Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter.
Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.
OCR for page 37
NATIONAL RESEARCH COUNCIL
COMMISSION ON ENGINEERING AND TECHNICAL SYSTEMS
2101 Constitution Avenue Washington, D. C. 20418
COMMITTEE ON NASA SCIENTIFIC
AND TECHNOLOGICAL PROGRAM REVIEWS
Panel on Redesign of Space Shuttle
Solid Rocket Booster
March 17, 1988
The Honorable James C. Fletcher
Administrator
National Aeronautics and Space Administration
400 Maryland Avenue, S.W., Room 7137
Washington, D.C. 20546
Dear Jim:
I am pleased to submit herewith the sixth interim report
of the National Research Counci1's Panel for the Technical
Evaluation of NASA's Redesign of the Space Shuttle Solid
Rocket Booster.
Since our last report, the Panel has conducted three
meetings and some of our members have attended the DM-9 Test
Readiness Review, one run of the Assembly Test Article, three
meetings of the Outer Boot Ring Anomaly investigation team,
and the SRM Critical Design Review Level ITI preboard and
board meetings. I also presented a testimony on the progress
of the redesign effort to the Senate Subcommittee on Science,
Technology, and Space on February 16th.
The Test Program
The test program has entered the critical certification
phase; with test articles and the components of the first set
of flight hardware already manufactured and no slack time in
the program, the remaining tests will have to proceed essen-
tia1ly perfectly if the target date for the return to flight
is to be met.
We concur with the decision to conduct three additional
fulI-sca~e, full-duration motor firings before the return to
flight, i.e., Qualification Motors #6 and #7 (QM-6, QM-7) and
the so-called Production Verification Motor (P~M). In par-
ticular, the PVM will provide the only test in the program to
verify the performance of the primary pressure seals in the
case field joint and case-to~nozzle joint throughout the motor
37
The National Research Council is the principal operating agency of the National Academy of Sciences and the National Academy of Engineering
to serve government and other organizations
OCR for page 38
Letter to the Honorable James C. Fletcher
—2—
burn; we believe that this test is essential to the certifi-
cati on o f the design . The results of the test, including
assessments of the performance of the j oints that are inten-
tionally modif fed to assure pressurization of the primary
O-rings, must be available for review before the return to
fl ight. We also agree that the fu~i-scale, ful1-duration low
ambient temperature qualification motor test (QM-8) can occur
af ter the return to flight provided that the test i s conducted
before the f irst launch at low ambient temperature.
The Nozzle Outer Boot Ring. A1 though the motor used in the
DM-9 test might have resulted in a successful flight, the
structural performance of its outer boot ring was unsatis-
factory. Post-test examination revealed that the margins of
safety for both the structural and thermal properties of the
DM-9 outer boot ring (involute design) were intolerably
small. It is our understanding that the exact causes of the
unsatisfactory performance are still to be determined. The
needs now are to (a) understand the reasons for the poor
thermal and structural behavior of the involute design and (b)
determine whether these reasons are applicable to the alterna-
tive, structural support design that is now baselined for
flight. Any anomalous behavior of nozzle parts should be
understood and corrective action taken if necessary before
committing to flight.
The structural support design will be subjected to test in
the three additional static motor firings before the return to
flight. It should be noted, however, that as a consequence of
the detailed investigation of the DM-9 result, fewer data are
currently available on the structural support design than on
the involute. Almost all of the confidence in the structural
support boot ring arises from the DM-8 test, which was less
demanding than the DM-9 test, and from the experience with the
design flown in previous Shuttle flights, from which the con-
cept of the structural support outer boot ring has evolved.
The DM-9 result illustrates that coupon data are insuf-
ficient for predicting the failure modes and characteristics
of composite structures for design purposes. Even though the
carbon cloth pheno~ic materials used in the two outer boot
ring designs are ostensibly the same based on coupon tests and
chemistry, the performance of the parts depends strongly on
their internal geometrical configurations and fabrication
procedures. The results of future full-scale tests of the
outer boot ring should be assessed from a sound and adequate
base of data from laboratory tests and in-process inspections.
38
OCR for page 39
Letter to the Honorable James C. Fletcher
—3—
The criteria for successful testing of the outer boot ring
should be established before QM-6 is fired. We believe that
test criteria should derive from design requirements. It is
our understanding that the outer boot ring/flexible boot
assembly is designed to prevent thermal damage to the flexible
bearing. If that is the case, then suitable criteria would be
expressed in terms of permissible damage (delamination,
fracture, erosion, etc.) or the conditions needed to preclude
damage to the bearing that would disqualify it for subsequent
use.
Thrust Vector Control Duty Cycles. The duty cycle of the
thrust vector control (TVC) system in the DM-9 test has been
suggested as a potential contributing factor to failure of the
outer boot ring in that test. We believe that the TIC duty
cycles used in static motor tests should be realistic but
should be significantly more severe than those experienced in
flight to demonstrate the margins in the design. Since the
largest mismatch between the thrusts of flight boosters is
likely to occur during the last 10 seconds of motor operation,
the largest angular deflections in nozzle tests should be
imposed early during that period.
Hydroburst Tests. A case hydroburst test was recently deleted
from the program. We recommend that the test be reinstated to
demonstrate the performance not only of the baseline design
but also of recently manufactured case material qualified to
current processes. The test can and should be completed
before the return to flight without introducing delays. In
addition, a second hydroburst test should be conducted after
flights resume in which flight-qualified hardware is subjected
to repeated cycles of assembly, pressurization, and disassem-
bly to simulate 20 uses before being burst. In the latter
test, the case segments should be examined between cycles to
monitor performance.
Requirements
The interpretations of several important design require-
ments are as yet unresolved. The manner in which they are
resolved can have significant effects on the program, particu-
larly in light of the limited amount of testing that can be
accomplished before the next flight.
Seal Systems. The program requirements specify that each
pressure vessel leak path shall have redundant, verifiable
seals and that each seal shall provide independent sealing
39
OCR for page 40
Letter to the Honorable James C. Fletcher
-4-
capabi~ity throughout the motor burn without evidence of
blow-by or erosion. Questions have been raised about the
interpretation of the requirement in the development of
criteria for success of tests in which the design has been
intentionally flawed. Three types of tests are envisioned:
of flight design motors, of joints with intentional flaws to
simulate defects that might occur in manufacturing or assem-
bly, and of joints that have been modified to study the
performance of specific seals.
First, the success criterion for tests of joint systems
without any intentionally introduced defects must be the re-
quirement itself, no erosion or blow-by of seals, since these
joint systems are of the flight design. These joints would
only be tested if they passed post-assemb~y leak checks. We
conclude that the same criterion should also apply in tests
where joints are flawed in such a way that the flaws are not
detectable by leak checks (the so-called manufacturing flaws),
since flight articles must be able to accommodate this type of
defect. This type of defect will be introduced into joints in
QM-6 as well as on several short-duration test articles.
Third, tests that incorporate modifications of the hard-
ware to assure that motor gas pressure reaches either the
primary or secondary seal (the so-called pressure-assuring
flaws) are intended to verify that the pressure seals will
work if and when called upon. In our view, these tests, in
which the seals will not pass leak checks, are essential for
certifying the design. We agree with the viewpoint, expressed
by some within the program, that the success criteria for
these tests, including the PVM, need not be the same as those
for tests of the flight design since the test hardware must be
significantly modified from the flight design in the pressure-
assuring tests. We conclude that an appropriate success
criterion in the later tests might allow some erosion of the
seal under test but should prohibit leakage past it. Thus, in
tests where modifications are introduced to assure pressure to
the primary O-ring, there should be no leakage past the pri-
mary O-ring and no erosion of or leakage past the secondary
O-ring.
Reuse of Motor Cases. The current requirement specifies that
,
case segments shall be designed for 20 uses. Currently, data
are not available from which to judge whether the require-
ment will be met. Dimensional control in the area of the
field joint interference fit may prove to be very difficult to
achieve after a number of reuse cycles. In light of the
uncertainties about reuse and because the lead time to obtain
40
OCR for page 41
Letter to the Honorable James C. Fletcher
additional new cases is long, it is essential for both safety
and maintenance of the schedule of future flights that a
practical program to determine the realistic reuse potential
of case segments be completed as soon as possible. The pro-
gram should include the second of the hydroburst tests
recommended earlier.
Grease. The requirements for reuse, surface finish, and other
considerations argue for the liberal use of the corrosion-
preventive grease. Liberal applications of grease, however,
make it more difficult to satisfy the requirement for veri-
fication of pressure seals after assembly, since the grease
may mask small leaks. The masking effect may, in fact, be
beneficial; other rocket motor systems intentionally rely on
liberal applications of grease to assist in the sealing func-
tion. In view of the clear benefit of corrosion protection,
potential benefit of assisting in the sealing function, and
uncertain arguments concerning the detection of small leaks,
we conclude that in resolving the conflicting implications of
the requirements for the design, priority should be given to
assuring that liberal amounts of grease are applied to the
O-rings.
Storage/Ag~ng. The requirements also specify that motor
segments must be usable after storage for five years. The
motor contains a large number of polymeric/composite com-
ponents; examples are the J-seal insulation and the case-to-
nozz~e joint insulation protecting the O-rings, the flexible
boot and bearing, and the propellant. Materials such as these
are subject to changes in properties due to aging during
storage, changes that can be irreversible. Except for the
propellant, the current program appears to be inadequate for
understanding the aging of these materials and how aging
characteristics under practical storage conditions influence
the dimensional or other requirements on the polymeric parts.
Control of Materials and Processes
As we have stated previously, next to the design itself,
the most important determinant of success, not only for the
return to flight but throughout the flight program, will be
assurance of the quality of materials, manufacturing, and
assembly of motor components. Defining and maintaining the
essential controls on materials and processes is critical to
the reliability of the booster especially because the flight
article itself cannot be test fired before use. Installation
of environmental controls in the Vehicle Assembly Building at
41
OCR for page 42
Letter to the Honorable James C. Fletcher
—6—
Kennedy Space Center represents an important improvement in
controlling cleanliness for bonding, repair of debonds, and
protection of components. We note below three additional
areas where further attention is needed.
First, when lack of bonding occurs between the insulation
and case, it is usually attributed to contamination of the
surface with grease. For large debonds, a procedure has been
specified for repair. We suggest that NASA qualify the proce-
dure using realistic laboratory specimens to be sure that the
technique for repairing defects does not inadvertently weaken
the bonds.
A second area is the assembly of the case-to-nozzle joint
while avoiding or controlling the occurrence of flaws in the
polysulfide adhesive caused by trapped gas bubbles. A series
of tests is being conducted to characterize the formation of
these flaws and if possible to develop means for preventing
them. The tests should include evaluation of the charac-
teristics of the adhesive as well as procedures for its
application that minimize or eliminate the occurrence of
voids. The objective should be to establish appropriate
controls on the materials, processes, and environment for
assembly of this joint.
The third area concerns the insulation barriers in the
case field joint and case-to-nozzle joint. Both employ an
interference fit at the mating surfaces of rubber parts as
well as open slots elsewhere so that the motor pressure will
act to press the parts together. The dimensional tolerances
and materials properties of the rubber parts are important for
assuring proper joining. The case field joint insulation cur-
rently is accepted as a "product of the mold," of which there
are six. The dimensions of molded parts can vary signifi-
cantly, however. Therefore, we recommend that these parts be
accepted based on "inspection to dimensions," the tolerances
for which are determined to assure appropriate interference
fits and adequately open slots. The desirable material
properties of the components of the joint should also be
defined and controlled.
Continuing Development and Product Improvement
The objective of the redesign effort is to return a safer
and more reliable Shuttle to service at the earliest possible
date. Safety and reliability, however, are not absolutes.
The desire to provide the safest and most reliable design can
conflict with the desire to return to flight as soon as
possible. NASA has to make judgments about whether additional
42
OCR for page 43
Letter to the Honorable James C. F1 etcher
—7—
improvements are worth the delays in the return to service
that they imply. F1ying the Shuttle or any other space
transportation vehicle will always entail accepting some
risks.
Thus far, we find no evidence that the redesign team has
taken or Will be taking undue risks in favor of an earlier
return to flight. However, in this as in other large aero-
space systems, schedule and budgetary constraints have
affected the program so that the risks associated with the
first flight of the redesigned SRB, while acceptable, will be
higher than if the program were not so constrained. It should
not be necessary to continue to incur this additional level of
risk throughout the service of the redesigned SRB, however, if
there were a program of continuing development and product
improvement beyond flight testing.
Maintaining such a program through the operational phases
of aeronautical and space systems, in fact of any complex
technological system, is simply prudent practice. The purpose
is to improve not only reliability and hence safety, but also
performance and cost on the basis of ground test data, analy-
sis, manufacturing and operational experience. Such a program
permits tracking and improving design features, materials, and
processes that are identified as potential problems. This
kind of program is particularly important for the SRB because
of the complexity of the system, limitations on the testing
program, and the national importance of reliable operation.
The nature of the SRB is such that only flight subjects all of
its components to realistic environments. Thus, the first few
flights, which will be subjected to a more intensive scrutiny
than later flights, should provide much data useful for
defining and reducing risks.
We believe that it is essential that NASA have in place an
appropriately staffed and funded program for planning and
implementing a continuing development program, including
provision for the requisite ground tests and determination of
flight performance; the means to analyze results, upgrade and
evaluate designs; and provision to introduce risk-reducing
improvements into flight hardware and operations. An impor-
tant result of a continuing development and product improve-
ment program wit ~ be an increased understanding of the
capabilities of the SRB, leading in turn perhaps to lower
operational costs. We recommended such a program in previous
reports.
Have ng such a program requires advanced planning, which
shout ~ begin now if it is to be effective. The program should
have continuity with the technical efforts of the redesign
43
OCR for page 44
Letter to the Honorable James C. Fletcher
—8—
program and should include dedicated personnel, continued
development of analytical and computational capabilities,
continued use of appropriate subscale and short-duration test
facilities, full utilization of all currently planned ground
firings, and provision for use of selected flight instrumen-
tation after the sixth flight of the redesigned SRM. In those
instances in which the element under consideration affects
safety, it is essential that the program incorporate a plan
for certification and adoption of modified designs, materials,
or processes on a timely basis.
Critical Design Review
As we understand it, the Critical Design Review (CDR) is
conducted to assure that the design meets the requirements.
In the current instance, the timing of the CDR was unusual
because the first flight set had already been built. Thus, it
seems unlikely that this CDR would result in a change in the
design, except in the unexpected event that an egregious error
were discovered. The plan for verifying that the design meets
the requirements was also considered in the CDR, and its
review was more timely.
The CDR process is designed to assure that no member of
the review team is inhibited from raising issues that he or
she believes to be important. While this objective is
laudable, it also plays a role in the major weakness of the
process: There appears to be no means for assuring that the
CDR board deals in sufficient depth with the most important
questions.
The board considers only the recommendations of reviewers
that have not been resolved in the several review teams or by
the preboard. Some of these may have been important, but a
number of issues brought to the board appeared to be of ques-
tionable overall importance. Almost all requests for addi-
tional studies, tests, or analyses were approved; which ones
must be completed before return to flight remains to be
determined. Whether many of the others will ever be done
8 e
remains uncertain.
It appears to us that issues of critical importance to the
program may often be agreed and resolved at a lower level in
the review thus escaping the proper attention of the board.
Lower level reviews should concentrate on the less critical
items with higher level reviews concentrating on the more
important issues, whether or not the issues are contro-
versial. We recommend that NASA reconsider future review
board procedures to assure that the board formally considers
and concentrates on the issues of highest priority.
44
OCR for page 45
Letter to the Honorable James C. Fletcher
;..
_ 9 _
In our second interim report, we commented on the lack of
a clear separation of organizational responsibility for
defining requirements, making design choices, and conducting
design reviews. Based on the observations of members of the
Panel who attended the recent Level III SRM CDR preboard and
board meetings, we could not distinguish the differences
between the roles of NASA Level III and those of its contrac-
tor in the preboard meeting nor was it clear that the par-
ticipation of NASA Level II in either the preboard or board
meetings thus far has assured an independent review. The
current observations confirm our earlier comment.
we c onc lude . however . that the CDR has provided an
essential forum For 1uentltylng and airing issues that may be
considered unresolved at this time. The atmosphere at both
meetings encouraged free and open discussion. There was
obviously considerable effort to be impartial, treating all
comments fairly.
In closing, ~ wish again to
the cooperation of the redesign
in conducting our activities.
cc: Adm. Richard H. Truly
Panel Members
45
_
The atmosphere at
express our appreciation for
team and other NASA personnel
Sincerely,
H. Guyford Stever
Chairman
OCR for page 46
Representative terms from entire chapter:
boot ring
