|
Items in cart [0] |
Questions? Call 888-624-8373 |
| Copyright © 2009. National Academy of Sciences. All rights reserved. Terms of Use and Privacy Statement |
Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter.
Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.
OCR for page 47
NATIONAL RESEARCH COUNCIL
COMMISSION ON ENGINEERING AND TECHNICAL SYSTEMS
2101 Constitution Avenue Washington, D. C. 20418
COMMITTEE ON NASA SCIENTIFIC
AND TECHNOLOGICAL PROGRAM REVIEWS
Panel on Redesign of Space Shuttle
Solid Rocket Booster
September 9, 1988
The Honorable James C. Fletcher
Administrator
National Aeronautics and Space Administration
400 Maryland Avenue, S.W., Room 7137
Washington, D.C. 20546
Dear Jim:
I am pleased to submit herewith the seventh interim report
of the National Research Council's Panel for the Technical
Evaluation of NASA's Redesign of the Space Shuttle Solid
Rocket Booster.
The preflight program for testing the redesigned solid
rocket booster has been completed and the Shuttle is expected
to be returned to service soon. This report provides our
assessment of the new design and its certification program,
including production and quality control issues, and our
findings on the status of the program at this time. Our
conclusions are based on engineering judgment and the results
of tests, the number of which has been necessarily small.
Since our last report, the Panel has conducted four formal
meetings and members of the Panel have attended a number of
test readiness reviews; the QM-6, QM-7, and PVM-1 static
tests; technical interchange meetings on the outer boot ring,
aft skirt, and insulation debond problem; the design certi-
fication review' and an inspection of the stacked boosters to
be used in the next flight (STS-26~. I also presented testi-
mony on the progress of the redesign effort to the Senate
Appropriations Subcommittee on HUD and Independent Agencies on
June 8th. Since June 1986 the Panel has participated in or
observed more than 90 meetings, reviews, site visits, and
tests and I have testified before the Congress on four
occasions.
Assessment of the Redesigned SRB
Approach of the Redesign. The redesign program was organized
to concentrate its resources on a "baseline" design, thereby
avoiding a dilution of effort in both the design and testing
47
The National Research Council is the principal operating agency of the National Academy of Sciences and the National Academy of Engineering
to serve government and other organizations
OCR for page 48
Letter to the Honorable James C. Fletcher
—2—
phases. The redesign was alto constrained to make maximum use
of existing or previously ordered hardware, owing to the long
time it takes to acquire new cases.
The consequences of these restraints were: (1) With few
exceptions, no alternative design of a major component was
carried to full-scale, full-duration testing. The principal
exception, an alternative design for the nozzle outer boot
ring, turned out to be needed and, because it was available,
many months of delay were avoided when the original baseline
design failed in the DM-9 static test. (2) The development
effort aimed at solving problems with the baseline design
rather than providing the technological basis for selecting
the best design. ~ 3 ~ The time and cost to return to flight
were minimized.
Early in the recovery ef fort, we urged NASA to give more
thorough consideration to alternative designs, of which many
were and are potentially promising . We recognized, however,
the advantages of the baseline approach for returning to
flight as soon as possible and bed ieve that it has proved
ef fective in this case .
Results from the Redesign. The redesign program has been
a imed at improving the des ign f eatures that may have
contributed to the Challenger accident as wed ~ as other
components that were performing less than satisfactorily or
that were identif fed as having inadequate factors of safety.
It also included an extensive analytical effort, a subscale
test program, and full-scale, short-duration testing which
provided much improved understanding of the design and its
limitations. The most important results of the program are
outlined below.
Case field joint. Five features of the design of the
original case field joint are thought to have contributed to
the accident. (1) The sealing surfaces of the original design
opened excessively during the ignition transient; this motion
has been greatly reduced by the addition of the capture
feature with its interference fit and extra O-ring. (2) The
O-ring material used in the original design has poor low
temperature resilience; since no suitable alternative is
currently available, the redesign employs the same material,
but seals are heated to maintain proper resilience. Also,
greater care is taken to assure the quality of O-ring
materials and manufacture. (3) The O-ring grooves were too
narrow to take full advantage of the effects of pressurization
for making the seal; the seal grooves have been widened in the
redesign. (4) The original system for verifying the seals
48
OCR for page 49
Letter to the Honorable James C. Fletcher
-3-
pushed the primary O-ring in the wrong direction to be an
effective seal upon pressurization; the new vent port and leak
check procedures assure proper seating of both the primary and
secondary seals. (5) The O-ring seals could be exposed to
jets of combustion gases through blowholes in the putty of the
original design; this exposure has been reduced or eliminated
by replacing the putty with a thermal barrier of bonded
insulation (the so-ca1 leaf J-sea1~. The interference fit also
helps to protect the seals from exposure to hot gas jets in
the event of a defect in the bonded insulation. In our
opinion, NASA has a reasonable basis for concluding that these
changes have corrected the previous design deficiencies.
Case-to-nozzle joint. The same redesign principles were
applied where possible to the case-to-nozzle joint which,
while not involved in the accident, had previously shown
problems similar to those observed in the case field joint.
Joint motion has now been restricted by radial bolts added to
the design. The preloading of these and other bolts is more
carefully controlled than previously. The O-rings are in a
heated environment, as they were in the original design, but
with more careful control of temperature. The O-ring grooves
have been widened, although the design selected cannot assure
that the primary seal is seated in the proper direction.
Bonded insulation and an extra (wiper) O-ring are provided to
protect the seals from combustion gases; in this case, how-
ever, the assembly process, dictated by the geometry, tends to
allow voids and blowholes to form in the adhesive that forms
the insulation bond.
The potential for gas flow through blowholes in the
adhesive and the potential leak paths around the additional
bolts create less certainty about the reliability of this
joint than the case field joint. However, the joint has
performed weld in tests. When realistic blowholes were
deliberately introduced into the joint during tests, the
volumes of gas that flowed through them were less than the
amount needed to jeopardize the seals. Therefore, while
uncertainties remain, the new design appears to represent a
significant improvement over the original. Additional work is
required to develop and demonstrate assembly techniques that
yield a more reproducible product. Until this is accom-
plished, very careful attention should be paid to quality
control in assembly. In addition, the performance of the
case-to-nozz~e joint in flight must be monitored to verify
that the additional stress of occasional blowholes in the
adhesive does not threaten to compromise its function.
Igniter joint. Some of the redesign principles were also
applied to the igniter joint. For example, the inner sealing
49
OCR for page 50
Letter to the Honorable James C. Fletcher
surfaces of the igniter in the original design opened too
quickly on ignition for the gasket seal to respond as required
by the specifications; the redesign employs a more substantial
preload on the igniter bolts to restrict this motion. Beyond
this, the addition of a heater to improve the resilience of
the seal material for cold weather launches is planned; how-
ever, the heater has not yet been demonstrated or qualified.
Test results indicate that the new design of this joint
represents an improvement over the original.
Case factory joint. The vulcanized insulation that
compa etely covers the inside of this joint acts as its only
qualif fed pressure seal . The layup and thickness of the
insulation have been modif fed to enhance safety. No
structural changes were made in the case factory j oint to
reduce the relative motion of the metal parts an] the O-rings
are not heated, so the two O-rings do not meet the formal
requirements for seals . This j oint, therefore, does not have
redundant, verifiable seal s that will operate independently
throughout motor burn. The insulation over the factory j oints
has per f ormed sati s f actorily in both f l ight and ground tests,
which have demonstrated that the insulation forms a highly
reliable seal. Furthermore, the O-rings may well provide
redundant sealing action if called upon well after the
ignition transient.
Nozzle ablative parts. Flight experience before the
accident suggested the need to improve the thermal performance
of carbon cloth phenolic parts in the nozzle. The results of
a nozzle technology development program initiated before the
accident led to improved control of the materials used to make
the parts as well as to changes in the cloth layup patterns.
A limited number of ground tests suggest that the thermal
performance of these parts has been substantially improved.
However, the performance of these components can be sensitive
to manufacturing variables so operational flight data should
be monitored very carefully.
The redesign of one nozzle ablative part, the outer boot
ring, proved in test to be structurally deficient and it was
necessary to turn to an alternative design. Based on test
results to date, the current baseline ("structural support")
design of the outer boot ring appears to be substantially
better than either the original design or the first redesign
("involuted. Some degree of uncertainty exists, however,
regarding the structural loads on this component when vent
holes, which were designed to assure the equalization of
pressure across the part, become plugged. NASA's analysis of
the "worst case" pressure differential due to plugging
indicates that the situation is unlikely to threaten the
safety of flight.
50
OCR for page 51
Letter to the Honorable James C. Fletcher
_ ~ _
Booster components. During the redesign activity, two
booster components were found to have structural safety
factors that did not satisfy specifications. The aft
attachment to the external tank and the aft skirt were both
redesigned. Only the new design of the former appears to be
satisfactory; the modified aft skirt has failed to meet the
ultimate design load condition required in the specifications.
We support NASA's decision to grant a waiver of the require-
ment for the aft skirt for the first flight since the safety
of flight is not in question. The current skirt is heavier
than the original design by several hundred pounds without
apparent improvement in its strength. We conclude that
further work on the aft skirt is needed to meet the design
requirements.
Very recently, we learned that during an evaluation of
booster parts in storage for future use, a crack was found in
a strut. We understand that the struts installed in STS-26
had been inspected in accordance with procedures and proof
tested and that the implications of the occurrence of this
defect for STS-26 are being evaluated.
Assessment of the Certification Program
The certification program is aimed at verifying that the
design meets the contract specifications and at determining if
it is qualified for manned flight. The program includes
analytical studies as well as development and qualification
tests.
Concurrency. In the case of the redesigned SRB, the
certification program was conducted in parallel with the
manufacture and assembly of the first several pairs of flight
motors. The objective, as with the baseline design approach,
was to return to flight as quickly as possible. The assump-
tion inherent in the parallel approach was that the certifica-
tion program would successfully demonstrate that the baseline
design meets requirements.
In practice, several changes in the first flight set were
made after the two boosters were constructed when certifi-
cation activities identified deficiencies. For example, the
alternative outer boot ring design replaced the original
redesign; new igniter bolts were installed to restrict the gap
opening; and insulation debonds were repaired. Other changes
were identified but were judged by NASA not to be sufficiently
important to incur the delays that would have been required to
incorporate them on the first flight set. These changes,
51
OCR for page 52
Letter to the Honorable James C. Fletcher
including stronger bolts in all internal nozzle joints,
adjustable vent port plugs, improvements in the aft skirt to
meet design requirements, and improvements in ease-1 iner
bonding processes presumably will be introduced in future
flights.
We conclude that the concurrent approach to certification
and manufacture of flight sets was an appropriate strategy.
The resumption of flight will clearly occur much earlier than
otherwise would have been the case and program management has
demonstrated diligence in making changes when tests or
analyses indicated priority needs.
The Test Program. The test program comprises work to validate
the mechanical and thermal integrity of the design and to
confirm that it operates as intended. For example, assuring
mechanical integrity is the primary focus of hydroproofing,
structural, and assembly tests of various kinds that are
intended to determine structural margins of safety or
practicality of assembly. Also in this category are tests to
determine the aging characteristics of nonmetallic parts, such
as compression set in O-rings and insulation. Aging tests for
components other than the propellant had been quite limited in
the SRB program.
Mechanical and thermal integrity as well as operational
characteristics were examined in a series of experiments in
which propellant was burned. A design feature was often first
tested in subscale motors, then in full-scale but short-
duration test beds, and f inally in full-scale, full-duration
static motor f irings . In addition to the usual testing of
a rt i c le s under nomina ~ condit ions, the redes ign program
inch uded tests of four types that had not been conducted
previously in the shunts e program. (1) The motor will have
been test f ired while conditioned to the highest and lowest
operating temperature specified in the design requirements,
with the low temperature test (QM-8 ~ coming after the
resumption of flight but before a cold temperature launch.
(2 ~ Some test articles, including one full-duration motor,
were subj ected to external dynamic forces to simulate the
loads experienced at launch and during flight. ~ 3 ~ Both
short-duration and full-duration firings were conducted to
determine the tolerance of the design to fl aws that might be
introduced during manufacturing or assembly but not be
detected by inspection. ~ 4 ~ The performance of seals was
tested in both short-duration and full-duration firings by
breaching the upstream barriers that normally would protect
the O-rings from combustion gases.
52
OCR for page 53
Letter to the Honorable James C. Fletcher
—7—
While not every test that the Panel and others might have
desired was conducted before the return to flight, it is clear
that the current test program has been considerably more
extensive and thorough than the test program that preceded the
first Shuttle launch. As a consequence, we conclude that NASA
can have commensurately more confidence in the redesigned SRM
than it had in the original design.
Much was accomplished in the testing program that will
also be valuable to NASA in developing future generations of
solid rocket motors. Unfortunately, both because the focus
was on the baseline design and because NASA did not have an
ongoing program for developing advanced technology with
applications to the motor, except for nozzle phenolics, the
redesign program has not taken full advantage of its subsca~e
test capability. We believe deeply in the value of technology
programs as the basis for future design, development, and
operations, building as they do the understanding needed to
approach the future.
The Analytic Program. In addition to testing, NASA also
relies on analytical studies to help verify that the design
meets requirements, especially in those circumstances where
tests cannot be conducted for practical reasons. For example,
the factor of safety for thermal loads, i.e., the ability of
the design to withstand thermal loads in excess of those
experienced under "worst case" operating conditions, cannot be
demonstrated by test. The requirements, nonetheless, specify
the factor of safety to be achieved and demonstrated.
While NASA may have no other choice but to rely on
analysis in these circumstances, it nonetheless appears to us
as if the program has in some cases placed undue confidence in
the results of analytical studies, particularly regarding
structural integrity. Analyses incorporate a variety of
assumptions and too seldom are estimates made of the effects
of assumptions on the accuracy or precision of the results.
Modeling the behavior of complex structures subject to
three-dimensional loads is a challenging task; the efficacy of
analytical models must be verified by appropriate experi-
ments. The nozzle ablative parts, for example, are complex
inhomogeneous, anisotropic structures and their physics and
chemistry may not be adequately captured by existing analyti-
cal models. The analysis of the outer boot ring, for example,
did not account for torsion, used incorrect loads, and had an
inappropriate failure criterion, yet the results of analysis
were originally used to select the baseline design. A similar
caution is warranted for the application of current models to
plastic deformation of metal parts and to complex structures,
such as the aft skirt.
53
OCR for page 54
Letter to the Honorable James C. Fletcher
—8—
Future Verif ication Activities . As indicated earl ier, the low
temperature certification static motor test is schedu~ ed to be
conducted be fore the f irst cold temperature launch. After
mission STS-2 6, a full°scale case j oint is to be subj ected to
multiple cycles of pressure ~ oading and then burst to identify
effects of multiple uses and validate structural analyses.
It is al so our understanding that the first six flights
were intended to provide data as part of the verif icat:ion
program. We have been disappointed to learn that the
instrumentation required for this purpose will not be f lown
after the third flight, apparently for budgetary reasons. No
amount of ground testing can simulate with complete fidelity
the conditions of flight, which is the environment that
counts; there is no substitute for flight data for identifying
anomalous behavior or verifying preflight calculations. We
are concerned that once flight instruments have been deleted
from the program, it will be difficult to get them back on the
flight articles. We recommend, therefore, that NASA set aside
funds for flight instrumentation beyond the third flight; the
agency should identify critical needs for operational data,
based on the results of the first several flights, that can be
met with instrumentation on future flights.
Production and Ouality Control
Because an SRM flight article cannot be operationally
tested before it is used, defining and maintaining controls on
the materials, processes, and parts used in its manufacture
are essential to establish confidence in the reliability of
the booster. The goal is to define the most effective manu-
facturing processes, then to assure that each motor is as much
as possible identical to all of the motors that have been
tested and flown before it. Careful workmanship and diligent
supervision are essential in working toward this goal.
Manufacturing Processes. Among the thousands of processes
used to make parts of the booster, four have been the focus of
our attention because, while progress has been made, they have
not yet been completely developed, demonstrated, and con-
trolled. These processes are: manufacturing nozzle ablative
parts, which are particularly vulnerable to single point
failures; manufacturing high quality O-rings; assembling the
case-to-nozzle joint without forming blowholes or voids in the
polysulfide adhesive; and bonding elastomers to metal sur-
faces, including both the insulation-to-case bond and bonds
within the flexible nozzle bearing. The features of the
respective processes that determine the quality of their
54
OCR for page 55
Letter to the Honorable James C. F1 etcher
_9_
products have not yet been conclusively identified. We
recommend that technology development be vigorously pursued to
resolve these uncertainties and that the changes be carefully
tested before being introduced into flight articles.
Uncertainties also remain in developing the specifications
governing the purchase of some critical materials, particu-
larly those whose formulas or preparations are proprietary.
Considerable progress has been made in specifying O-ring
materials, but that work is not yet complete. Much work sti11
needs to be done regarding adhesives and other bonding agents.
Quality Control. Diligence in assuring the required quality
in materials and processes is a demanding, never-ending task.
It appears to us that NASA and its contractors appreciate the
central importance of quality control and have been working
hard to improve the record of achievement. For example,
progress has been made, both at Kennedy Space Center and at
Morton-Thiokol, Inc., toward establishing and maintaining
standards of cleanliness. Progress has also been made in
nondestructive inspection and evaluation of materials, parts,
and assembled articles.
Considerable attention has also been paid to the problem
of measuring case segments. The case field joint design
requires relatively precise control of the dimensions of the
capture feature and the mating clevis leg: a few thousandths
of an inch on a cylinder approximately 12 feet in diameter may
be critical not only for its intended operation but also for
reuse. Making accurate, precise measurements in this context
has not proven to be easy. We concur that NASA should con-
tinue to develop and then employ the best demonstrated
technique for making the required measurements.
The analysis of failure modes and effects, which was
extensive, identified a very large number of items that will
be subject to mandatory inspection. The number is larger than
before the accident primarily because of greater care and
attention to detail in the current assessment. The number is
so large, however, that the program runs the risk of getting
overwhelmed with potentially insignificant details. We concur
with the recommendation of the NRC's Committee on Shuttle
Criticality Review and Hazard Analysis Audit that means be
devised for establishing priorities so that the inspection
program can focus its attention on the truly important items.
55
OCR for page 56
Letter to the Honorable James C. Fletcher
10-
Deviations in STS-26 and Subsequent Flights. While the goal
is to make each booster identical, deviations from design
requirements and discrepancies in materials and processes
always occur in the normal course of events. These are
formally reviewed to assess their potential consequences for a
successful mission and only those judged not to affect safety
or reliability adversely are accepted.
The STS-26 boosters have a considerable number of such
deviations and waivers. The Panel has reviewed NASA's process
for evaluating and approving them and finds it to be satis-
factory. We have also reviewed a few of the more significant
items. While we have not been able to make a thorough assess-
ment in each case, we have found nothing which demonstrates
that NASA's evaluations are in error.
Among the deviations, the first flight set contains some
parts, and was manufactured using some processes, that will be
changed for future missions because improvements were identi-
fied during the development and certification process but
after the STS-26 boosters were assembled. As described
earlier, NASA concluded that the benefits to be derived from
making certain changes were not worth the associated delays.
Included in this category are: O-rings in the safe and arm
device that have less than the specified squeeze on the rotor
shaft; fully threaded bolts in nozzle internal joint #5;
case-liner edge bonds built without the benefit of the most
recent process controls; nozzles that have been subjected to
removal and replacement of the outer boot ring; and the
so-called custom-fitted vent port plugs. In addition, putty
in the igniter joints of the STS-26 boosters--and one of the
STS-27 boosters--has been mechanically tamped to reduce the
potential for blowholes although this process will not be
followed in the future. Each of these unique features of the
SRBs on STS-26 has been tested in at least one static motor
ground test.
While flights beyond STS-26 will also have waivers and
deviations for the reasons described in the first paragraph of
this section, we are concerned that many deviations and
waivers arise because the related design requirements are
incorrect or impractical and will not ever be met. NASA
s h ou l d reduce the number o f such dev i at i ons and wa ivers by
changing the requirements where there is no practical
expectation of meeting them in the future and where the
resulting reliability, performance, and operating constraints,
if any, are acceptable .
56
OCR for page 57
Letter to the Honorable James C. Fletcher
Current Status of the Program
—11—
As noted in our first report, dated August 1, 1986, four
interdependent factors influence the program: safety, sched-
ule, cost, and performance. Improving the design for enhanced
safety and reliability has been the prime consideration, but
schedule and costs have also had important influences on the
redesign program.
Many design changes have improved safety and reduced
risks. Some design changes may have introduced new, as yet
unrecognized risks. Some risks, associated with elements of
the design that were not changed, remain as they were before
the Challenger accident. On balance, based primarily on
changes in design of the case field joint, case-to~nozz~e
joint, and the nozzle ablative components, we believe that the
overall level of safety and reliability has been substantially
8 .
mprovec ..
More might have been accomplished if the program were
unconstrained by the need to return to flight as soon as
possible and by limitations in budget and other resources.
But such constraints were practical necessities and our
impression is that they were not unreasonable in this case.
More can still be accomplished to improve safety and
reliability after flights resume, however, as a number of
important issues in the design and verification program have
been deferred or are sti11 unresolved. Among these are: the
adequacy of new procedures for making the case-insulation
bonds for future flight articles; the adequacy of repairs to
case-insulation bonds; the structural performance of nozzle
parts and bonds; the occurrence and effects of blowholes in
the adhesive in the case-to-nozzle joint; effects of long term
storage on installed elastomeric seals and bonds; the accuracy
and reliability of measuring and matching case segments; the
adequacy of the aft skirt design; the potential need to
prevent the establishment of differential pressure across the
nozzle flexible boot; the verification of structural analysis
by a burst test of a full-scale case; the potential for
achieving the required number of reuses of case segments; and
the removal of materials that contain asbestos. Additional
issues or concerns can be expected to arise from flight
experience, which is the true test of the redesign.
We have previously recommended that NASA undertake a
program to continue to reduce risks, enhance reliability, and
reduce costs associated with the redesigned SRB after flight
resumes. Having such a program, which should address both
issues unresolved in the redes ign to date and concerns that
57
OCR for page 58
Letter to the Honorable James C.
Fletcher
-12-
arise from flight experience, requires pJanning to assure
appropriate continuity in technical efforts and of personnel
and to be capable of introducing improvements into an ongoing
operational program. NASA's commitment to and budget for such
a program is essential. In our opinion, the prospect of an
advanced solid rocket motor, which might not be available
until the middle of the next decade at the earliest, does not
warrant a relaxation in NASA's diligence to provide the safest
practical space transportation system in the interim. We
strongly reiterate our earlier recommendation.
Our focus today, however, is on the return to flight:
mission STS-26. NASA and its contractors have worked dili-
gently on the redesign and testing program and deserve to be
recognized for their efforts. The redesigned solid rocket
boosters have incorporated a large number of improvements that
8 _ ~ _
~ _ _ a
snouts resume In cons~aeran~v ennancea sarerv and reliabiliLv.
hence reducer rise.
-
_ a _ ~ ~
Risks remain, however. And readiness to
fly depends as much, if not more, on confidence in manufac-
turinq and assembly as on the redesign, which our Panel has
Whether the level of risk
is acceptable is a matter that NASA must judge. Based on the
Panel's assessments and observations regarding the redesigned
we have no basis for objection to the
for STS-26.
evaluated over the nest 28 months.
solid rocket boosters,
current launch schedule
.
cc: Adm. Richard H. Truly
Panel Members
Sincerely,
H. Guyford Stever
Chairman
58
Representative terms from entire chapter:
aft skirt
