In recent years there's been talk about a total privatization, essentially giving the vehicles and the infrastructure to a private contractor and just letting them operate; and, very frankly, I feel that that is very naive, very unrealistic, and will never happen. I mean, there is nobody out there, I think, who would want to take on that responsibility unless they're indemnified; and if they're fully indemnified, then the government is gaining nothing except the contractor's fee.

So the cost is going to go up. So if there's some political reason why you don't want government work force working on it, then I think that can work; but you'd have to be very, very careful of the transition. It's not the steady state that you worry about in those things; it's the transition from one state to another. You've got a program that's over 20 years old, 25 years old really. It's been flying for over 20 years; and to try to change its culture overnight by saying it's totally privatized and removing the checks and balances that everybody has become accustomed to could entail some increased risk. It could be done. I would prefer to see it done in the next program and design it from the ground up.

If you want a privatized program, then design it from the ground up; but with one customer, the government, and a limited number of flights and an unknown liability for things like the infrastructure -- you know, what does it cost to change a roof on the VAB or the side panels or to meet environmental concerns if they should come up -- I just don't see it being realistic to transfer to a private contractor completely.

DR. LOGSDON: Under SFOC, there are a particular set of incentives. Was there any concern that those incentives diminished the emphasis on safety by USA or were you -- you, I guess, as an individual in this case -- confident that USA could operate the vehicle as safely as the civil servants had done in the first 20 years?

MR. BLOMBERG: Well, my answer on that has to be time-dependent. When I read the Statement of Work for the contract to USA, I had great concerns. I was concerned, for example, about the incentive fee for meeting launch on time. I thought that was ill-advised because the last thing you want to do is tie some money to a launch decision. That has to be made purely on risk grounds. I was also concerned that the safety measures against which the contractor was going to be evaluated were defined by the contractor, and so you could end up with a situation where you managed to the metrics rather than managed to the safety of the vehicle. That was in theory.

In practice, we looked at USA's performance very closely. I know the folks there very well and have followed their performance, and I think it's been exemplary. They have called launch halts whenever necessary -- in fact, at points where I probably would not have called them personally because I thought it was ultraconservative, but it's better to be ultraconservative than the other way around. So I think the performance has been right on what you would want. They have the safety culture that is necessary. That doesn't mean it's a hundred percent effective. That doesn't mean it can't be improved, but my concerns at the outset really did go away.

DR. LOGSDON: One final question. This is, I think, a giant extrapolation from what you have said this morning; but let me ask you about it. You've said you see no progress in materials or propulsion that would justify investment in a new vehicle, that the shuttle has to fly past 2020, and that there are lots of improvements that could be put into the shuttle. Would you recommend building an updated version of the shuttle design, one or two?

MR. BLOMBERG: Again, without knowing the full budget picture, just from an operational safety standpoint for the space shuttle program, I would absolutely recommend that. I think the finest thing that could be done right now would be to take all of the knowledge that the people have of the space shuttle system and all the additional knowledge that your board is going to produce, which is scrutinizing the system more than it's ever been scrutinized in recent years, and put that into one or two additional orbiters and when those come on line, maybe retire the oldest of the current ones. I think that would be the best thing that we could possibly do both for the safety of flight and for expanding our knowledge of human space vehicles.

Absent that, I would certainly like to see the existing vehicles upgraded with as many of those things as is reasonable to put in. We were talking about escape, for example. It might be a lot easier and more cost-effective to put an escape system into a new shuttle vehicle than to try to retrofit the existing vehicles and cut through the existing mold lines.

So I would certainly love to see that and I think it's a way to go while simultaneously commencing the basic research-and-development programs that you need to have a radically new vehicle. Because it's not just going to happen. There's no market out there for building efficient reusable rocket engines unless it's for a human space vehicle. So NASA and the country are going to have to do that and work on the materials side, but it's unclear how long it will take to get the breakthrough you need to have a significantly better vehicle than the upgraded shuttle that you're talking about, the shuttle derivative, would be.

DR. LOGSDON: Thank you.

ADM. GEHMAN: Mr. Blomberg, among the other tasks that this board has, including finding the direct cause of this accident and making recommendations to prevent it, we also have to place our report, in terms that I've used, "in context." As the chairman, that's one of my specific problems is to place our recommendations in context.

One of the contexts is the life of the shuttle program, which is something that we've talked about before. If we're near the end of the shuttle program, our recommendations would have a certain flavor to them. If we are only 50 percent of the way through the shuttle program, as has been suggested that we're going to be flying shuttles until 2020, we're at the halfway point. We've lost 40 percent of our vehicles at the halfway point.

This problem of putting it in context is weighing on my shoulders; and I was struck by some words in the last ASAP report that you signed, which was last year's, technically, 2001's. I would like to read something here. I'm not going to throw these things back in your face, but I want to allow you to talk to us about it.

This was finding and recommendation No. 1. "Last year, concern arose that the planning horizon for the space shuttle and the international space program was too short, imperiling the development, advancement, and adaptation of safety improvements" because you couldn't amortize them or you couldn't justify them -- my words. "It is now recognized that the space shuttle will be used well beyond 2012, a longer life span than was originally anticipated. Now serious safety concerns are currently ranged around the potential for lost opportunities in safety improvements which can lead to safety problems as ageing systems deteriorate." In other words, now we've got a new set of problems. "The panel believes that the space shuttle is fully capable of supporting the ISS for its entire life."

So my understanding of what I just read is that by extending the program life, we now have eliminated the excuses for not making infrastructure upgrades and all the safety things that you have mentioned, which I value that as a good thing -- that is, if there's money there -- but now we have a new problem and the problem is, of course, ageing and deteriorating systems. My first question is: Have I characterized that approximately correctly?

MR. BLOMBERG: Yes, I think you have, although I think it's a matter of emphasis. I don't think the ageing issue per se is anywhere near as great as the other issues, the issues of not upgrading the vehicle. I think the ageing issues could very likely give you some graceful deterioration, whereas the upgrades could give you some quantum jumps in safety or reductions in risk.

ADM. GEHMAN: The reason why the ageing problem is stuck on my forehead so well is because of the theory of the unknown unknowns, that it's turned out that the parts of the shuttle program, the parts of the STS which were viewed to be the most dangerous have not failed -- it's always something else which has gotten us, it seems -- and we feel that if you're going to continue to fly this thing for twice as long as it's already flown, there has to be an aggressive program out there looking for what we call the unknown unknowns. In other words, you've got to start looking for trouble. I believe that can be done, that we have other examples of aircraft that are working kind of at the edges of their margins, that are old and things like that -- military aircraft and civilian aircraft. The second part of my question, though, gets to the comment about the relationship between the shuttle and the ISS. Do you believe that they are linked?

MR. BLOMBERG: Absolutely. I mean, the ISS was designed to the shuttle's capabilities, with some help from the Russian vehicles and a little bit from the European vehicles, but basically to the shuttle's capabilities. Frankly, from my own perspective, it would probably be a poor economic decision for the country to build another vehicle to service the ISS because the next-generation vehicle might have a totally different mission. So why not, as long as the space shuttle is capable of servicing the ISS throughout its entire life, keep that symbiotic relationship going. I mean, it was designed to re-boost the space station. They were designed to exchange consumables in both directions, if necessary.

So I think just a very simple answer is to keep the space shuttle flying as safely as possible as long as you are doing the space station and then think about what the mission is for the next vehicle, whether it's the support journey to Mars or some other purpose. Going back to your first remarks also, I would like to point out that the kinds of safety improvements that we're talking about are not only hardware, software, and even ground infrastructure.

We're talking about training. We're talking about re-analyses to understand and characterize the vehicle better for its now realistic lifetime. So that while there were life limits placed on every component -- you could only keep an external tank in storage for so many years and you could only keep a solid rocket motor segment in storage -- those limits are no longer realistic, and it's time to redo those analyses.

Well, as Dr. Widnall was saying, that's not romantic -- romantic from the Congressional standpoint. "Why do I have to redo an analysis? Did you get it wrong the first time?" It's millions and millions of dollars, but really that's what's necessary. It was done after Challenger. The failure modes and effects analyses were all redone. The critical items list were all redone, based on experience.

Well, now we have a lot of additional experience in both directions. We know that there are things that were originally characterized as Critical 1 items that aren't Critical 1. They're not Criticality 1, and there are other things maybe that were not categorized as Crit 1 that are now, because of ageing conditions, and either should be changed out or made redundant or some other changes. We need to recharacterize that.

All of the computer models that were used to develop the space shuttle in the late 1970s have been upgraded multiple times, the materials models, the flow models and so forth. What are the implications of those on the vehicle in both directions? Were we too conservative with those things, or were we too liberal? Did we misunderstand?

I believe that the requirements, down to the most minute requirements, need to be revisited by the people who understand the system, to determine whether they need to be upgraded. The simple example that the program went through, I don't know, about five or six years ago with a new pressure-sensitive adhesive in the solid rocket motors -- they couldn't use the one that was spec'ed, because of environmental concerns, and they had a requirement of a certain peel strength.

They went out and found another adhesive that met the requirement. It was right in the middle of the range of the requirement, and it didn't work. When they went and re-analyzed it, now scrutinizing it, they found out that they had been flying at two or three times the requirement and they really needed it. They bought the best off-the-shelf stuff and it was much higher than the requirement, and that was absolutely necessary.

So falling back on a spec that was written before you flew the vehicle doesn't have a lot of meaning. You now have over a hundred flights. It's time to re-do that. It's a costly process, it's not a romantic process, it doesn't produce things that are impressive to the public, but it is absolutely what goes on with commercial aircraft, with military aircraft, and it should be going on with the space shuttle.

ADM. GEHMAN: You are aware, of course, of NASA's budget and the kind of limitations on their budget. As I understand it, you are recommending that we consider upgrades to the shuttle to keep it fully capable of flying for another 20 years, given certain conditions that you've outlined here; but we also have to get to work on the next manned spacecraft. This is going to be a tremendous pressure on a budget.

MR. BLOMBERG: Well, maybe. You know, there was a lot of money spent in the NASA budget, during the 15 years I was on the ASAP, that was not productive. Billions were spent on the advanced solid rocket motor. It never flew. Millions or billions -- I'm not a budget expert -- were spent on the X-33 and the X-34. They never flew. I think that even within the present budget confines, it's possible to support the international space station and the space shuttle to the fullest extent that they need and have a technology development program that will support a next generation; but if you try to initiate a new vehicle program, to develop a vehicle from scratch when you don't have the technology -- so you're doing the technology development and the vehicle development at the same time -- then you're not going to have enough budget. That's what happened, I think, with X-33.

Instead of going and working on the technology areas that were clearly needed to make X-33 work, they embarked on building a test vehicle. I just am a believer in finishing what's on your plate before you take more, and I think supporting the ISS and shuttle adequately is first priority for the country.

MR. WALLACE: Let me switch to sort of a pure human factors type of question. We're a little over two months in this effort, and I have to say there are no lack of processes at NASA. I mean Flight Readiness Reviews and COFRs and Launch Readiness Reviews and all the processes leading up to that; and every time we ask a question, we get lots of paper.

Really, I mean it's a tremendously methodical, thorough set of processes; yet the investigation has raised some troubling questions about sort of communications and decision-making and flow of information up and down. My question is sort of human factors. Is there a point at which people find too much comfort in processes, where processes might actually stop thinking? Admiral Gehman talked about the unknown unknowns.

MR. BLOMBERG: You certainly can be over-proceduralized and can be process-bound. That is one of the things that can happen to an organization. I don't think it has happened to NASA. However, any big organization, any organization as large as NASA will have some communications issues and it is always difficult to determine how much should bubble all the way up to the top, to the administrator's level, for example. Frankly, there is a real question of whether you want the administrator making ultimate technical decisions because the administrator is just that, an administrator.

I think in the 15 years I observed NASA, I think the processes were not perfect but certainly as good as you could expect from a large organization, and improving. It's an overused phrase, but continuous improvement was there. Now, not everything that was done was an improvement; but people were watching it. I think the processes are sincere. I think everyone within the system is truly dedicated to safety; and the big change that I saw over the 15 years on both sides, contractor and NASA side, was when I first joined the panel, I would say that the likelihood of a randomly picked person in the system standing up and saying, "Time out. We're not going to fly. I'm stopping the flight," was very low. Today I would say it's virtually a hundred percent, that anyone out there, from somebody turning a wrench to a middle manager to a senior manager, would feel absolutely empowered, if they were uncertain, to say, "Stop," and they would be listened to, that it would not be something that they would say, "No, you don't know what you're talking about." It would be at least run to ground very professionally before a decision was made; and certainly if time was of the essence, they would not fly. That, to me, is the essence of a good safety system.

MR. WALLACE: Well, I didn't mean to suggest that more decisions needed to go to the administrator's level at all. I understand. But just to follow up on your answer where you say anybody can stop the process, in your experience, is there any change, post launch, in terms of that sort of thing?

MR. BLOMBERG: Well, of course, the options available to you post launch are fairly limited. The post-launch environment and the launch countdown environment, I think once you start into a launch countdown and then you go on from there to the post launch, you really do want to be procedurally bound. You want to be requirements-driven. You do not want to be defining waivers on the fly.

A waiver sounds like a terrible thing. I know when I first got into the aerospace business, I said, "You mean you're waiving a requirement? You're agreeing to fly in an unsafe condition?" Well, that's not the case, in virtually every situation. A waiver is a carefully thought-out process by which you decide that something is an acceptable risk. You don't do that under time pressure while you're in the middle of a launch count. You don't do that while you have a crew up in orbit and make decisions on the fly.

So, you know, if the flight rules say, "If such and such happens, you come home," you come home. Then you work it out. You know, if it turns out that you were wrong, that it was a sensor failure rather than a true failure of the system, you've taken the conservative approach. So I think that that's where you have to draw the line in this is when do you have to be procedure-bound and when can people have some leeway in the system and call it.

Even though it might sound conservative, I would not want somebody, while a flight was in process to say, "Time out. Bring it back." That's not the way to go; but, "Time out. We ought to study this and see whether we ought to bring it back tomorrow," that's what the Mission Management Team is for and things will get elevated to that team very rapidly. It depends on the context of what you're dealing with.

GEN. BARRY: One of the things we're trying to understand is a little bit about the management structure, and I'd like to see if this resonates with you. We're going to talk pre-launch and post launch. Pre-launch, obviously Challenger, a lot of focus has been spent on improving the process, particularly in a certification of flight readiness.

If we characterize that and we said, okay, pre-launch is centralized, it is focused on competition between centers a little bit, where all the centers are involved in certification of flight readiness, and there is, some would some argue, an attitude that you've got to prove there is no problem. Post launch is more de-centralized. It is only really one center primarily involved and that's the Johnson Space Center and, as some would argue -- and we're trying to figure this out -- that you have to prove there is a problem. Does any of that resonate with you insofar as pre- and post-launch considerations are?

MR. BLOMBERG: Well, it does resonate; but I think, General, that it may be a bit of a simplification. Pre-launch, I think you have a whole series of what I would call challenge-and-response meetings that culminate in the combined Flight Readiness Review, but really every element and every subsystem has its own Flight Readiness Review that start way before that and it's a series of challenges based on what you know about the system and its recent performance. So if there was a hiccough on a previous flight or during processing or the previous flight of that vehicle, then you've got to clear that; and that starts way down with the sub-tier people, each of whom goes through a bunch of challenges. I would agree with your characterization that it's "Prove to me that it's safe to fly," but it's an incremental process.

Once the flight is up, the focus shifts to JSC for sure, but, remember, there's a Mission Evaluation Room operating not only at every human space flight center but at all the major contractors and those rooms are there specifically to support their elements and the issues. So I guess my short answer is I agree with you except with the caveat that it has to be clear that the JSC folks are not trying to make technical decisions that are outside of their technical areas. They rely completely on the technical specialists. If it's a propulsion issue on the thrusters, for example, they would go to the thruster specialists. What they are specialists in is mission operations and once you're operational and once you're flying, they know all of these requirements and the rules and so they know to really turn to you and say, "You told me from your analysis that if this happens, if so many of these fail, we have to come back. We're coming back because you told me that." And if the specialists were to say, "Well, we really didn't mean that. It's okay to go on," then -- I can't recall a situation where that's happened and they've won; but if it were to happen, they would certainly have to produce some very, very compelling analyses and produce them virtually instantaneously. For example, they probably have had to have a change request in the system already for that to happen. So my take on it is that your characterization is a good one and the system is a good one. That's about the way it should go.

GEN. BARRY: Let me follow up on that, if I may. If it is a rather structured process going up prior to launch with the Certification of Flight Readiness -- and I think the next hundred flights for the shuttle are programmed to go to the space station, a couple are going to Hubble, so other than just the space station -- some have proposed an idea of having a certification of re-entry readiness. In other words, you have an associate administrator who signs off on the Certification of Flight Readiness and we have a de-centralized focus with the Mission Management Team, the MER, and you have also, of course, the flight director involvement. If we are on the space station, should there be a more centralized focus on re-entry?

MR. BLOMBERG: That's actually a very complex question because the first thought I have is it depends on what countermeasures you have available that would make that certification a valid certification. If you have no ability to fix the vehicle or to bring the crew back any other way, then it's kind of a moot point. If there are things you can do, if there are alternatives, then that has a lot of appeal as long as it doesn't get in the way of all of the other things that are necessary for safe mission operations. Re-entry is not just getting in and pushing a button and saying, "Let's go down." There's a lot of crew preparation. There's a lot of support needed from the ground; and as long as that review doesn't get in the way of those things or supplant any of them, I don't see where it would hurt; and it might help.

ADM. GEHMAN: Mr. Blomberg, I was thinking here to myself that in support of one of your comments here when we were talking about re-entry -- having looked at re-entry things, checklists and things like that -- I was reminded that one of the things on the re-entry checklist is to put all the laptops away, which supports your argument that we've got to upgrade the computer systems because what we're doing is we're carrying a lot of laptops up there because the computer systems won't handle it. Earlier we had this discussion about whether or not the shuttle is a research-and-development or an operational vehicle and I think I heard you say -- and I'll give you a chance to comment -- it's closer to being an R&D vehicle than a transportation system.

MR. BLOMBERG: Well, I don't even think it's close. I mean, it is an experimental vehicle. Just the fact that it's flown over a hundred times doesn't change its nature. Every flight is an experiment. Every flight is gaining knowledge. It's not an airline, by any means.

ADM. GEHMAN: We may be using the terms loosely here as to whether it's an experimental vehicle or an engineering development model vehicle or something like that; but in any case, we are in agreement that this is an experimental vehicle. But it is being used in an operational sense.

MR. BLOMBERG: Well, that's true and I don't think those things -- I think that's a semantic issue more than a technical issue. It's being used for the repetitive support of the international space station and for flying humans into space on a regular basis, but that doesn't change the nature of the vehicle. That nature arises, for example, from things such as you've got multiple copies and they're not all identical by any means, that the technology that's being used in the vehicle is not widely-used technology, or much of that technology. It doesn't come from the nature of the mission.

ADM. GEHMAN: Of course, there's no law against using an engineering development model or an experimental vehicle in operational use. In the first Gulf War, the military's JSTARS was still an engineering development and was used. The Predator unmanned aerial vehicle was used in Bosnia that was still technically under engineering development. So there's no law that says you can't do that. I'm still working on this context thing, and I want to get your views. I want to get this thing clarified. So it's an experimental vehicle and we're still learning about the environment in which it operates and particularly this Mach 24, 300,000-foot altitude environment which we know precious little about for a winged manned vehicle, but it is being used for operational purposes also. Now, the question I have relates to your building another one. If we're in agreement on those two points, do you think it's reasonable for an experimental vehicle to have a 40-year life?

MR. BLOMBERG: I don't see anything that precludes it. I mean, I don't think we have any models to follow for that. This is a unique situation, probably one that we've never been in before; but given the care that went into the design of the vehicle and that has gone into its operation, I don't see anything that precludes that.

ADM. GEHMAN: Let me rephrase the question, then. Let's forget about NASA and forget about the shuttle program. Do you think the United States should evolve into manned flight into space by not evolving itself for 40 years?

MR. BLOMBERG: Well, Admiral, you know, if you ask me do I think that the United States made a poor decision perhaps 20 years ago in not spending the money to have a shuttle replacement ongoing, I would say yes; but if you also ask me would the country be better served by not having human space flight until a shuttle replacement is produced, I would vehemently say no, I mean, that human space flight is important, we are learning a great deal from it, we are accomplishing things in space, and the shuttle is fully capable of supporting that at an acceptable, albeit not perfect, level of risk.

Now, would we have been better if we had Shuttle 2 now or some other vehicle? Probably. But we didn't make that decision. So right now we have to play the cards that we're dealt. The cards that we're dealt is the only human-rated vehicles that we know of on this planet are Soyuz and Shuttle, and Soyuz can't do the job. So it's going to be Shuttle.

DR. OSHEROFF: Well, first let me say that your team won last night. I'm sure you're happy about that. I noticed that. I have no stake in that. Stanford did not make it in that part.

I wanted to bring up a question. When my graduate students do something with a cryostat, which is actually a kind of extreme environment and things go wrong and they end up having to warm up and fix things, I always tell them that they learn far more from their failures than they do from their successes. I think that goes well beyond graduate students doing research projects, as well.

I think it is fair to say that we have some good ideas as to what led to the loss of the Columbia and her crew. We certainly don't know for sure and we're not willing to identify anything at this point; but assuming that we've done that, can you give me some ideas as to what the lessons are that we need to learn? I guess I'm particularly interested in the issues of risk management and risk abatement.

MR. BLOMBERG: Well, this is an area which I've examined quite thoroughly, not only for the shuttle but particularly aircraft accidents that I've been involved in. The reality is that the sequence of events is that whenever you have a human vehicle, a vehicle that's going to transport humans, you do as much analysis as you can possibly do -- and I'm including testing in that -- to make it as safe as possible before you operate it. But as the vehicle gets more and more complex, it is absolutely impossible to check out every interaction and every type of failure and every situation that the vehicle will encounter. Therefore, in those places that you consider to be most risky, you build in redundancy, you do whatever you can, and you hope that your operational experience, the closed-loop feedback, will give you that additional experience, as you operate the vehicle, to upgrade it.

Mr. Wallace was talking about the airline industry. This goes on all the time, whether it's brakes or various components of aircraft that reports come back from operators saying, "We're having trouble with this." The manufacturer looks at it and says, "Oops, we missed that." We didn't miss it because of dereliction of duty. We missed it because it's a maybe a second or third order of interaction, but now we can fix it. We've got this operational experience. Unfortunately, part of our operational experience in any vehicle is accidents. We hope it never gets to that, but it is part of the reality of operating, particularly in a high-risk environment. When there is an accident, we get a spinoff benefit; and the benefit is that we get the resources to focus in on the area that was involved in the accident and then a wider part of the vehicle. Challenger is a perfect example. There was a focus in on virtually every high-risk component of the vehicle, and a lot of improvements were put in.

I think that is the natural progression of things; and your students, when they destroy an experiment or have a problem with the laboratory, learn from that. You'd hope that they don't learn by someone getting injured or a high-cost destruction of property; but regardless, as long as we close the loop and as long as we didn't do anything intentional, deliberate, or uncaring -- we are fallible. I mean, I'm a human factors person, and I'm the first one to tell you that humans are perhaps the most fallible part of any system. We design the systems, we operate the system, we make the decisions to go, and so somewhere in whatever you're going to find for Columbia, humans failed.

The question that I would want to ask is: Did we fail through malice, did we fail through neglect, or did we fail through ignorance? If we failed through ignorance, let's learn from it, let's increase our vigilance, and make the system better and keep that closed loop going. That's all we can do in any vehicle.

DR. OSHEROFF: I would suggest that there's another possibility and that is that the failure was through a faulty process which did not properly identify some of the risks and which would then have allowed NASA to take steps to minimize those risks.

MR. BLOMBERG: Absolutely. That is certainly a possibility; but if that's the possibility, I would speculate that that process failed because we didn't understand it, not because we short-circuited it or because anybody deliberately said, "Oh, it's okay. Let's go full speed ahead." That's part of the understanding. It's not only characterization of the materials and the software and so forth, it's characterization of how people and processes work. That's an integral part of it, and the whole shuttle program has been struggling with that now for years and doing a pretty good job of process control and understanding that processes are, in many cases, as important as products, as the hardware and software that results from them. So they've developed a process failure modes and effects analysis technique and some other things.

It's very likely that -- it's assured -- I mean, I am sure that whatever caused the accident escaped a process at some point. It had to have, because it flew. So at some point in the process, somebody missed it; and it may have been my panel. We may have been staring it in the face and missed it, but it wasn't for lack of trying, I'm convinced, on the part of all concerned, because, as I said in my opening remarks, I just have never seen a system more safety conscious and people more dedicated to safety. That's not a hundred percent assurance; it just says that their hearts are in the right place.

DR. OSHEROFF: Well, I fully agree with you, but I think that we really have to look at what processes may need improvement and I'm sure you agree with me on that.

MR. BLOMBERG: I do, Doctor, but with one variation. I think that the time to do that is after you've decided what the proximate cause was. The processes are in the root cause domain, and right now my understanding from your statement is you're still struggling with understanding the proximate cause. Once you understand that, then I think that's the time to step back and say how did that slip through all of the defenses.

DR. OSHEROFF: Well, let me suggest -- and I think that NASA's already suggested this -- inspection of the shuttles in orbit, with the ability to repair at least the tiles, if not the RCC panels.

MR. BLOMBERG: Well, even if that doesn't turn out to be the cause of the accident, that may be a positive outcome of the investigation, saying here is a technique, is an ability that we had that we weren't making maximum use of. That's the kind of improvement that I was talking about that comes out of this intense scrutiny. Again, I don't think that we're dealing with an escape here that anybody can be faulted for not having realized, because the operational experience just didn't point to it.

DR. OSHEROFF: I'm sorry, I have absolutely no intention of assigning fault to anyone. This is an extremely complicated vehicle and the process of certifying it for flight readiness is extremely complicated, but I think we have to set aside the issue of fault and, in fact, not identify that but recognize the processes that must be changed.

MR. BLOMBERG: I fully agree with you. I'm just saying I think it's a matter of timing, and I think that is done most effectively after you understand the causes and, you know, you have to work backwards from the effects and then say what processes were there that could have caught this and are reasonable to perform. I venture that you will find in some of your blind alleys, some of the theories that you've checked out that don't turn out to be the cause of this accident, you will still be able to back those out to improved process because you've scrutinized those so much. That's a terrific benefit of the kind of investigation that you're doing. It's just the question of when to do it.

DR. OSHEROFF: So the idea of minimizing risk is certainly one that's very valuable.

MR. BLOMBERG: That has to be the overriding principle of the entire operation is risk management and minimizing risk and understanding the risk you're accepting. It's not only minimizing the risks but it's understanding the risk that you've accepted.

DR. OSHEROFF: Thank you.

DR. WIDNALL: I'd like to follow up a little bit on some of the words you've used. I didn't write them all down, but you said, you know, we know it wasn't due to malice. Then you had this rather large catch-all category called ignorance, and I guess I'm just not willing to allow so much to be in this category of ignorance. Being a poor engineer, I don't have a rich vocabulary in organizational theory; but it seems to me to me words like denial, organizational structure in the way the various levels work together, issues of unconscious trade-offs that various parts of an organization make, I think somehow that vocabulary has to get into any kind of framework which otherwise might be called ignorance. I mean, I think we really need to think deeply about how one organizes an effective, you know, as you mentioned earlier, large organization for the whole question of making good decisions in the safety area.

MR. BLOMBERG: Well, I agree with you completely; and probably the word "ignorance" was unfortunate. Being a poor engineer myself, I couldn't think of a better term. But I wrap in that the clear issues of things like we don't have the technical knowledge to understand how a material performs under certain circumstances because it's never been tested in that environment and we never looked at it because we never thought it was a problem, which is another form of what I'm saying, in quotes, is ignorance.

My own concern is that, with the best of intentions, any organization -- and I think NASA and its contractors may have fallen into this -- when you're so goal-oriented and you're so budget-limited, you tend to put blinders on and you tend to look at -- in my experience here, they tended to look at the next flight, let's look at getting this next flight off as well as we can. Maybe the old not seeing the forest for the trees comes into play. That's one of the reasons, for example, why we try to get engineers and managers in any organization to understand the end-to-end system so they understand where their portion fits in and maybe will see some of the interactions that go beyond just the performance of their subset. That clearly could have been a problem here.

The space shuttle people were under enormous stress, stress from one side of supporting the international space station and not being the weak link in the international effort to put a space station up and, on the other side, the very real knowledge that if they could not perform within the budget, there was a risk to the entire program and, therefore, to their lives, to what they had dedicated themselves to. I'm absolutely convinced that nobody said, "Well, we've got to go ahead. I know we're increasing the risk; but if we don't do that, we could lose the whole program." That I would be very sure of, knowing the people; but whether they inadvertently missed something because of their zeal and because of their innovative capabilities remains to be seen.

Certainly they need relief. They're not going to be able to fly for another 20 years under the stress levels that they've been asked to fly under for the last seven or eight. I would liken it to a very taut rubber band. You can only pull that rubber band just so far, and eventually it's going to snap. These folks are being asked to continually pull rabbits out of hats, and you can't do that forever. I am convinced that if they knew they couldn't pull the rabbit out of the hat, they would stop the flight; but as you're saying, sometimes you think you've pulled the rabbit out of the hat and all your analyses say that and you just don't have the tools to give you the proper insight.

DR. WIDNALL: Or you don't really want to know the rabbit is in the hat.

MR. BLOMBERG: Well, I think there's very little of that. I honestly do believe that the folks on both sides, NASA and the contractor, do want to know if the rabbit's still in the hat. They understand the implications of failure. They are very dedicated to the crews and to keeping everybody safe. So I think if there's uncertainty, they err on the side of conservatism; but sometimes zeal can say that you're certain when perhaps you should have said you're uncertain.

ADM. GEHMAN: Mr. Blomberg, on behalf of the panel, we want to thank you very much for your help here today. You've been looking at this for over 20 years, and your views are very helpful to us. We appreciate your very frank answers. We appreciate your willingness to dialogue with us as we attempt to bring our level of knowledge up to yours. Your views are very helpful to us, will make a big difference in the report, and we want to thank you for your contribution. So thank you very much. We'll take about a ten-minute break here while we seat the next panel. (Recess taken)

ADM. GEHMAN: All right. Ladies and gentlemen, we're ready to resume here. We're privileged to have join us today a panel. Mr. Gary Grant is the systems engineer in the Thermal Management Group for Boeing; and Mr. Dan Bell is in the TPS, subsystem manager for Boeing. I'll invite you to make a statement and give us a briefing or whatever you want to do; but before we begin, let me ask you to affirm that the information you will provide to the board today will be accurate and complete, to the best of your current knowledge and belief.

THE WITNESSES: I affirm that.

ADM. GEHMAN: Thank you very much. Would you introduce yourselves. Tell us your background and what your current position is.

DAN BELL and GARY GRANT testified as follows:

MR. BELL: My name is Dan Bell. I am the TPS subsystem manager for the Boeing Company. I've got 15 years of experience in TPS, TPS installations, materials. Prior to becoming the TPS subsystem manager, I was the manager in the Thermal Management Systems Group in the Huntington Beach facility, also Boeing.

MR. GRANT: My name is Gary Grant. I'm also in the Thermal Protection System. I have 14 years experience, primarily in the operational and turn-around area and requirements. I'm an active member of the LASS subsystem, and I'm acting as an assistant subsystem manager in that capacity.

ADM. GEHMAN: Thank you very much. We're delighted to have you join us today, and we invite you to make a presentation or a statement.

MR. BELL: I think we're here to give you guys a presentation.

ADM. GEHMAN: Go ahead.

MR. BELL: I want to bring up the charts.

Next slide, please. We're here to kind of bring the board and give an overview of our TPS and RCC systems. In this presentation we're going to talk in some detail about the reinforced carbon-carbon system, the leading edge of the vehicle and some other components, what we call our high-temperature reusable insulation. I think you all know them better as these are the black tiles on our vehicle. Our low-temperature reusable surface insulation, these are the white tiles. AFRSI or FIB -- each of those are kind of interchangeable names -- those are kind of quilted soft goods that we use primarily on the upper surface of the vehicle. We have FRSI, flexible reusable surface insulation. These components are a needled felt material that's used on the upper surface of the vehicle, more durable than our AFRSI material. Then we're going to go into some penetrations and seals, those locations on our vehicle where we have areas that need to be closed out with different thermal barriers and sealing systems.

Next slide, please. Just to demonstrate on a very high level where the RCC and these different components exist. RCC makes up the leading edge components. The nose cap and what's not shown here on the lower surface. We also have the chin panel and what we call the aero head, and that's the forward attach point for the vehicle itself.
Next slide. When we talk about our high-temperature reusable surface insulation tile, those are the black tiles, the upper surface tiles that are shown here. Most have seen the lower surface -- and we'll get into that -- but the entire lower surface of the vehicle is covered by those components.

Next slide, please. Our LRSI tile. As you can see, right around the forward windows and on the forward edge of the OMS pods themselves, we have our low-temperature surface insulation tiles. Next slide. Our AFRSI blankets or FIB blankets that we have cover a large acreage of the upper surface. These components are lower maintenance than are LRSI tiles, and that's the primary reason those were selected over the tile system for that upper surface.

If we go to the next slide. This fills in the puzzle with our FRSI system. This is a felt system, very durable and very maintenance friendly, having workers in and around that vehicle. The penetration seals and thermal barriers, we're going to get to on some later charts.

Next slide, please. When we talk about the environments that our vehicles are exposed to, the first thing everybody asks is what kind of temperature, thermal environments we're exposed to. What's shown here are some data that came off a compilation of data taken from three flights early on in the program. It shows you a variation in temperatures from the very forward edge of the vehicle, lower surface, ranging from 1900 degrees. Then we have some areas on the vehicle that we'll talk about a little later on that get upwards into the 2500-degree range. These isotherms vary across the vehicle. Our upper surface of the vehicle sees much lower temperatures, generally less than a thousand degrees, and varies, depending upon the location, to as low as 300 or 350 degrees at the top of the payload bay doors.

Next slide. Now, when we go through a re-entry cycle, what we wanted to demonstrate here is the change in pressure; and pressure is an important part of the equation on re-entry. Starting from the time of re-entry, you can see how the pressure actually increases as you get further in the atmosphere, as one would expect. This was taken from a body point forward on the vehicle surface.

Next slide. I wanted to touch base in a little more detail on some heating and some very specific locations. These are some of the more extreme environments that our TPS, our tile systems see. A body point on the very forward edge of the nose landing gear door, Body Point 1024, sees a peak heating of about 2300 degrees Fahrenheit. On the door itself, the temperatures start to decrease as we move aft. We're still getting extremes around close to 2100 degrees there. We do have a very hot region in between the two elevons, the inner and outer elevon. In this region we get some additional heating that causes us to push that tile system upwards to 2500 degrees.

ADM. GEHMAN: There are two lines on each of those graphs. What do they mean?

MR. BELL: I don't think I have the background on this specific slide to answer your question correctly. So we'll get you that data. I do know that the lines that were listed there are the actual temps, though, that were measured at those body points.

Let me go to the next slide. The TPS system is very extremely part-count heavy. We have very high numbers of parts that we have to deal with on a daily basis. Our high-temperature reusable, our black tiles, what's listed on the first line there, is two different systems. One is our LI-900 system, which makes up the majority of the components, 9-pounds-per-cubic-foot tiles. Then our LI-2200 tiles make up a smaller subset of that, and we'll get to those locations on some later charts.

You can look there just with those systems alone. There's about 20,000 tiles on each vehicle. TUFI tiles, which we'll talk about, are our newer introduction to the vehicle; and we have about 306 of those installed on the vehicle. Those primarily take up the base heat shield and upper body flap section of the vehicle at this time.

FRCI tiles, which were an introduction sometime in mid-program, we have almost 3,000 of those installed. Again, now getting to the upper surface, the upper surface tiles, our LRSI, about 700, actually 800 tiles with varying density of substrates. Then if we look at the amount of area occupied by our FIB or AFRSI blankets and then our FRSI, we're talking over 2,000 square feet for each one of those systems. It's a lot of parts to deal with.

Next page, please. I wanted to touch on how our system goes together, and it's primarily for our tiles. Well, let's start at the top of our system. The tiles are a substrate, which three of the components that we are currently using up there are listed. LI-900, LI-2200, two of the original substrates from Day 1 on the program, still occupy the majority of our substrate material. We have a material called FRCI 12 which was introduced at a later time. It's got some benefits from a strength standpoint. Then we have what's not listed up there, an AETB-8 material, an 8-pound-per-cubic-foot material that accommodates us the use of a TUFI coating on that surface.

These three substrates have the same coating, our RCG coating, reaction-cured glass coating, over the surface of that. We then take that substrate, the base of the material is densified, and we bond onto that what we call SIP. It's a strain isolation pad. That is bonded to the base of the tile with an RTV system, which is a silicone. It's a two-part silicone system, and that two-part silicone system is then bonded to the structure. We have multiple types of structure that we actually bond to.

One of the features of our design system, as you can see, is this component. This is what we call filler bar. Filler bar allows us to have a seal in between two adjacent tiles. So if you can imagine -- you kind of see in this gap here. If we had another tile that would sit into this hole here, this piece of filler bar would be covered by this tile and then its adjacent tile.

Next page, please. When we talked about the different types of substrates that we have on our vehicle -- and this is a little archaic as far as it's a demonstration of where those parts are located -- the 9-pound material, our LI-900 material, as you can see, makes up the majority of our lower surface of the vehicle. It's our primary workhorse from an acreage standpoint. FRCI 12 -- and this is 102, so it has actually less FRCI 12 than do the other vehicles. We have instituted some locations where FRCI 12 has been installed for different reasons.

LI-2200 material is a higher density material that we use in LESS regions, generally around penetrations and a highly-loaded region. It's also used quite a bit around the nose of the vehicle itself. AETB-8 obviously isn't shown here because it's on the base heat shield and upper body flap of the vehicle.

Questions?

Next slide, please.

GEN. BARRY: One question. Could you tell us what percentage of the tiles on the bottom are original tiles?

MR. BELL: We have that data. It's a pretty substantial number. Most of our tiles. I believe the number is about 60 percent. We certainly can get you some accurate data, and I think we have those charts available and we'll make those available to you.

GEN. BARRY: Thank you.

DR. RIDE: Could I just ask how you chose the areas on 102 to put the FRCI tile on? You said that it's less than the other orbiters.

MR. BELL: Sure. The FRCI 12 tiles are an introduction that occurred after the build of 102. From a design standpoint, those tiles give us some benefit because they have some added strength characteristics that allowed low-margin tiles to be upgraded and in some cases we went forward and upgraded specific areas of low-margin tiles that would benefit from that strength.

DR. RIDE: So it looked like the doors of the wheel wells, the inboard doors of both wheel wells?

MR. BELL: Actually this forward edge, there's a seam that exists under this edge. I don't think it's really driven by the fact that the doors are at that location. Yes. And there's some other very specific areas. FRCI allowed introduction of a stronger substrate that can accommodate relieving some of those low-margin areas that we've had to deal with for 102. We simply installed more of them on the other vehicles to deal with that, but there was still attrition mods where FRCI, on the books, that 102 would have had upgraded at points this time.

Next slide, please. This kind of gives you a feel. You know, you take a look at the bottom of our vehicle and you think that it's a nice, flat surface; but it's really not. We have various thicknesses of our tiles; and our tiles provide some contour to the vehicle, as well. You can see in some of our thinner areas we get down to less than an inch in thickness; and back on the very base of the body flap, we're talking about tile thicknesses approaching 4 inches in thickness. So a significant variation across the vehicle.

ADM. GEHMAN: And the reds are thicker?

MR. BELL: The red ones would be thinner.

ADM. GEHMAN: Thinner. Then the blues and purples are thicker? MR. SPARKS: That's right.

ADM. GEHMAN: I can't read the numbers over there.

MR. BELL: Next chart, please. Talking a little bit more detail about our lower-temperature systems that are used on the upper surface. I talked about AFRSI or FIB blanket. What we have is two glass fabrics, an outer OML fabric which is a quartz, astroquartz material, and S-class IML fabric on the lower surface; and that surrounds a 6-pounds-per-cubic-foot-density batting. This is the insulating characteristics of the blankets themselves. Then just as you would stitch a blanket, we actually stitch, using quartz thread, through the entirety of the blanket itself to hold those together.

Now, a little bit different approach is our FRSI material. Our FRSI material is specifically fiber that is felted. This is a Nomex fiber. It is felted together and produces these sheets. Then we apply a silicone coating to the surface of that, and that is bonded then to the structure itself. We have vent holes, too, for obvious reasons. A little lower density. This material is very good around the work force. Very durable. We actually walk on this material. This is the only TPS component that we actually can walk on.

You can see the difference in the materials is driven by -- we'd love to use this material everywhere, but we can't because of these temperature requirements. That's really what defines those locations where we can put those materials.

Next slide, please. A little more detail. I'm not sure we want to go into a whole lot of this. A couple of features. You know, how do we close out the edges of the blankets? Simply the fabric is wrapped around the edges and then the stitches that we talked about are provided all the way through the blanket itself. Another feature that is interesting about this design is the actual loop part of the stitches occurs at the very bottom of the blanket. That allows this bond line; or when we bond this blanket, these stitches and overlaps are included in that bond line. So if we ever lost -- let's say we broke a thread. We wouldn't be subjected to an unravelling situation where the blanket could unravel itself.

Next slide. When we talk about our tile systems, you'd be negligent to not include our gap-filler systems. In between our tiles, we have a gap. If that gap is deemed to be out of tolerance or specifically designed to be large, then we would come in and include what we call a pillow-type or pad-type gap-filler which, simply stated, it's batting with fabric wrapped around it, similar Nextel or quartz fabrics that we talked about for the AFRSI blankets themselves.
We include a strip of Inconel foil. This Inconel foil provides some stiffness that allows us to handle these parts and install them. We have some features that we include in specific areas for design purposes where we would add a piece of sleeving to the surface of that.

We get down to where we would have design cases. In some areas we want to protect that gap a little more. We actually build into our tile system this lip. This lip protects the gap-filler in that gap a little more, and then we come in with our gap-filler underneath it. And there's what we call a double lip and single lip type of installation. On the acreage portion of the vehicle, we utilize a lot of -- and you'll see a lot of these -- what we call RTV or ceramic-coated Ames gap-fillers. These Ames gap-fillers, you can think of them as almost like playing cards; and we can include up to six layers of these Ames gap-fillers to deal with either out-of-tolerance gaps or to deal with flow conditions that we've witnessed and inspected down the cavity itself. So we'll install those on an as-needed basis.

Next slide, please. The penetrations. Penetrations are a difficult thing to deal with. An ideal vehicle would have no penetrations on the lower surface of the vehicle. Obviously, for many reasons, we don't have that luxury. The major penetrations that we're talking about here are the nose landing gear door, a very critical area because it's very hot in that region, as well; the mains, which everybody has had a lot of attention on; the ET doors; body flap seals; and then elevon cove seals. On the upper surface, we have our rudder speed brake, we have around our thruster, the forward RCS thruster module, around the hatch, and then around our hinge line. There are places that TPS needs to be included. It certainly doesn't get the attention that the big acreage stuff that you can see, but it is probably as or more critical than the other systems.

Let's go to the next slide and talk more detailed about that. There's a lot that goes into dealing with how we keep heat out of these locations where we have penetrations. The nose landing gear door, again, I touched on it being a very critical area. It's very critical because this is in a very hot area, and actually for this nose we have a triple-redundancy NR seal on the forward edge of the nose. There's an OML thermal barrier, what we call a primary thermal barrier, and then an IML thermal barrier; and that is backed up by a pressure seal that we have or an environmental seal, if you will, that seals the surface of the structure together, closing that door itself. This kind of shows the three barriers in place. The reason we have the redundancy here obviously is because of the extreme environments and heating.

Let's go to the next slide and talk main landing gear door thermal barrier. This shows a difference between an old and new design. It's a pretty good example of what the barrier is itself. We start with a Nextel sleeving and Nextel fabric wrapped around an Inconel spring tube. This Inconel spring tube supplies stiffness into the part that allows it to retain some compressibility. If it was just batting or other material, we wouldn't get a spring-back that we need to maintain our seal.

We used to come and bond in. Every time we had to replace a barrier, we actually had to bond in this barrier into place. Very, very time-consuming. Very labor-intensive. Difficult bonds to make in situ. A redesign that occurred included a standoff, if you will, that had an attach plate; and this aluminum attach plate snaps into place. So now we have piece parts that we can apply much quicker to include into the design of the vehicle. Helped maintenance significantly.

When we start to talk about elevon cove and even the body flap cove, it's a very difficult area to deal with because it's a dynamic environment while the heating is occurring. We have moving parts here occurring that we have to protect. It all centers around what we call our hinge tube. We have a primary seal here and then a secondary curtain seal on the back side of that. The tiles are designed to protect the seal itself here and here, and then we have actually AFRSI blankets installed inside this cove to deal with any heating that might get through and into that panel itself. The rest of the components obviously have to move in situ with any movement around that part.

Next slide. I wanted to go into a little bit about damage history as far as our vehicle goes and what we typically have seen as far as impacts to our vehicle. We use this greater than 1 inch as kind of a criteria that we track our larger impacts. There is no significance about that size in particular. For the fleet average, we have about 30 impacts of that size every mission and with a total number of impacts, including the ones that are less than an inch, of about 144 per flight. The average tiles --

MR. WALLACE: Can I interrupt you with a question, Mr. Bell? This fleet average of 30 impacts, can you give an historical perspective on at the very beginning of the program? I mean, was there an expectation that there would be a number of impacts?

MR. BELL: Obviously you're probably pre-dating me with that question, but I certainly can go back and know that the requirement for TPS is that there would be no impacts to that system. That's in our OVEI document and that still exists today. That has not changed. So early on in the system -- and I've gotten this from those that have preceded me -- early flights, they were even concerned about having cracks in tiles and obviously having to deal with those type of changes and evolving into where we are now.

MR. WALLACE: We've seen these sort of numbers, and they seem to be fairly level. I mean, while there are some extreme cases, the trend is fairly flat. I mean, can you tell me sort of from a standpoint of the TPS program is this something that has just sort of become -- and I know that you don't cause these impacts, you're the victim of these impacts.

MR. BELL: Sure.

MR. WALLACE: But you work with the other elements. Is this just like an ongoing effort to lower this number?

MR. BELL: From the TPS standpoint, we are primarily looking at these numbers and these numbers come out of our post-flight reports that we generate every flight if we see a movement in these numbers or these have been treated as our baseline. Now, what we really look for is anomalies, very large damages, or a case where you would have a significant number of damages that are out of the norm; and that drives us generally to go and pursue that further.

I think if we'll go to the next slide, what you'll see is -- next slide, please. If you look at these impacts, you know, there's a variation from flight to flight. You know, here's a significant case; and I've got another slide that will kind of point out those events. Generally, what we're using this data for is to point out, say, significant event or changes from that baseline that you kind of defined.

ADM. GEHMAN: This slide here is actually Columbia?

MR. BELL: This is 102.

ADM. GEHMAN: This is OV 102. This is Columbia minus her first five flights, which I guess were considered to be test flights.

MR. BELL: Test flights. And I'm not sure we had collected the data in the same fashion for those flights. That may be why it's missing from the slide. You'll notice that Columbia actually had a lower average of impacts than the fleet from a 1-inch standpoint. The location of these impacts is pretty consistent. It doesn't really vary a whole lot from the vehicle itself. The TPS system is actually quite resilient. Even though it's quite easily damaged, it absorbs these type of impacts very well. It certainly is a maintenance issue, these sizes of impacts that we're talking about.

GEN. BARRY: Let me ask a question. We discussed a little yesterday about, of course, foam. Really the question came up: Can you design an external tank that will not shed foam? I think most conclusions are that it's going to be very hard to do that. If you take that assumption and accept the fact that you are going to take some hits, you've already alluded to this design spec originally for the tiles was not to accept any hits.

MR. BELL: That's correct.

GEN. BARRY: Now, if you have history on where these things are traditionally hit, you've already just stated that they kind of reside in the same areas, for the most part. Are there any designs right now to strengthen the tiles so the specifications can be stated as having an ability to accept hits? I understand there's a BI-8 kind of tile. Can you talk a little bit more about that?

MR. BELL: Sure. It's kind of been an evolved process. We started out with our AETB-8 TUFI tiles, and I've got some charts that will actually show you. It's pretty dramatic what these tiles have done for us on the base heat shield as far as reducing impact damage. Again, let me emphasize that impact damage was being driven by a maintenance issue. It wasn't considered a safety issue back on the base heat shield that we were trying to fix, primarily driving towards that. The implementation from that was very positive.

Now, the issue with that substrate is that substrate, the AETB-8, does not have a thermal conductivity or it's not as good an insulator as the base system that we have on the rest of the vehicle. So we cannot go in and simply implement that material because then our thermal load to the structure would have issues from a gradient standpoint or a local thermal impact standpoint.

In 1999, we initiated an upgrades effort to go forward and try to create or design a system that would accommodate a tough coating that would have the ability to insulate where we needed to on the lower surface of the vehicle itself; and what you had mentioned, that BI-8, or in some cases it's called BRI-8, it's still in development. It's actually very close to being completed, and that's something that we'd like to have that tool in our bag if the program deems that we need to go and do this type of replacement. It's not available today.

GEN. BARRY: The bottom line is the question that could be asked is: What will it take for the orbiter tile, the TPS tile, to be able to accept hits?

MR. BELL: Well, I think you could approach this in two ways. Certainly we can imagine that these type of ascent hits, we can take those hits now, the typical hits that we have; and we've demonstrated that if we get the sizes of impacts that are typical, our system can deal with those very well. We do have still a maintenance issue that we would have to deal with. From a TPS standpoint, we would love to eliminate it.

Now, if you're talking about substantially larger impacts than we are accustomed to seeing, then we have to do more homework even to evaluate whether this BRI material installed in these specific locations would provide us the benefit that I think you're looking for.

GEN. BARRY: We've been told there are about 200 to 400 of the 22,000 tiles on the bottom that are "critical." Is there any attempt to beef those up? Maybe you could explain why those are identified as critical.

MR. BELL: If I could try to clarify, there's probably more like 18,000 tiles on the bottom of the vehicle that are "critical." I would hesitate to be the person that has to pick out one tile to leave off for the next launch. The tiles I think that keep coming up, these 2 to 4 hundred tiles, they're primarily the ones around the penetrations. Those are already beefed up per se because those are the higher-density materials. That's not to say that we aren't pursuing higher-density materials that can accommodate a stronger substrate, just like we are on the BRI-8. That work is in process, as well. But really to accommodate increased toughness of that lower surface system, it would be difficult to pick out a specific location. I can kind of take a step back and say which is the critical tile; the critical tile is going to be the tile that takes the impact. If you can figure out what is going to be the location of that next impact, I can fix or increase that durability or certainly approach the vehicle as a whole. But I don't think that you can simply say -- certainly we would make gains by any replacements. I hate to be very specific on one location as being critical.

DR. OSHEROFF: You talk about tile hits that are an inch. I assume that's in diameter at the surface. How deep are these typically?

MR. BELL: And I'm talking in generalities here. Lower-surface impacts are generally very low-angle impacts. So when you're talking about for most of the lower surface -- and I know with some of the work that we've had going on, if you start to look at the acreage impacts, you're talking about less than 10 degrees of angle of incident at various velocities. So generally the crater depth is very much driven by the length of the damage or the degree or mass that impacts it. So generally they're not very deep. We have seen some deeper ones. I would say, you know, a half inch would be deep. Most of the damages that are listed out on the vehicle are typically not very deep.

DR. OSHEROFF: And how deep are the deepest ones?

MR. BELL: That would be data that I would have to go back and pull for you. Certainly we have not just the foam impacts, we've had an impact, STS 27, where we lost half of a tile. A cavity in that one, I would say, would go full depth.

DR. OSHEROFF: Can you say a little bit -- I think it's pretty clear that most of the tiles are repaired rather than replaced. Could you describe a little bit that process, or are you going to do that?

MR. BELL: I wasn't planning on it, but I would be happy to. We really have three basic repairs. We have what we call a coating repair. We could think of it as a coating repair. The coating gets removed from the part. No depth to it really at all. We come in and apply an additional coating over the surface of it to preserve our erosion resistance and emissivity for the next flight. It's a very benign repair.

Then we start to get into different depths or quantities of, how I can say this, volumes of damages that we are allowed to repair. Those are simply a ceramic slurry is mixed up and applied to the cavity, and what you end up with a high-density putty. We call them our putty repairs in that surface. Our next level of repair is, if we exceed our putty level requirements as far as sizes that we can repair, we replace the tile.

DR. OSHEROFF: How difficult would it be to apply this putty in space, from a chemical point of view? Forget about gravity.

MR. BELL: Any application in space obviously has its challenges. I think that I would probably like to not answer that question since we have an entire team out there driving towards an on-orbit repair. Certainly the approaches that have been dealt with previously have not been along the lines of a ceramic putty repair like we're dealing with.

Let me approach this from a different question. I think I can answer your question without going somewhere where it's outside of my realm. The putty repairs that we're dealing with, if our damage is that we have returned from space with them, typically they're ascent damages. So those damages existed prior to the re-entry or thermal cycle. So we would really have no driver or no need to go and repair that prior to a re-entry case.

Now, if you're talking about going in and trying to repair a much larger volume, potentially even a full tile replacement, the ceramic system that we're talking about would be way too massive from a mass standpoint alone, I think, to accommodate that, as well as it would not necessarily stick to a fractured tile surface the way that we need to. Generally, we mechanically lock in those repairs, as well as we get some chemical attachment. So I don't think that would be a very good approach, sir.

DR. OSHEROFF: The point is that they are, in fact, working on how to do this. Is that correct?

MR. BELL: There is a flight techniques panel which includes 12 subteams, of which obviously TPS is a big part, that are pursuing this effort.

DR. RIDE: Just a question where you've got this particular slide up. You said that the patterns of debris hits tend to vary from flight to flight. I was wondering whether you had seen any patterns in the hits from certain types of debris. For example, I think these are the products that you guys put together, is that right, so you're probably pretty used to looking at these. I'm just curious whether, for example, foam coming off the bipods has certain patterns that you would recognize when you just went out and started counting these up and looking around the vehicle and putting together a chart like this. Where I'm going is that there are a lot of flights where we don't really have ascent imagery and we don't know where the foam came off. I'm wondering whether, just from your experience with the patterns here, one could go back and take a look at the drawings like this that you've made for each flight and kind of estimate where the foam came from.

MR. BELL: The effort that goes into putting this data together, there's actually a parallel effort that goes into it by an actual debris group. They actually build something very similar to this and they take specific sizes and they are looking for exactly what you're talking about. They're looking for anomalies that they can trace back to sources, and they do a better job than TPS by themselves to integrate those different pieces of data and try to bring that information forward.

You know, the bipod ramp is challenging from a transport standpoint and where it comes off within the launch and where it would actually impact the vehicle. The one piece of data that we have been able to go back in, we had a significant damage on STS 50; and that STS 50 damage was related back to the bipod. I believe, if I'm right, that damage occurred back here. It was, again, a very low angle of impact. We really don't know what the size of the foam debris was. All that we know is there was a relationship between when that came off and the damage that we had. The damage, I believe, was about 14 inches long, if I am pulling numbers out of the air here, if I remember correctly.

DR. RIDE: Thanks.

MR. BELL: Again, not very deep because the angle of incidence is very low.

ADM. GEHMAN: You've got total impacts and you've got impacts greater than an inch. If in any of those flights the OV 102 came back missing a tile, would it have been annotated on there or would that have made your chart somehow?

MR. BELL: We don't have that relationship here. The only tile that I know that we had lost from an impact case was half of a tile, and that was that STS 27 case. I know of no other losses of tiles due to impact. We've had significant damages; but if you're talking about loss of tiles, that is the case. Now, that case, I have to be very specific. That case was related back not to foam but SRB ablator, so a much more dynamic projectile than foam is.

ADM. GEHMAN: That was Atlantis.

MR. BELL: Yes. Correct. Would you pull up the next chart. I think it will kind of go down the path of what you're talking about. This is primarily to demonstrate that when we have something that is out of the norm as far as debris impacts, we normally go back or we have gone back and related that to a specific event that was significant. You can see the STS 27 flight, I believe, is in here somewhere and we're talking about those cone ablator and the SRB cork. I'm having almost as hard a time reading it as you.

ADM. GEHMAN: I think one of my colleagues here previously mentioned that even if you take out the spikes, that the trend is flat here. We're not getting any better at preventing damage to your TPS.

MR. BELL: That is correct. We have not seen any significant change in that. Next slide. This is a demonstration. We really didn't talk about TUFI tiles because it really isn't applied to the lower surface at this time. I wanted to show you what it did for us on the lower surface. On the case on the left, it's not as easy to see; but all of the tiles had been replaced except for this tile in the center. You can see the damages that occurred on that specific tile. On the right-hand side. These two tiles were replaced. And you can see the gray marks are previous damages. So these are repairs that we had done from flight to flight, all the gray in this photograph.

ADM. GEHMAN: These are your putty repairs?

MR. BELL: These are actually what we would call slurry repairs, sir, where we simply paint the slurry on to eliminate the erosion resistance. We don't really have an aero issue on the base heat shield of the vehicle. What's significant here that you can see is all the little white marks. Those are from a single flight. Those are damages that we would have had to repair from a single flight. The TUFI tiles have virtually eliminated our need to do repairs like that. So from an operations standpoint, it was significant for us.

GEN. BARRY: I understand also the TUFI tiles shrink. Is that correct?

MR. BELL: That's incorrect.

GEN. BARRY: Incorrect.

MR. BELL: The TUFI tiles, if we were to put that TUFI coating on our existing substrates, those substrates, when we would fire them, cannot handle this type coating and those parts would shrink to something that would not be usable for us as a system.

GEN. BARRY: So with the coating, they do not shrink.

MR. BELL: Our AETB-8 substrate with the TUFI coating on it, it's a very stable material. Next slide. Okay. This is the point that, unless you have any more questions about TPS, I'll hand this over to Gary.

GEN. BARRY: Just one other question. Do you know of any systematic studies to identify critical damage scenarios? It really alludes to the fact that if you can trace where the hits have been and we can get some kind of data base, which we've asked for, to be able to say, okay, 80 percent of the hits have occurred on this part of the underside of the orbiter, then we can take up maybe the issue of how you want to strengthen it even further to be able to accept hits. So we're really talking about damage scenarios. To your knowledge, is there any damage scenarios that have been done?

MR. BELL: I don't know of any, sir.

GEN. BARRY: We still have that question out. So we're looking for the answer.

DR. OSHEROFF: Can you tell me how much would it increase the weight of the orbiter if you were to replace, let's say, the 500 -- I know you don't like the word "most critical" tiles -- with TUFI tiles? Roughly speak, how much extra weight is it per tile?

MR. BELL: From a weight standpoint, these new tiles that we're talking about do not include a weight penalty.

DR. OSHEROFF: Really.

MR. BELL: Yes. We're actually closely approaching the weight. So if you ask me if it would be significant, I think it would be very insignificant.

GEN. BARRY: But there is a difference between LI-900 and TUFI tile.

MR. BELL: Well, the LI-900 is the substrate density, 9 pounds per cubic foot. We have an RCT coating on that which applies mass to that system, and you get a weight. We started out with our AETB-8 or a BRI-8 material, which is 8 pounds per cubic foot substrate. It's a lower-density substrate to start off, and we're adding our mass at the coating where we get the benefit out of the impact resistance. Does that make sense to you?

ADM. GEHMAN: Yes. So it's close to the LI-900.

MR. BELL: Very close. The new BRI-8 system is very close.

GEN. BARRY: Now, there's a difference in BRI-8 and TUFI. I guess that's the question.

MR. BELL: TUFI. You can think of TUFI -- the Ames guys might get upset with me here, but AETB-8 and TUFI coating is intended to be a system. That system was intended to be used as a single product and we kind of have gone away from that and looked at applying that TUFI, which we really refer to it primarily as a coating and not an article, and we're looking to apply that material to another substrate per se that allows us to utilize this in different locations.

DR. LOGSDON: Let me see if I can reconstruct and understand something you said early on in your presentation, which is that most of the integrator damage to tiles that you've seen has happened on ascent and, since the vehicle has survived successfully re-entry, you do not treat these as flight safety issues but as maintenance issues. Is that a fair summary of what you said?

MR. BELL: These are ascent impacts that we have no control over fixing them on orbit, from the standpoint of when these parts get back to Kennedy Space Center, whether that's through Edwards or landing directly, it is an operations issue to have to do and deal with the maintenance associated with that. We have a baseline of impacts that we have seen historically that fall into that category.

DR. LOGSDON: Even though you have a stated requirement of zero impacts, that's at this point kind of irrelevant to reality. The baseline is 30 or so inch impacts expected per mission and a judgment that that's acceptable.

MR. BELL: That judgment is probably not one that I should address. All I can tell you is what we've dealt with from a typical standpoint as far as operations go, and you've seen the numbers and that's demonstrated to have been, looks like, my interpretation, something that has been longstanding.

MR. WALLACE: As we've learned a lot about the shuttle system, even the parts of it that may have originally seemed fairly simple and straightforward turn out to be very, very complex; and we talked this morning earlier, as witness, Mr. Blomberg, about incremental improvements. My question is if you were to design -- let's just assume that we're going to build a space shuttle again that's going to be essentially the same vehicle but we have a clean sheet of paper and today's technology to design the thermal protection system. Any general thoughts on what it might look like and if it might, in fact, be a lot simpler than what we have now? Either of you can answer that question.

MR. BELL: Let me take a stab first. The vehicles, as you see them, are in evolution. If you look at the vehicles and say that vehicle, that was the design originally -- there's been several iterations and changes to the vehicle through time. So as the TPS community, we continually make modifications and changes to improve both safety and operations.

Maintenance drivers, those changes occur continuously. And there are requests for changes on the books today that we will continue to pursue and you will see this vehicle evolve from what it is now. If we had to start from a clean slate, that allows us to do other things that we wouldn't necessarily have an opportunity to do, given our current configuration and some of our tiles.

Your specific question, I think, referenced the complexity of the design. Sitting here, thinking about the complexity of the design, I do not see any major changes unless you would start to approach the structural part of the vehicle and the way that the penetrations are originally designed that would benefit TPS necessarily. Certainly you'd have to integrate TPS into your design up front so that we are just not the insulation system going over a door. You'd have to design and think differently how you would approach the seals.

Let me give you an example. Maybe Gary's a better one to look at this. The chin panel is an add-on to the vehicle. The chin panel is an RCC component that attaches up -- it lays against the nose cap of the vehicle. That was an add-on. Well, the interface between those two components has created a gap-filler that is just very maintenance-driven for us; and certainly if we had the opportunity to start over, we would design that out, design a different interface there. But, you know, what we've got now is an evolution of TPS that you see. Is that a good synopsis, Gary?

MR. GRANT: To take a step back from like what Dan's saying, I think if we were to do something different, we'd look at the most maintenance-intensive areas from a standpoint of refurbishment and from the interface end. It would require more than just a change in the thermal protection system. So inputs that we have may also drive changes in the way that the penetrations, doors, or seals would function. But the chin panel is a good example and it may be something that we talk about. But at the time that that interface was designed, there was talk of putting another seal which would basically bridge those two together. Unfortunately the maintenance, you know, downfall wasn't seen in the future; but that would be a good example of something that we could change without causing another change to the rest of the function of the orbiter.

ADM. GEHMAN: Please go ahead, Gary.

MR. GRANT: Okay. So then we'll talk about the leading edge structural subsystem. Next slide, please. As Dan alluded to, although it is a subsystem unto itself, it is part of the overall thermal protection system of the orbiter. In this first slide, we talk about some of the basic requirements. It was put in areas where you do have the higher temperatures. So we've got multi- and single-mission limits that were posed to the design element. Part of it also is not just, of course, for example, on the wing leading edge to provide a shape there but, of course, you have to protect the internal also. So internal insulation is part of the design requirements.

Of course, being that most of the parts other than the aero head are on leading edge areas, the aerodynamic shape's important. The air foil shape needed to be maintained for flight; and also on these leading edges where we have the highest heating, it's roughness- and waviness-critical. The system needed to be able to distribute loads amongst the system itself and to the structure, the supporting structure.

The impact resistance. The main component or actually the only component that was really designed to withstand a very adverse impact was the forward ET attach plate, which actually in the original design was tiles, and then they ended up doing a functional test of the explosive bolt and found tile damage and this actually ended up being somewhat of an afterthought retrofit. RCC was already in place and in development for the nose cap and the wing leading edge. When we talk about impact resistance, that's the one element of our subsystem that was designed to take a known or expected heavy load or shock.

GEN. BARRY: Do you know what the measurement of that is? I understood it was like .006 foot pounds. Do you know that?

MR. GRANT: I think we might get to that. There's some slides that talk about the impact testing that was done in the development.

GEN. BARRY: Which was very small, by the way.

MR. GRANT: Yes. I guess the point is that impact resistance, you know, other than the forward ET, was more for foreseen handling damages and kind of rain impingement and bugs and things like that, as opposed to real protective shield. Then the last thing is that the parts being new and really not much of a way to test, they had to be certified by analysis; and in that process it's found that they are limited life, which in the orbiter, actually space transportation system, whatever element you're talking about, limited life or cycle means that it's not something that you can install and it's good for the hundred missions or 20,000 cycles it's going to see in its life.

ADM. GEHMAN: What does certification by analysis mean?

MR. GRANT: Well, these parts, you know, some of the portions were tested and rated at facilities and/or checks, but the actual parts themselves were not able to demonstrated on any other type of vehicle.

ADM. GEHMAN: All right.

DR. WIDNALL: I have a question. I don't know whether you're going to get to this later, but are you going to talk about things like the fatigue life of these panels and vibratory loads and things like that?

MR. GRANT: Yes. If we don't -- I mean, if the charts don't cover what you need. Then the final thing is that the parts need to be interchangeable.

Next slide, please. The LESS consists of more than the carbon. In the investigation and discussions, we've really focused on the RCC, reinforced carbon-carbon parts themselves. In the system there's a nose cap that has three expansion seals and five TEE seals to make up the nose cap assembly. The wing leading edge is made up of 22 panel seals sets per side, or 44 per orbiter. And as Dan mentioned, a chin panel was retrofitted on the panels. It was in an area where we ended up having a lot of tile and gap-filler rework, and this actually spans between the nose cap and leading edge of the nose landing gear door and the forward external tank attachment plates.

For the carbon to work, it has to have attachments, internal insulation to protect the structure that the parts are attached to, the attach fittings themselves; and then in all cases other than the external tank aero head, we have to be able to access our fasteners. So we use reusable surface insulation tiles and gap-fillers to make access panels. In general, the basic design goal was to provide thermal structural capabilities for the areas that exceeded 2300 degrees.

Next slide, please. Let's talk about the RCC now. In general, the makeup of the reinforced carbon-carbon, there's three breakdowns. So there's actually kind of two main ways of viewing it or two main entities. One is the actual load-carrying part itself, which is the carbon substrate. It's made up of a rayon fabric that's impregnated with great amounts of graphite and then there's a resonance used to help it lay up in a rigid fashion and then there's a very detailed three-stage process that's used to convert it to a carbon matrix. In and of itself, you could almost be complete with your parts right there except that we have an environment that is going to attack that substrate through oxidation. So that's where the silicone carbide coating and the TEOS and the other sealants come in. So the purpose for the silicone carbide coating is to protect the underlaying impregnated carbon fabric.

This is actually not a coating that's applied. It's actually a transformation. It's accomplished by a dry pack in a powder that's made up of silicone carbide, silicone, and aluminum powder. Ideally, our coating is about 20 to 30 mils thick. Of course, it gets thicker when you get to some of the sharp edge and the bends, just due to the geometry, the way the shape is.

Unfortunately, during the cool-down, due to the difference in the thermal expansion between the carbon substrate and the newly converted silicone carbide coating, there's a difference in the thermal expansion coefficients and the silicon carbide contracts more during the cooling and we get craze cracks, if you will, which affects the substrates, potential oxidation. So the next element, that's added to help this. First the TEOS is applied, which leaches down through the craze cracks into the carbon areas to help form a harden or another way of protecting the carbon substrate. Then once this is completed, a Type A sealant, as we call it, a glass sealant is applied which helps to fill in some of the craze crack areas also and, again, give additional oxidation protection. The early design had just a single application of this coating, and it was discovered about the time 105 was being built that actually a second application of this coating would be beneficial for mission life. So some of the 105 and then subsequent spare parts have actually a double Type A coating.

DR. WIDNALL: What's the density of the material?

MR. GRANT: You know, I don't have the actual number. It's, on the order of tiles, you know, magnitudes greater. I don't know the actual number of the density.

DR. WIDNALL: I mean, it's got to be a heavier density than tiles.

MR. GRANT: Yes. By magnitudes. Down at the bottom right, you see a typical acreage is on the order of a quarter-inch thick. Then as you transition to lug areas where the parts are actually attached or some of the areas where you get the curves due to an actual geometry change, you actually get quite a bit thicker. In some of the lug areas, you're close to a half an inch thick.

Next slide, please. This is a good snapshot at all the parts installed on the vehicle. Of course, we have the nose cap and associated seals. Behind this, there's a row of access tiles; and it actually allows us, if we need to, to change gap-fillers behind this area. The chin panel, which actually here you can see just the edge of it, access panels located out on the edges and then actually you reach through the nose landing gear door, which you barely see here, to reach in to get the attachments and then you get a view of the chin panel and the seals, just on the edge.

Up on the right, we see the wing leading edge panel attached to the ship. This actually is a photo of a 103, and so its configuration is a one-piece spar fitting. In another slide that's coming up, you actually see the two-piece spar that 102 had. But you get a good look at the leading edge rib of an RCC panel there. You can actually see many of the insulators and some of pieces we're looking at. The Koropon-coated spar is shown there.

Then the forward ET, actually you can see the forward ET attach point. This is evidently a post-flight photo on the runway. This is what that installation looks like on the runway, and there's actually an aft plate and then a forward plate and then that interfaces with the nose landing gear door.

Next slide, please. Here's a little more detail of the system itself. The nose cap is actually somewhat of a self-contained unit. The nose cap actually has its own bulkhead, own structural bulkhead, which is the nose cap and the seals. Internal insulation of the conic blankets, which you see a cross-section of here. Of course, it's attached by way of Inconel fittings to the actual nose cap bulkhead, which then the whole assembly is put onto the orbiter vehicle and attached to the forward fuselage structure. Interface panels which actually go all the way around and interface with the forward fuselage and then a bulkhead door which allows access into the nose cap and then the conic blanket internal insulation assemblies are actually broken down into four quadrants. And that's the way that you get those in and install them to the nose cap bulkhead itself. Next slide, please. Wing leading edge parts. You see here, sitting on the bench, a panel with attached T seals. This is a panel T seal set. You can see the attached lugs here. T seals are attached to the actual lug fittings on the panel, not directly to the ship.

As you can see, this is a cross-section. The purple is the RCC itself. Upper access panels that allow us to get to the -- these attach points here. Upper panel. Lower access panel shown and installed here, which again allow us to get to the attach fittings.

The spar fittings -- and this picture here does show the 102 configuration. There's a separate upper and a lower spar fitting, and those are shown by red in the sketch here. Then once everything's installed and complete, before access panels are put on, the spar insulation in the different -- the earmuff insulators here -- again, this is 102 configuration -- actually go over and cover the spar fittings so that once everything's completed on the internal, all parts are protected from radiation.

DR. WIDNALL: Are you going to talk about any structural testing that was done on these RCC panels?

MR. GRANT: I think the slides that we'll talk about have some of the impact testing. I don't know --

DR. WIDNALL: Well, let me just ask a question. Are you surprised? The thing that surprised me about it is that in recovering the debris, we found half of the RCC panels. In other words, they broke at the center. Now, looking at that, I'm asking myself, if I grabbed ahold of that panel and, you know, pulled it out, where would it break? The rib is a little thinner in the center. I mean, do you have an understanding? When you saw that debris, did you say, uh-huh, or are you as confused as I am about why they broke where they broke?

MR. GRANT: I think the loads those parts saw -- you know, I don't think it's surprising that they broke there; and one of the things that we saw the parts, you know, broke at the lugs, too.

DR. WIDNALL: That's fine; but, I mean, really every single panel we have is broken at the leading edge.

MR. GRANT: Yes. You know, if you notice, we don't have any -- we have some T seals or gap seals --

DR. WIDNALL: Right, but I'm talking about the big panels.

MR. GRANT: -- in somewhat good condition, but the panels themselves, I don't know that any of them --

DR. WIDNALL: Well, we have a lot of half-panels. Half.

MR. GRANT: Yes. You know, I don't have that specific information. I know there had to have been compressive and stress testing, and that's something that I could take an action and make sure you see that data.

DR. WIDNALL: I'd be interested in that.

DR. OSHEROFF: This is pursuant to Sheila's question. Certainly looking at the debris, it was my impression that a lot of these things had to have been broken. They didn't break upon striking the ground.

DR. WIDNALL: No, I don't think so.

DR. OSHEROFF: Well, part of it at least was still attached to the wing. That seems to be more -- because you could see that there would be spatter on one half and not on the other half.

MR. GRANT: Well, I've been somewhat involved in the reconstruction. One of the things that we tried to not do -- I mean, other than, like the doctor was saying, you know, of course, thoughts are running through your mind -- but we've specifically tried not to speculate on where did they find these parts -- you know, "Oh, my God, this is the one right here." We really tried to systematically place them; and, as you know, it's an important part of investigation to make sure we get the correct parts correctly located on the floor.

In general, observation-wise, I've personally seen very few parts that show a lot of ablation to the actual substrate. I mean, it's really impossible to speculate as to when they broke; but a lot of them, I'm not seeing a degradation of that, the carbon and the fabric substrate that you would see, you know, had it broken early in the re-entry attempt.

ADM. GEHMAN: Why don't you go ahead.

MR. GRANT: So I think this covers the basic assembly of the wing leading edge system. Next slide, please. The parts were procured to a spec that was developed through NASA and the vendor. Performance is that they should be structurally sound, maintain a positive margin of safety -- which, of course, the factor of safety baseline is 1.4 -- be able to withstand 100 missions with minimum refurbishment and replacement, be able to withstand rain impingement. Physically the system, the goal was 1699 pounds. Of course, you had to maintain and be able to have step-and-gap control adjustment, which is built into the design; and the surface roughness within any part had to be less than the figure shown there.

Impact resistance was really more of a goal from the standpoint of, you know, if you talked to the vendor today, their biggest concern is handling damages on these. So, in general, the goal there was to create some type of impact resistance if somebody dropped a nut or a wrench or some of the things that would happen in normal processing -- other than, like I mentioned before, providing a protective shield. The maintainability. The visual inspection would give you clues into any concerns you have with the parts. Part removal should be somewhat straightforward and simple and shouldn't take very long. Less than 15 minutes was used as a number. And again, that they should be interchangeable. Predicted temperatures that were presented to critical design review in March of '77 showed the maximum temperatures on the nose cap were around 2500 degrees and, wing leading edge, 2600. On the panels, the gap seals actually are a little bit hotter at 2800, close to 2900 degrees.

GEN. BARRY: Can you go back a slide, please? The 100 missions. My understanding is that certain panels are a lot lower than that, like Panel No. 9 on the lower part is only cleared to 50.

MR. GRANT: That's correct. So part of what's integrated here is that, you know, your spares or your extra parts on hand actually are necessary to help you achieve that. I mean, obviously the design for the orbiter was 100 missions. So the reality of the RCC and the leading edge structural subsystem was that individual parts -- you know, one part, without being replaced, was not going to get you there.

GEN. BARRY: That's an appreciation for, I guess, an analysis that has been subsequent to the original design spec that you've concluded that, okay, for 9. Then it varies, too. I mean, 10, I think, is 63; and then it goes out and gets to 100 on the outer.

MR. GRANT: Yes.

GEN. BARRY: Let me ask you a question on mass loss. There is mass loss to these RCCs over time.

MR. GRANT: Yes.

GEN. BARRY: Okay. Can you talk a little about that and how we talk about ageing? I mean, there is an effect over time on these RCCs.

MR. GRANT: Yes. Well, actually the early mission lives on these parts was quite a bit lower than what you've seen in our current requirements. Initially the Type A sealant was not a part of the system; and then once the sealant was added and then the double Type A was added, we actually began to get the parts to where they were more robust. Then since then we've had to go through performance enhancements and different types of things where the capabilities of the orbiter were expanded. So, you know, over time those things tended to jostle around the actual mission life itself. So initially the flight lives were actually a little lower than what you had -- I'm sorry, what was the question again?

GEN. BARRY: Well, I guess it really comes down to the fact --

MR. GRANT: Talking about mass loss.

GEN. BARRY: The RCC's a quarter of an inch thick.

MR. GRANT: Yes.

GEN. BARRY: I mean, if you add the Type A sealant, the TEOS, of course, the substrate, the silicone carbide. Now we introduce mass loss of about .003 pounds per square foot, right? The thing is how do you measure this ageing, you know, for the mass loss?

MR. GRANT: Well, what we've done over time -- the biggest thing that we have that really corroborates some of the assessments on that is destructive tests that we've done, and we're able to take a look at that. Mass loss, of course, is related to oxidation; and in looking at that, one of the things that came out of some of those early destructive tests was the sealant refurbishment which we have instituted. I think it was around the 1992 time frame where every other LMDP on the wing leading edge panels that are in the areas where you have the highest convective mass loss get their sealant refurbished, in a sense, really kind of reset those parts in the way of having a higher resistance to the convective mass loss.

I think one of the backup charts I have shows, if you never do a seal quantity refurbishment, how that mass loss increases with time. As you do it, it actually brings that number back down, not quite to the design but a lot to something that's manageable. And our every other LMDP effectivity that we have on that's actually a little bit conservative by a few flights.

So I guess the destructive tests and the evaluations on the parts that we've had -- and most of the models that were used to predict the actual life, you know, using the extrapolation of the mass loss, were very conservative. The trajectories that were used for those -- like the initial flight lives are using abort trajectory, which, of course -- you know, and they basically ran a hundred abort trajectories. So that's very conservative to what we're actually flying, which is normal mission with a re-entry.

ADM. GEHMAN: At KSC, do you do any acceptance testings of the parts from the vendors to see if they meet these criteria?

MR. GRANT: Well, they have this procurement spec that's something that they are held to and that we are, too. The actual receiving and inspection is something that's done in the logistics area. So from an engineering standpoint, you know, we would do our normal maintenance inspections before parts are installed; but we don't actually make a decision to accept the part. Obviously if we saw something that concerned us that may have --

ADM. GEHMAN: Obviously. So to pursue the business of the acceptance inspection, we've got to pursue that someplace else. Dr. Logsdon had a question.

DR. LOGSDON: Just a quick question. A couple of weeks ago, ten days ago, there was some suggestion in some press accounts of the primer from the launch tower having an oxidation effect on the RCC. Did you, in fact, see evidence of that?

MR. GRANT: Specifically on Columbia?

DR. LOGSDON: No. In general.

MR. GRANT: Yes. I guess that's something that we eventually would have gotten to. You're referring to the pinholes. When we first saw the phenomenon, we obviously didn't know what we were dealing with; but through quite a bit of time, study, tracking these, we were very concerned about them. We spent hours and hours looking at them, mapping them, measuring them, just dissecting them every which way you could. We were trying to narrow in on there was a point in time -- and I believe it was STS 50 -- where from that point on we found them, we found them only on certain parts, and we somewhat -- you know, trying to find a cause for this, we ended up finding out that there was a change to the way that the pad was being refurbished. And I think some of the other members of the board that have been in contact with us have quite extensive reports on this. But we found there was a zinc-based primer that was being used and then an overcoat -- and I'm not familiar with the materials on it. But at that time the change was to not apply that overcoat. And the zinc was one of the elements that we were finding in the glass deposits that were coming out of these pinholes, so to speak.

So basically what happens, the zinc does break down the matrix of the silicone carbide and actually gives us a little path down; and the nature of it, too, is that it follows the paths of the craze cracks and imperfections. So it's not necessarily a straight hole down in, once we actually took some destructive tests. But the zinc was the key to us actually linking it to what had changed on the pad. But that fell into line with all the other findings that we didn't really see them on the nose cap or chin panels and it was in the wing leading edge in certain areas that were covered by the rain protection.

DR. LOGSDON: Have you done anything about that?

MR. GRANT: The procedure to the pad or --

DR. LOGSDON: No, the --

MR. GRANT: To the parts.

DR. LOGSDON: Have we covered the primer?

MR. GRANT: So, I mean, are you talking about to our parts?

DR. LOGSDON: The launch pad.

MR. GRANT: Yes. At that time -- and I don't have the information -- but we were able to get in touch with the facilities crew and basically the procedure was changed again. And as we continued to analyze and track the parts, the pinholes, they actually formed somewhat of a glass coating down the actual path that leads to the substrate, which actually gives, itself, some protection to oxidation. So we've done quite a bit of studying and set criteria for the size of the pinholes that are acceptable and the cycle time that we review them.

DR. LOGSDON: My question was: Have you now painted the launch pad to cover the primer?

MR. GRANT: Yes. Once that was identified positively as a source, that was immediately taken care of.

DR. OSHEROFF: Can you estimate how much mass loss occurred as a result of oxidation due to the pinholes?

MR. GRANT: The actual oxidation is preferential to the silicone carbide and carbon substrate interface. So what we've found in the few that we've seen that actually go down to the substrate, because that pinhole actually forms a glass coating around it, what we're concerned about is the oxidation that would actually separate the coating from the substrate itself. So because of that glass lining, so to speak, it somewhat protects those edges from actually getting the attack that we're concerned about.

ADM. GEHMAN: I didn't hear an answer to the question there. Have you ever measured the mass loss?

MR. GRANT: Well, what we've seen is that we are not getting any additional attacking of the interface of the silicone carbide to the carbon, based on the pinholes. That's one of the reasons why we go and do a sealant refurbishment, which somewhat fills in that pinhole temporarily; but once the zinc is present in that matrix, it's impossible to get it actually removed.

GEN. BARRY: But right now you're doing that visually.

MR. GRANT: Yes.

GEN. BARRY: The board is very interested, of course, in further NDI, you know, to get verification on what that mass loss would be, and not just do it on a visual indication, to be able to look down there and see if there are voids underneath those pinholes to see if, in fact, there has been, in the admiral's term, the termites that have dug holes underneath there.

ADM. GEHMAN: Why don't we go ahead. We're a little bit over time here.

MR. GRANT: Next slide, please. This shows a predicted trajectory temperature pressure curve for a space station mission, one showing wing leading edge Panel 9, which is our highest-temperature wing leading edge panel, and the nose cap, which itself is a very high-temperature part.

Next slide, please. The design allowables for impact resistance. A test was performed. LTV is the vendor for the parts. Tests were done with a spherical steel ball; and for a typical 19-ply acreage area, it was found that the threshold for not seeing cracks or damage to the coating or substrate was 1.4 foot pounds, which is approximately the 16-inch pound design goal that they had.

There were hypervelocity impacts that was done in '77. They used nylon cylinders and glass spheres and, again, the lower-energy impacts produced some front face damage, the higher energy produced a front and back face damage, and the glass spheres only produced front face damage. Next slide, please. Ice impact tests were performed at Southwest Research and, as you can see, again, as the energy goes up, you start to get cracks into the coating and then, finally, at a high enough energy, the specimens were actually destroyed. The low-velocity impact tests are probably the most consistent or useful data, and these are actually things that are used when we have concerns on damage that may create a hole in a panel or whatever. But the results here, again you see, as you get the higher energy, you get damage to the front and rear face. And with the lower energy, you get some damage to the coating on the outside.

Next slide, please. A low-velocity impact test was performed on a right-hand Panel No. 10, which was actually a panel that we did sustain a couple of impact damages while we were on orbit. Once it was removed, there were tests done by Rockwell and NASA on this. The Rockwell tests used a BB and a lead bullet. The idea there was to kind of demonstrate the effect of the hardness of whatever the projectile was. The lead, of course, is soft, did not produce any damage; and the BB actually saw front and rear damage to this panel.

Next slide, please. Some of the issues that we've had over the years. This panel that I alluded to, the 104, STS 45, we actually sustained two damages on the upper surface of this panel. An evaluation was done to determine, you know, the micrometeoroid orbital debris effects. Concern, of course, is that a potential such damage could actually create a hole in the RCC panel which would very quickly compromise your wing spar. Of course, the burn-through would be a potential loss of crew and vehicle.

The resolution was that a study was done to enhance the internal insulation and to provide a little more margin there, where if you actually had a hole that was a quarter inch or smaller, although the hole would grow during re-entry, your cavity heating would increase, but the actual spar itself would remain protected by a more robust internal. Inside the Inconel foil, there's actually some fabric, high-temperature glass fabric layers that were added to essentially just give you enough margin to return safely. That's one of the things that came out of that actual event.

Next slide, please. I think we have some pictures of it. Actual pictures of the OML or the outer mold line and then the underlying damage. On the left you see what's called Impact 1 here. It's about 2 inches by an inch and a half wide. And then an associated back face damage, which you can barely see some of the cracking that happened on the back face. On this side, this edge is a little stronger since it's close to an actual rib of the panel. Damage wasn't very big on the front; but then the actual back face, some of the coating actually was dislodged there.

Next slide, please. This demonstrates some of the pieces that were used for the testing. Of course, with a quarter-inch hole, we're trying to provide -- just a little bit extra protection here. So some specimens were created with a hole of such size. You see what the hole grew to and you see what the actual -- this is the material that's used that covers the internal insulators. And this has the Nextel fabric around it and you can see at the end of the test, you actually still had some protection there. Next slide, please.

That's it.

ADM. GEHMAN: In one of your first viewgraphs up there where you showed the cross-section of the RCC wing leading edge panel, you referred to the matrix and then the way the outer few mils are treated to provide -- your viewgraph said that the carbon is there for the strength and the outer piece is there for the protection. We mentioned oxidation, but is it correct to characterize the outer treatment also as the major part of the thermal protection also?

MR. GRANT: No. Again, the --

ADM. GEHMAN: The whole thing is for the thermal protection.

MR. GRANT: To protect for oxidation, yes.

ADM. GEHMAN: For what?

MR. GRANT: Well, the primary elements that actually provide the thermal protection to the orbiter are the internal components that protect the wing leading edge spar from the radiation of the parts. The parts themselves, since they can sustain temperatures up to, you know, 3,000 degrees, the parts themselves, you know, that coating is not the primary protection for the actual RCC.

ADM. GEHMAN: Unlike the tiles, which are nearly perfect radiators, the RCC is not.

MR. GRANT: Yes.

ADM. GEHMAN: It's just supposed to take the heat and stay structurally intact.

MR. GRANT: Yes. That's correct.

DR. WIDNALL: You actually didn't say very much about the requirement, the fatigue requirement and how that was tested, what the requirement actually was in terms of vibration levels or whatever. I recognize you don't have that on slides, but I'd be very interested to see the kinds of requirements that were set for basically the fatigue life of the panels in that environment.

MR. GRANT: Okay. You know, the details on the type of cycle testing, obviously the parts were designed to withstand the thermal, vibroacoustic, all the stress. So all those environments, you know, were things that the parts were designed for; and I'd have to get that.

DR. WIDNALL: I'd be interested in knowing what that was.

ADM. GEHMAN: Anybody else? All right. Gentlemen, thank you very much. Your depth of knowledge on this is very impressive; and we appreciate you bearing with us as we work our way through this. I know you want to get to the bottom of this as much as we do, and we thank you for dialoguing with us and being patient with us as we work our way through this. You've been very helpful.

Thank you very much.

Okay. We are finished. We're going to have a press conference right here in 30 minutes.

(Hearing concluded at 12:28 p.m.)

Back to Event