Click for next page ( 48


The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 47
NATIONAL RESEARCH COUNCIL COMMISSION ON ENGINEERING AND TECHNICAL SYSTEMS 2101 Constitution Avenue Washington, D. C. 20418 COMMITTEE ON NASA SCIENTIFIC AND TECHNOLOGICAL PROGRAM REVIEWS Panel on Redesign of Space Shuttle Solid Rocket Booster September 9, 1988 The Honorable James C. Fletcher Administrator National Aeronautics and Space Administration 400 Maryland Avenue, S.W., Room 7137 Washington, D.C. 20546 Dear Jim: I am pleased to submit herewith the seventh interim report of the National Research Council's Panel for the Technical Evaluation of NASA's Redesign of the Space Shuttle Solid Rocket Booster. The preflight program for testing the redesigned solid rocket booster has been completed and the Shuttle is expected to be returned to service soon. This report provides our assessment of the new design and its certification program, including production and quality control issues, and our findings on the status of the program at this time. Our conclusions are based on engineering judgment and the results of tests, the number of which has been necessarily small. Since our last report, the Panel has conducted four formal meetings and members of the Panel have attended a number of test readiness reviews; the QM-6, QM-7, and PVM-1 static tests; technical interchange meetings on the outer boot ring, aft skirt, and insulation debond problem; the design certi- fication review' and an inspection of the stacked boosters to be used in the next flight (STS-26~. I also presented testi- mony on the progress of the redesign effort to the Senate Appropriations Subcommittee on HUD and Independent Agencies on June 8th. Since June 1986 the Panel has participated in or observed more than 90 meetings, reviews, site visits, and tests and I have testified before the Congress on four occasions. Assessment of the Redesigned SRB Approach of the Redesign. The redesign program was organized to concentrate its resources on a "baseline" design, thereby avoiding a dilution of effort in both the design and testing 47 The National Research Council is the principal operating agency of the National Academy of Sciences and the National Academy of Engineering to serve government and other organizations

OCR for page 47
Letter to the Honorable James C. Fletcher 2 phases. The redesign was alto constrained to make maximum use of existing or previously ordered hardware, owing to the long time it takes to acquire new cases. The consequences of these restraints were: (1) With few exceptions, no alternative design of a major component was carried to full-scale, full-duration testing. The principal exception, an alternative design for the nozzle outer boot ring, turned out to be needed and, because it was available, many months of delay were avoided when the original baseline design failed in the DM-9 static test. (2) The development effort aimed at solving problems with the baseline design rather than providing the technological basis for selecting the best design. ~ 3 ~ The time and cost to return to flight were minimized. Early in the recovery ef fort, we urged NASA to give more thorough consideration to alternative designs, of which many were and are potentially promising . We recognized, however, the advantages of the baseline approach for returning to flight as soon as possible and bed ieve that it has proved ef fective in this case . Results from the Redesign. The redesign program has been a imed at improving the des ign f eatures that may have contributed to the Challenger accident as wed ~ as other components that were performing less than satisfactorily or that were identif fed as having inadequate factors of safety. It also included an extensive analytical effort, a subscale test program, and full-scale, short-duration testing which provided much improved understanding of the design and its limitations. The most important results of the program are outlined below. Case field joint. Five features of the design of the original case field joint are thought to have contributed to the accident. (1) The sealing surfaces of the original design opened excessively during the ignition transient; this motion has been greatly reduced by the addition of the capture feature with its interference fit and extra O-ring. (2) The O-ring material used in the original design has poor low temperature resilience; since no suitable alternative is currently available, the redesign employs the same material, but seals are heated to maintain proper resilience. Also, greater care is taken to assure the quality of O-ring materials and manufacture. (3) The O-ring grooves were too narrow to take full advantage of the effects of pressurization for making the seal; the seal grooves have been widened in the redesign. (4) The original system for verifying the seals 48

OCR for page 47
Letter to the Honorable James C. Fletcher -3- pushed the primary O-ring in the wrong direction to be an effective seal upon pressurization; the new vent port and leak check procedures assure proper seating of both the primary and secondary seals. (5) The O-ring seals could be exposed to jets of combustion gases through blowholes in the putty of the original design; this exposure has been reduced or eliminated by replacing the putty with a thermal barrier of bonded insulation (the so-ca1 leaf J-sea1~. The interference fit also helps to protect the seals from exposure to hot gas jets in the event of a defect in the bonded insulation. In our opinion, NASA has a reasonable basis for concluding that these changes have corrected the previous design deficiencies. Case-to-nozzle joint. The same redesign principles were applied where possible to the case-to-nozzle joint which, while not involved in the accident, had previously shown problems similar to those observed in the case field joint. Joint motion has now been restricted by radial bolts added to the design. The preloading of these and other bolts is more carefully controlled than previously. The O-rings are in a heated environment, as they were in the original design, but with more careful control of temperature. The O-ring grooves have been widened, although the design selected cannot assure that the primary seal is seated in the proper direction. Bonded insulation and an extra (wiper) O-ring are provided to protect the seals from combustion gases; in this case, how- ever, the assembly process, dictated by the geometry, tends to allow voids and blowholes to form in the adhesive that forms the insulation bond. The potential for gas flow through blowholes in the adhesive and the potential leak paths around the additional bolts create less certainty about the reliability of this joint than the case field joint. However, the joint has performed weld in tests. When realistic blowholes were deliberately introduced into the joint during tests, the volumes of gas that flowed through them were less than the amount needed to jeopardize the seals. Therefore, while uncertainties remain, the new design appears to represent a significant improvement over the original. Additional work is required to develop and demonstrate assembly techniques that yield a more reproducible product. Until this is accom- plished, very careful attention should be paid to quality control in assembly. In addition, the performance of the case-to-nozz~e joint in flight must be monitored to verify that the additional stress of occasional blowholes in the adhesive does not threaten to compromise its function. Igniter joint. Some of the redesign principles were also applied to the igniter joint. For example, the inner sealing 49

OCR for page 47
Letter to the Honorable James C. Fletcher surfaces of the igniter in the original design opened too quickly on ignition for the gasket seal to respond as required by the specifications; the redesign employs a more substantial preload on the igniter bolts to restrict this motion. Beyond this, the addition of a heater to improve the resilience of the seal material for cold weather launches is planned; how- ever, the heater has not yet been demonstrated or qualified. Test results indicate that the new design of this joint represents an improvement over the original. Case factory joint. The vulcanized insulation that compa etely covers the inside of this joint acts as its only qualif fed pressure seal . The layup and thickness of the insulation have been modif fed to enhance safety. No structural changes were made in the case factory j oint to reduce the relative motion of the metal parts an] the O-rings are not heated, so the two O-rings do not meet the formal requirements for seals . This j oint, therefore, does not have redundant, verifiable seal s that will operate independently throughout motor burn. The insulation over the factory j oints has per f ormed sati s f actorily in both f l ight and ground tests, which have demonstrated that the insulation forms a highly reliable seal. Furthermore, the O-rings may well provide redundant sealing action if called upon well after the ignition transient. Nozzle ablative parts. Flight experience before the accident suggested the need to improve the thermal performance of carbon cloth phenolic parts in the nozzle. The results of a nozzle technology development program initiated before the accident led to improved control of the materials used to make the parts as well as to changes in the cloth layup patterns. A limited number of ground tests suggest that the thermal performance of these parts has been substantially improved. However, the performance of these components can be sensitive to manufacturing variables so operational flight data should be monitored very carefully. The redesign of one nozzle ablative part, the outer boot ring, proved in test to be structurally deficient and it was necessary to turn to an alternative design. Based on test results to date, the current baseline ("structural support") design of the outer boot ring appears to be substantially better than either the original design or the first redesign ("involuted. Some degree of uncertainty exists, however, regarding the structural loads on this component when vent holes, which were designed to assure the equalization of pressure across the part, become plugged. NASA's analysis of the "worst case" pressure differential due to plugging indicates that the situation is unlikely to threaten the safety of flight. 50

OCR for page 47
Letter to the Honorable James C. Fletcher _ ~ _ Booster components. During the redesign activity, two booster components were found to have structural safety factors that did not satisfy specifications. The aft attachment to the external tank and the aft skirt were both redesigned. Only the new design of the former appears to be satisfactory; the modified aft skirt has failed to meet the ultimate design load condition required in the specifications. We support NASA's decision to grant a waiver of the require- ment for the aft skirt for the first flight since the safety of flight is not in question. The current skirt is heavier than the original design by several hundred pounds without apparent improvement in its strength. We conclude that further work on the aft skirt is needed to meet the design requirements. Very recently, we learned that during an evaluation of booster parts in storage for future use, a crack was found in a strut. We understand that the struts installed in STS-26 had been inspected in accordance with procedures and proof tested and that the implications of the occurrence of this defect for STS-26 are being evaluated. Assessment of the Certification Program The certification program is aimed at verifying that the design meets the contract specifications and at determining if it is qualified for manned flight. The program includes analytical studies as well as development and qualification tests. Concurrency. In the case of the redesigned SRB, the certification program was conducted in parallel with the manufacture and assembly of the first several pairs of flight motors. The objective, as with the baseline design approach, was to return to flight as quickly as possible. The assump- tion inherent in the parallel approach was that the certifica- tion program would successfully demonstrate that the baseline design meets requirements. In practice, several changes in the first flight set were made after the two boosters were constructed when certifi- cation activities identified deficiencies. For example, the alternative outer boot ring design replaced the original redesign; new igniter bolts were installed to restrict the gap opening; and insulation debonds were repaired. Other changes were identified but were judged by NASA not to be sufficiently important to incur the delays that would have been required to incorporate them on the first flight set. These changes, 51

OCR for page 47
Letter to the Honorable James C. Fletcher including stronger bolts in all internal nozzle joints, adjustable vent port plugs, improvements in the aft skirt to meet design requirements, and improvements in ease-1 iner bonding processes presumably will be introduced in future flights. We conclude that the concurrent approach to certification and manufacture of flight sets was an appropriate strategy. The resumption of flight will clearly occur much earlier than otherwise would have been the case and program management has demonstrated diligence in making changes when tests or analyses indicated priority needs. The Test Program. The test program comprises work to validate the mechanical and thermal integrity of the design and to confirm that it operates as intended. For example, assuring mechanical integrity is the primary focus of hydroproofing, structural, and assembly tests of various kinds that are intended to determine structural margins of safety or practicality of assembly. Also in this category are tests to determine the aging characteristics of nonmetallic parts, such as compression set in O-rings and insulation. Aging tests for components other than the propellant had been quite limited in the SRB program. Mechanical and thermal integrity as well as operational characteristics were examined in a series of experiments in which propellant was burned. A design feature was often first tested in subscale motors, then in full-scale but short- duration test beds, and f inally in full-scale, full-duration static motor f irings . In addition to the usual testing of a rt i c le s under nomina ~ condit ions, the redes ign program inch uded tests of four types that had not been conducted previously in the shunts e program. (1) The motor will have been test f ired while conditioned to the highest and lowest operating temperature specified in the design requirements, with the low temperature test (QM-8 ~ coming after the resumption of flight but before a cold temperature launch. (2 ~ Some test articles, including one full-duration motor, were subj ected to external dynamic forces to simulate the loads experienced at launch and during flight. ~ 3 ~ Both short-duration and full-duration firings were conducted to determine the tolerance of the design to fl aws that might be introduced during manufacturing or assembly but not be detected by inspection. ~ 4 ~ The performance of seals was tested in both short-duration and full-duration firings by breaching the upstream barriers that normally would protect the O-rings from combustion gases. 52

OCR for page 47
Letter to the Honorable James C. Fletcher 7 While not every test that the Panel and others might have desired was conducted before the return to flight, it is clear that the current test program has been considerably more extensive and thorough than the test program that preceded the first Shuttle launch. As a consequence, we conclude that NASA can have commensurately more confidence in the redesigned SRM than it had in the original design. Much was accomplished in the testing program that will also be valuable to NASA in developing future generations of solid rocket motors. Unfortunately, both because the focus was on the baseline design and because NASA did not have an ongoing program for developing advanced technology with applications to the motor, except for nozzle phenolics, the redesign program has not taken full advantage of its subsca~e test capability. We believe deeply in the value of technology programs as the basis for future design, development, and operations, building as they do the understanding needed to approach the future. The Analytic Program. In addition to testing, NASA also relies on analytical studies to help verify that the design meets requirements, especially in those circumstances where tests cannot be conducted for practical reasons. For example, the factor of safety for thermal loads, i.e., the ability of the design to withstand thermal loads in excess of those experienced under "worst case" operating conditions, cannot be demonstrated by test. The requirements, nonetheless, specify the factor of safety to be achieved and demonstrated. While NASA may have no other choice but to rely on analysis in these circumstances, it nonetheless appears to us as if the program has in some cases placed undue confidence in the results of analytical studies, particularly regarding structural integrity. Analyses incorporate a variety of assumptions and too seldom are estimates made of the effects of assumptions on the accuracy or precision of the results. Modeling the behavior of complex structures subject to three-dimensional loads is a challenging task; the efficacy of analytical models must be verified by appropriate experi- ments. The nozzle ablative parts, for example, are complex inhomogeneous, anisotropic structures and their physics and chemistry may not be adequately captured by existing analyti- cal models. The analysis of the outer boot ring, for example, did not account for torsion, used incorrect loads, and had an inappropriate failure criterion, yet the results of analysis were originally used to select the baseline design. A similar caution is warranted for the application of current models to plastic deformation of metal parts and to complex structures, such as the aft skirt. 53

OCR for page 47
Letter to the Honorable James C. Fletcher 8 Future Verif ication Activities . As indicated earl ier, the low temperature certification static motor test is schedu~ ed to be conducted be fore the f irst cold temperature launch. After mission STS-2 6, a fullscale case j oint is to be subj ected to multiple cycles of pressure ~ oading and then burst to identify effects of multiple uses and validate structural analyses. It is al so our understanding that the first six flights were intended to provide data as part of the verif icat:ion program. We have been disappointed to learn that the instrumentation required for this purpose will not be f lown after the third flight, apparently for budgetary reasons. No amount of ground testing can simulate with complete fidelity the conditions of flight, which is the environment that counts; there is no substitute for flight data for identifying anomalous behavior or verifying preflight calculations. We are concerned that once flight instruments have been deleted from the program, it will be difficult to get them back on the flight articles. We recommend, therefore, that NASA set aside funds for flight instrumentation beyond the third flight; the agency should identify critical needs for operational data, based on the results of the first several flights, that can be met with instrumentation on future flights. Production and Ouality Control Because an SRM flight article cannot be operationally tested before it is used, defining and maintaining controls on the materials, processes, and parts used in its manufacture are essential to establish confidence in the reliability of the booster. The goal is to define the most effective manu- facturing processes, then to assure that each motor is as much as possible identical to all of the motors that have been tested and flown before it. Careful workmanship and diligent supervision are essential in working toward this goal. Manufacturing Processes. Among the thousands of processes used to make parts of the booster, four have been the focus of our attention because, while progress has been made, they have not yet been completely developed, demonstrated, and con- trolled. These processes are: manufacturing nozzle ablative parts, which are particularly vulnerable to single point failures; manufacturing high quality O-rings; assembling the case-to-nozzle joint without forming blowholes or voids in the polysulfide adhesive; and bonding elastomers to metal sur- faces, including both the insulation-to-case bond and bonds within the flexible nozzle bearing. The features of the respective processes that determine the quality of their 54

OCR for page 47
Letter to the Honorable James C. F1 etcher _9_ products have not yet been conclusively identified. We recommend that technology development be vigorously pursued to resolve these uncertainties and that the changes be carefully tested before being introduced into flight articles. Uncertainties also remain in developing the specifications governing the purchase of some critical materials, particu- larly those whose formulas or preparations are proprietary. Considerable progress has been made in specifying O-ring materials, but that work is not yet complete. Much work sti11 needs to be done regarding adhesives and other bonding agents. Quality Control. Diligence in assuring the required quality in materials and processes is a demanding, never-ending task. It appears to us that NASA and its contractors appreciate the central importance of quality control and have been working hard to improve the record of achievement. For example, progress has been made, both at Kennedy Space Center and at Morton-Thiokol, Inc., toward establishing and maintaining standards of cleanliness. Progress has also been made in nondestructive inspection and evaluation of materials, parts, and assembled articles. Considerable attention has also been paid to the problem of measuring case segments. The case field joint design requires relatively precise control of the dimensions of the capture feature and the mating clevis leg: a few thousandths of an inch on a cylinder approximately 12 feet in diameter may be critical not only for its intended operation but also for reuse. Making accurate, precise measurements in this context has not proven to be easy. We concur that NASA should con- tinue to develop and then employ the best demonstrated technique for making the required measurements. The analysis of failure modes and effects, which was extensive, identified a very large number of items that will be subject to mandatory inspection. The number is larger than before the accident primarily because of greater care and attention to detail in the current assessment. The number is so large, however, that the program runs the risk of getting overwhelmed with potentially insignificant details. We concur with the recommendation of the NRC's Committee on Shuttle Criticality Review and Hazard Analysis Audit that means be devised for establishing priorities so that the inspection program can focus its attention on the truly important items. 55

OCR for page 47
Letter to the Honorable James C. Fletcher 10- Deviations in STS-26 and Subsequent Flights. While the goal is to make each booster identical, deviations from design requirements and discrepancies in materials and processes always occur in the normal course of events. These are formally reviewed to assess their potential consequences for a successful mission and only those judged not to affect safety or reliability adversely are accepted. The STS-26 boosters have a considerable number of such deviations and waivers. The Panel has reviewed NASA's process for evaluating and approving them and finds it to be satis- factory. We have also reviewed a few of the more significant items. While we have not been able to make a thorough assess- ment in each case, we have found nothing which demonstrates that NASA's evaluations are in error. Among the deviations, the first flight set contains some parts, and was manufactured using some processes, that will be changed for future missions because improvements were identi- fied during the development and certification process but after the STS-26 boosters were assembled. As described earlier, NASA concluded that the benefits to be derived from making certain changes were not worth the associated delays. Included in this category are: O-rings in the safe and arm device that have less than the specified squeeze on the rotor shaft; fully threaded bolts in nozzle internal joint #5; case-liner edge bonds built without the benefit of the most recent process controls; nozzles that have been subjected to removal and replacement of the outer boot ring; and the so-called custom-fitted vent port plugs. In addition, putty in the igniter joints of the STS-26 boosters--and one of the STS-27 boosters--has been mechanically tamped to reduce the potential for blowholes although this process will not be followed in the future. Each of these unique features of the SRBs on STS-26 has been tested in at least one static motor ground test. While flights beyond STS-26 will also have waivers and deviations for the reasons described in the first paragraph of this section, we are concerned that many deviations and waivers arise because the related design requirements are incorrect or impractical and will not ever be met. NASA s h ou l d reduce the number o f such dev i at i ons and wa ivers by changing the requirements where there is no practical expectation of meeting them in the future and where the resulting reliability, performance, and operating constraints, if any, are acceptable . 56

OCR for page 47
Letter to the Honorable James C. Fletcher Current Status of the Program 11 As noted in our first report, dated August 1, 1986, four interdependent factors influence the program: safety, sched- ule, cost, and performance. Improving the design for enhanced safety and reliability has been the prime consideration, but schedule and costs have also had important influences on the redesign program. Many design changes have improved safety and reduced risks. Some design changes may have introduced new, as yet unrecognized risks. Some risks, associated with elements of the design that were not changed, remain as they were before the Challenger accident. On balance, based primarily on changes in design of the case field joint, case-to~nozz~e joint, and the nozzle ablative components, we believe that the overall level of safety and reliability has been substantially 8 . mprovec .. More might have been accomplished if the program were unconstrained by the need to return to flight as soon as possible and by limitations in budget and other resources. But such constraints were practical necessities and our impression is that they were not unreasonable in this case. More can still be accomplished to improve safety and reliability after flights resume, however, as a number of important issues in the design and verification program have been deferred or are sti11 unresolved. Among these are: the adequacy of new procedures for making the case-insulation bonds for future flight articles; the adequacy of repairs to case-insulation bonds; the structural performance of nozzle parts and bonds; the occurrence and effects of blowholes in the adhesive in the case-to-nozzle joint; effects of long term storage on installed elastomeric seals and bonds; the accuracy and reliability of measuring and matching case segments; the adequacy of the aft skirt design; the potential need to prevent the establishment of differential pressure across the nozzle flexible boot; the verification of structural analysis by a burst test of a full-scale case; the potential for achieving the required number of reuses of case segments; and the removal of materials that contain asbestos. Additional issues or concerns can be expected to arise from flight experience, which is the true test of the redesign. We have previously recommended that NASA undertake a program to continue to reduce risks, enhance reliability, and reduce costs associated with the redesigned SRB after flight resumes. Having such a program, which should address both issues unresolved in the redes ign to date and concerns that 57

OCR for page 47
Letter to the Honorable James C. Fletcher -12- arise from flight experience, requires pJanning to assure appropriate continuity in technical efforts and of personnel and to be capable of introducing improvements into an ongoing operational program. NASA's commitment to and budget for such a program is essential. In our opinion, the prospect of an advanced solid rocket motor, which might not be available until the middle of the next decade at the earliest, does not warrant a relaxation in NASA's diligence to provide the safest practical space transportation system in the interim. We strongly reiterate our earlier recommendation. Our focus today, however, is on the return to flight: mission STS-26. NASA and its contractors have worked dili- gently on the redesign and testing program and deserve to be recognized for their efforts. The redesigned solid rocket boosters have incorporated a large number of improvements that 8 _ ~ _ ~ _ _ a snouts resume In cons~aeran~v ennancea sarerv and reliabiliLv. hence reducer rise. - _ a _ ~ ~ Risks remain, however. And readiness to fly depends as much, if not more, on confidence in manufac- turinq and assembly as on the redesign, which our Panel has Whether the level of risk is acceptable is a matter that NASA must judge. Based on the Panel's assessments and observations regarding the redesigned we have no basis for objection to the for STS-26. evaluated over the nest 28 months. solid rocket boosters, current launch schedule . cc: Adm. Richard H. Truly Panel Members Sincerely, H. Guyford Stever Chairman 58