNALL: Well, let me just ask a question. Are you surprised? The thing that surprised me about it is that in recovering the debris, we found half of the RCC panels. In other words, they broke at the center. Now, looking at that, I'm asking myself, if I grabbed ahold of that panel and, you know, pulled it out, where would it break? The rib is a little thinner in the center. I mean, do you have an understanding? When you saw that debris, did you say, uh-huh, or are you as confused as I am about why they broke where they broke?

MR. GRANT: I think the loads those parts saw -- you know, I don't think it's surprising that they broke there; and one of the things that we saw the parts, you know, broke at the lugs, too.

DR. WIDNALL: That's fine; but, I mean, really every single panel we have is broken at the leading edge.

MR. GRANT: Yes. You know, if you notice, we don't have any -- we have some T seals or gap seals --

DR. WIDNALL: Right, but I'm talking about the big panels.

MR. GRANT: -- in somewhat good condition, but the panels themselves, I don't know that any of them --

DR. WIDNALL: Well, we have a lot of half-panels. Half.

MR. GRANT: Yes. You know, I don't have that specific information. I know there had to have been compressive and stress testing, and that's something that I could take an action and make sure you see that data.

DR. WIDNALL: I'd be interested in that.

DR. OSHEROFF: This is pursuant to Sheila's question. Certainly looking at the debris, it was my impression that a lot of these things had to have been broken. They didn't break upon striking the ground.

DR. WIDNALL: No, I don't think so.

DR. OSHEROFF: Well, part of it at least was still attached to the wing. That seems to be more -- because you could see that there would be spatter on one half and not on the other half.

MR. GRANT: Well, I've been somewhat involved in the reconstruction. One of the things that we tried to not do -- I mean, other than, like the doctor was saying, you know, of course, thoughts are running through your mind -- but we've specifically tried not to speculate on where did they find these parts -- you know, "Oh, my God, this is the one right here." We really tried to systematically place them; and, as you know, it's an important part of investigation to make sure we get the correct parts correctly located on the floor.

In general, observation-wise, I've personally seen very few parts that show a lot of ablation to the actual substrate. I mean, it's really impossible to speculate as to when they broke; but a lot of them, I'm not seeing a degradation of that, the carbon and the fabric substrate that you would see, you know, had it broken early in the re-entry attempt.

ADM. GEHMAN: Why don't you go ahead.

MR. GRANT: So I think this covers the basic assembly of the wing leading edge system. Next slide, please. The parts were procured to a spec that was developed through NASA and the vendor. Performance is that they should be structurally sound, maintain a positive margin of safety -- which, of course, the factor of safety baseline is 1.4 -- be able to withstand 100 missions with minimum refurbishment and replacement, be able to withstand rain impingement. Physically the system, the goal was 1699 pounds. Of course, you had to maintain and be able to have step-and-gap control adjustment, which is built into the design; and the surface roughness within any part had to be less than the figure shown there.

Impact resistance was really more of a goal from the standpoint of, you know, if you talked to the vendor today, their biggest concern is handling damages on these. So, in general, the goal there was to create some type of impact resistance if somebody dropped a nut or a wrench or some of the things that would happen in normal processing -- other than, like I mentioned before, providing a protective shield. The maintainability. The visual inspection would give you clues into any concerns you have with the parts. Part removal should be somewhat straightforward and simple and shouldn't take very long. Less than 15 minutes was used as a number. And again, that they should be interchangeable. Predicted temperatures that were presented to critical design review in March of '77 showed the maximum temperatures on the nose cap were around 2500 degrees and, wing leading edge, 2600. On the panels, the gap seals actually are a little bit hotter at 2800, close to 2900 degrees.

GEN. BARRY: Can you go back a slide, please? The 100 missions. My understanding is that certain panels are a lot lower than that, like Panel No. 9 on the lower part is only cleared to 50.

MR. GRANT: That's correct. So part of what's integrated here is that, you know, your spares or your extra parts on hand actually are necessary to help you achieve that. I mean, obviously the design for the orbiter was 100 missions. So the reality of the RCC and the leading edge structural subsystem was that individual parts -- you know, one part, without being replaced, was not going to get you there.

GEN. BARRY: That's an appreciation for, I guess, an analysis that has been subsequent to the original design spec that you've concluded that, okay, for 9. Then it varies, too. I mean, 10, I think, is 63; and then it goes out and gets to 100 on the outer.


GEN. BARRY: Let me ask you a question on mass loss. There is mass loss to these RCCs over time.


GEN. BARRY: Okay. Can you talk a little about that and how we talk about ageing? I mean, there is an effect over time on these RCCs.

MR. GRANT: Yes. Well, actually the early mission lives on these parts was quite a bit lower than what you've seen in our current requirements. Initially the Type A sealant was not a part of the system; and then once the sealant was added and then the double Type A was added, we actually began to get the parts to where they were more robust. Then since then we've had to go through performance enhancements and different types of things where the capabilities of the orbiter were expanded. So, you know, over time those things tended to jostle around the actual mission life itself. So initially the flight lives were actually a little lower than what you had -- I'm sorry, what was the question again?

GEN. BARRY: Well, I guess it really comes down to the fact --

MR. GRANT: Talking about mass loss.

GEN. BARRY: The RCC's a quarter of an inch thick.


GEN. BARRY: I mean, if you add the Type A sealant, the TEOS, of course, the substrate, the silicone carbide. Now we introduce mass loss of about .003 pounds per square foot, right? The thing is how do you measure this ageing, you know, for the mass loss?

MR. GRANT: Well, what we've done over time -- the biggest thing that we have that really corroborates some of the assessments on that is destructive tests that we've done, and we're able to take a look at that. Mass loss, of course, is related to oxidation; and in looking at that, one of the things that came out of some of those early destructive tests was the sealant refurbishment which we have instituted. I think it was around the 1992 time frame where every other LMDP on the wing leading edge panels that are in the areas where you have the highest convective mass loss get their sealant refurbished, in a sense, really kind of reset those parts in the way of having a higher resistance to the convective mass loss.

I think one of the backup charts I have shows, if you never do a seal quantity refurbishment, how that mass loss increases with time. As you do it, it actually brings that number back down, not quite to the design but a lot to something that's manageable. And our every other LMDP effectivity that we have on that's actually a little bit conservative by a few flights.

So I guess the destructive tests and the evaluations on the parts that we've had -- and most of the models that were used to predict the actual life, you know, using the extrapolation of the mass loss, were very conservative. The trajectories that were used for those -- like the initial flight lives are using abort trajectory, which, of course -- you know, and they basically ran a hundred abort trajectories. So that's very conservative to what we're actually flying, which is normal mission with a re-entry.

ADM. GEHMAN: At KSC, do you do any acceptance testings of the parts from the vendors to see if they meet these criteria?

MR. GRANT: Well, they have this procurement spec that's something that they are held to and that we are, too. The actual receiving and inspection is something that's done in the logistics area. So from an engineering standpoint, you know, we would do our normal maintenance inspections before parts are installed; but we don't actually make a decision to accept the part. Obviously if we saw something that concerned us that may have --

ADM. GEHMAN: Obviously. So to pursue the business of the acceptance inspection, we've got to pursue that someplace else. Dr. Logsdon had a question.

DR. LOGSDON: Just a quick question. A couple of weeks ago, ten days ago, there was some suggestion in some press accounts of the primer from the launch tower having an oxidation effect on the RCC. Did you, in fact, see evidence of that?

MR. GRANT: Specifically on Columbia?

DR. LOGSDON: No. In general.

MR. GRANT: Yes. I guess that's something that we eventually would have gotten to. You're referring to the pinholes. When we first saw the phenomenon, we obviously didn't know what we were dealing with; but through quite a bit of time, study, tracking these, we were very concerned about them. We spent hours and hours looking at them, mapping them, measuring them, just dissecting them every which way you could. We were trying to narrow in on there was a point in time -- and I believe it was STS 50 -- where from that point on we found them, we found them only on certain parts, and we somewhat -- you know, trying to find a cause for this, we ended up finding out that there was a change to the way that the pad was being refurbished. And I think some of the other members of the board that have been in contact with us have quite extensive reports on this. But we found there was a zinc-based primer that was being used and then an overcoat -- and I'm not familiar with the materials on it. But at that time the change was to not apply that overcoat. And the zinc was one of the elements that we were finding in the glass deposits that were coming out of these pinholes, so to speak.

So basically what happens, the zinc does break down the matrix of the silicone carbide and actually gives us a little path down; and the nature of it, too, is that it follows the paths of the craze cracks and imperfections. So it's not necessarily a straight hole down in, once we actually took some destructive tests. But the zinc was the key to us actually linking it to what had changed on the pad. But that fell into line with all the other findings that we didn't really see them on the nose cap or chin panels and it was in the wing leading edge in certain areas that were covered by the rain protection.

DR. LOGSDON: Have you done anything about that?

MR. GRANT: The procedure to the pad or --

DR. LOGSDON: No, the --

MR. GRANT: To the parts.

DR. LOGSDON: Have we covered the primer?

MR. GRANT: So, I mean, are you talking about to our parts?

DR. LOGSDON: The launch pad.

MR. GRANT: Yes. At that time -- and I don't have the information -- but we were able to get in touch with the facilities crew and basically the procedure was changed again. And as we continued to analyze and track the parts, the pinholes, they actually formed somewhat of a glass coating down the actual path that leads to the substrate, which actually gives, itself, some protection to oxidation. So we've done quite a bit of studying and set criteria for the size of the pinholes that are acceptable and the cycle time that we review them.

DR. LOGSDON: My question was: Have you now painted the launch pad to cover the primer?

MR. GRANT: Yes. Once that was identified positively as a source, that was immediately taken care of.

DR. OSHEROFF: Can you estimate how much mass loss occurred as a result of oxidation due to the pinholes?

MR. GRANT: The actual oxidation is preferential to the silicone carbide and carbon substrate interface. So what we've found in the few that we've seen that actually go down to the substrate, because that pinhole actually forms a glass coating around it, what we're concerned about is the oxidation that would actually separate the coating from the substrate itself. So because of that glass lining, so to speak, it somewhat protects those edges from actually getting the attack that we're concerned about.

ADM. GEHMAN: I didn't hear an answer to the question there. Have you ever measured the mass loss?

MR. GRANT: Well, what we've seen is that we are not getting any additional attacking of the interface of the silicone carbide to the carbon, based on the pinholes. That's one of the reasons why we go and do a sealant refurbishment, which somewhat fills in that pinhole temporarily; but once the zinc is present in that matrix, it's impossible to get it actually removed.

GEN. BARRY: But right now you're doing that visually.


GEN. BARRY: The board is very interested, of course, in further NDI, you know, to get verification on what that mass loss would be, and not just do it on a visual indication, to be able to look down there and see if there are voids underneath those pinholes to see if, in fact, there has been, in the admiral's term, the termites that have dug holes underneath there.

ADM. GEHMAN: Why don't we go ahead. We're a little bit over time here.

MR. GRANT: Next slide, please. This shows a predicted trajectory temperature pressure curve for a space station mission, one showing wing leading edge Panel 9, which is our highest-temperature wing leading edge panel, and the nose cap, which itself is a very high-temperature part.

Next slide, please. The design allowables for impact resistance. A test was performed. LTV is the vendor for the parts. Tests were done with a spherical steel ball; and for a typical 19-ply acreage area, it was found that the threshold for not seeing cracks or damage to the coating or substrate was 1.4 foot pounds, which is approximately the 16-inch pound design goal that they had.

There were hypervelocity impacts that was done in '77. They used nylon cylinders and glass spheres and, again, the lower-energy impacts produced some front face damage, the higher energy produced a front and back face damage, and the glass spheres only produced front face damage. Next slide, please. Ice impact tests were performed at Southwest Research and, as you can see, again, as the energy goes up, you start to get cracks into the coating and then, finally, at a high enough energy, the specimens were actually destroyed. The low-velocity impact tests are probably the most consistent or useful data, and these are actually things that are used when we have concerns on damage that may create a hole in a panel or whatever. But the results here, again you see, as you get the higher energy, you get damage to the front and rear face. And with the lower energy, you get some damage to the coating on the outside.

Next slide, please. A low-velocity impact test was performed on a right-hand Panel No. 10, which was actually a panel that we did sustain a couple of impact damages while we were on orbit. Once it was removed, there were tests done by Rockwell and NASA on this. The Rockwell tests used a BB and a lead bullet. The idea there was to kind of demonstrate the effect of the hardness of whatever the projectile was. The lead, of course, is soft, did not produce any damage; and the BB actually saw front and rear damage to this panel.

Next slide, please. Some of the issues that we've had over the years. This panel that I alluded to, the 104, STS 45, we actually sustained two damages on the upper surface of this panel. An evaluation was done to determine, you know, the micrometeoroid orbital debris effects. Concern, of course, is that a potential such damage could actually create a hole in the RCC panel which would very quickly compromise your wing spar. Of course, the burn-through would be a potential loss of crew and vehicle.

The resolution was that a study was done to enhance the internal insulation and to provide a little more margin there, where if you actually had a hole that was a quarter inch or smaller, although the hole would grow during re-entry, your cavity heating would increase, but the actual spar itself would remain protected by a more robust internal. Inside the Inconel foil, there's actually some fabric, high-temperature glass fabric layers that were added to essentially just give you enough margin to return safely. That's one of the things that came out of that actual event.

Next slide, please. I think we have some pictures of it. Actual pictures of the OML or the outer mold line and then the underlying damage. On the left you see what's called Impact 1 here. It's about 2 inches by an inch and a half wide. And then an associated back face damage, which you can barely see some of the cracking that happened on the back face. On this side, this edge is a little stronger since it's close to an actual rib of the panel. Damage wasn't very big on the front; but then the actual back face, some of the coating actually was dislodged there.

Next slide, please. This demonstrates some of the pieces that were used for the testing. Of course, with a quarter-inch hole, we're trying to provide -- just a little bit extra protection here. So some specimens were created with a hole of such size. You see what the hole grew to and you see what the actual -- this is the material that's used that covers the internal insulators. And this has the Nextel fabric around it and you can see at the end of the test, you actually still had some protection there. Next slide, please.

That's it.

ADM. GEHMAN: In one of your first viewgraphs up there where you showed the cross-section of the RCC wing leading edge panel, you referred to the matrix and then the way the outer few mils are treated to provide -- your viewgraph said that the carbon is there for the strength and the outer piece is there for the protection. We mentioned oxidation, but is it correct to characterize the outer treatment also as the major part of the thermal protection also?

MR. GRANT: No. Again, the --

ADM. GEHMAN: The whole thing is for the thermal protection.

MR. GRANT: To protect for oxidation, yes.

ADM. GEHMAN: For what?

MR. GRANT: Well, the primary elements that actually provide the thermal protection to the orbiter are the internal components that protect the wing leading edge spar from the radiation of the parts. The parts themselves, since they can sustain temperatures up to, you know, 3,000 degrees, the parts themselves, you know, that coating is not the primary protection for the actual RCC.

ADM. GEHMAN: Unlike the tiles, which are nearly perfect radiators, the RCC is not.


ADM. GEHMAN: It's just supposed to take the heat and stay structurally intact.

MR. GRANT: Yes. That's correct.

DR. WIDNALL: You actually didn't say very much about the requirement, the fatigue requirement and how that was tested, what the requirement actually was in terms of vibration levels or whatever. I recognize you don't have that on slides, but I'd be very interested to see the kinds of requirements that were set for basically the fatigue life of the panels in that environment.

MR. GRANT: Okay. You know, the details on the type of cycle testing, obviously the parts were designed to withstand the thermal, vibroacoustic, all the stress. So all those environments, you know, were things that the parts were designed for; and I'd have to get that.

DR. WIDNALL: I'd be interested in knowing what that was.

ADM. GEHMAN: Anybody else? All right. Gentlemen, thank you very much. Your depth of knowledge on this is very impressive; and we appreciate you bearing with us as we work our way through this. I know you want to get to the bottom of this as much as we do, and we thank you for dialoguing with us and being patient with us as we work our way through this. You've been very helpful.

Thank you very much.

Okay. We are finished. We're going to have a press conference right here in 30 minutes.

(Hearing concluded at 12:28 p.m.)

Back to Event

Privacy Policy Disclaimer Accessibility