Report of the PRESIDENTIAL COMMISSION on the Space Shuttle Challenger Accident

Volume 5 Index

Hearings of the Presidential Commission on the Space Shuttle Challenger Accident: February 26, 1986 to May 2, 1986.

- MARCH 7, 1986 SESSION (part 2 of 2)

  > Colonel Edward O'Connor.
  > Robert Lang, Carver Kennedy, and Bill Barsh.
  > Thomas Moser, Jerrol W. Littles, and Jack Lee.
  > Gary Coultas and George Hopson.

Note:
Centered number = Hearing page
[bold number] = Text page.

[1124] 2042

TESTIMONY OF: THOMAS MOSER, DEPUTY ASSOCIATE ADMINISTRATOR FOR SPACE FLIGHT, NASA; DR. JERROL WAYNE LITTLES, ASSOCIATE DIRECTOR FOR ENGINEERING, MARSHALL SPACE FLIGHT CENTER; AND JACK LEE, DEPUTY DIRECTOR, MSFC

CHAIRMAN ROGERS: Mr. Moser, will you go ahead and identify each of you and your present assignments.

MR. MOSER: Okay, Mr. Chairman, members of the Commission.

I'm Tom Moser. I'm reporting today in the capacity as the head of the failure scenario team from the Johnson Space Center. I have held that position until just recently at the same time I was director of engineering at JSC.

I began my experience with the space shuttle in 1969, and most of that time I served in capacities related to strength integrity of the orbiter and as deputy project manager of the orbiter itself.

DR. LITTLES: Mr. Chairman and members of the Commission:

My name is Wayne Littles. I am associate director of engineering at Marshall Space Flight Center, and I've been at Marshall for 18 years, and I've held my

2043

current position for two years. And prior to that, I was deputy to the same position, and prior to that, I served as the chief of the engineering analysis division in S and E.

My education is in mechanical engineering, and I have a bachelor's degree from Georgia Tech, a master's degree from the University of Southern California, and a Ph.D. from the University of Texas.

MR. LEE: Mr. Chairman, members of the Commission:

I'm Jack Lee, deputy director of the Marshall Space Flight Center. I have held that position since 1980. I have been with the Marshall Center since 1958, and since the date of the incident I have directed the analysis of failure evaluation effort for the Marshall elements for those elements for which we're responsible. That includes the external tank, the solid rocket booster, the shuttle main engine, and the inertial upper stage.

MR. MOSER: Mr. Chairman, if it pleases the Commission, the next five speakers will proceed through a failure scenario beginning at the top level with the evidence as we see from the accident, and then into the top level fault trees, and then down into the detailed failure scenarios of each one of the possible causes.

2044

And so I will begin that.

[1125] And to facilitate this, I will present an abbreviated time line this morning. I will provide to the Commission, if you so desire, a detailed four-page time line. But for the sake of presentation and clarity, I have abbreviated that for your presentation today.

CHAIRMAN ROGERS: I was going to ask, could you just as a preliminary matter explain the terms first? What is a failure scenario? What do you mean by failure scenario? I think I know, but it would be helpful.

MR. MOSER: And you will see that in one of our presentations here. Basically, the fault tree that you will see on the presentation

CHAIRMAN ROGERS: First you used the term "failure scenario." What is that?

MR. MOSER: Failure scenario is a detailed analyses of a fault tree as to why the various elements of the failure events could have taken place. It is using a model of a failure, a theory for a failure, and then the analysis to substantiate or to deny that each element of the failure model is in fact correct.

CHAIRMAN ROGERS: Am I correct that a failure scenario is a hypothesis of something that might have

2045

happened, and then you consider each aspect of that to see whether it in fact did happen?

MR. MOSER: Yes, sir.

CHAIRMAN ROGERS: And then you draw conclusions from that?

MR. MOSER: Yes, sir, and we verify or deny or disprove each one of the steps of that. And today as we proceed through this, we will show you that some of the steps in the failure scenarios indicate that it is not a viable cause, and I think that will become very clear as we proceed through.

CHAIRMAN ROGERS: When you get to a fault tree, would you explain what that is, too, so the listeners understand what it is?

MR. MOSER: Okay, sir.

If I could have the first chart, please, M-1.

(Viewgraph M-1.) [Ref. 3/7-30]

This is-what I've shown here on M-1 is an outline of the investigation process, beginning with the incident. The description of the incident is captured by the evidence from the flight data, the physical data, and the photographic data. It is factual as best we know it, and I will present that to you today, along with the time line. That is the given for the problem, if you will.

2046

The next level is what could have caused this accident, and that is the-please leave M-1 up, please, on the screen. If you could go back to M-1, please.

The second block per se is the fault tree development. It is what could have gone wrong and caused the accident. It could have been the orbiter, it could have been the external tank, it could have been any number of things which caused that failure. It could have been the weather conditions.

Those, it is the anomaly and the vehicle for the failures which constitute the fault tree. From those possible fault tree elements, we then establish and gather data to either substantiate or deny any one of the branches for that fault tree, and we will have a detailed fault tree for you for each one of these things by the other presenters.

To support that, in the middle of that investigation process, the incident data bases are derived, both from the evidence which has been measured, which we document as given up in the first block, and also there is data which is derived by test and analysis, looking at records, the [1126] type of things which you gentlemen-the gentleman just spoke to you on processing the hardware and the checkout. This is what

2047

is then used to verify or deny parts of the failure process and analysis.

All of that then, with the details of the failure analysis which postulates the sequences, the causes, and the special tests and analysis which is conducted, which we will talk to you about in detail, are then fed back and the entire loop is iterated back and forth until we finally decide on those events which are still possible or probable and work those until we can either prove or disprove them, hoping to come out with conclusions as to what the causes were or findings.

And today what we're going to present to you are some findings, and I think. some of these elements, we are going to show that there is a very, very low probability that they contributed, in all probability they did not, they are not probable causes.

Others, we're going to report to you on the status of our analysis and investigation.

If I could have the next chart, please.

(Viewgraph M-2.) [Ref.3/7-31]

This is the beginning of the abbreviated. If you can scan in on the left-hand side of that chart if you will, please.

The time line that I have shown here begins

2048

before T-zero. It begins with the SSME start command. As I stated earlier, I have abbreviated the time lines and the events just for the sake of clarity, and the start of this event in this time line is for the launch itself.

As we develop possible failures which were caused by any one of the elements that require that the time line begin earlier than this, during the checkout and processing of any one of the elements, that is shown with those particular scenarios.

I will now present to you evidence as we know today to be factual-it is not derived data that I am going to show-that goes with each one of the events of the time line. And so this is a given to any one of the detailed failure scenarios that you will see.

Starting with the SSME startup, that is the main engine startup, that begins at approximately 6.6 seconds before T-zero, which is the ignition signal to the solid rocket booster motor. Subsequent to that, at about one-half a second, .531, we saw-and if I could have chart M-8, please.

(Photograph M-3.) [Ref. 3/7-32]

We saw a puff of smoke at the aft field joint of the solid rocket booster motor. We have deduced from photographic evidence from multiple camera positions that

2049

the puff of smoke is coming, originating from between the solid rocket booster and the external tank. It is in the quadrant that is to the right of the picture as you see it there and on the far side of the solid rocket booster.

That smoke was evident from .5 seconds up until a little less than four seconds. There are some photographic observations that indicate that that smoke and gases can be seen as late as 12 seconds. That is still under investigation by enhanced photography.

CHAIRMAN ROGERS: At what point in the time line do you think the smoke occurred?

MR. MOSER: It occurred at .531 seconds after ignition signal to the solid rocket booster.

CHAIRMAN ROGERS: About a half a second after liftoff?

MR. MOSER: Yes, sir.

[1127] CHAIRMAN ROGERS: And how closely have you identified the source of the smoke?

MR. MOSER: What we have done is we have identified it to be originating in the quadrant of the solid rocket booster, to the right-hand side of the solid SRM as you see it there, and between the SRM and the external tank.

We have not pinpointed from our enhanced

2050

photography the exact location of the source of the smoke yet, sir.

CHAIRMAN ROGERS: How close are you to doing that?

MR. MOSER: I can't answer that right now. We thought we were about there about ten days ago, and that photography enhancement has not panned out and proven that yet, sir.

One of the cameras that had a better view of that was non-functional at the time of launch. So we are having to use some other techniques, and I don't know that we will be able to, with the data that we have, to pinpoint exactly what the source is.

We have concluded, however, from the photographic data that it is not coming from the extreme, in this photograph, from the extreme right-hand side of the solid rocket booster, which is where the check port, the test port, is located.

DR. RIDE: Can you put limits on the circumferential arc?

MR. MOSER: No, only to say that it is within that quadrant, Sally.

DR. RIDE: Between about 300 degrees and 210, is that the quadrant?

MR. MOSER: From this photograph, we can't get

2051

it very close. From one of the other photographs that we have during the ascent we can get closer, and I will show you that here in a moment. But that is a different event.

CHAIRMAN ROGERS: It must have been an earlier photograph, though, than this, because the smoke is pretty far up on this photograph.

MR. MOSER: There could have been one, yes, sir. I have chosen the sequence of photographs to best describe it. There is one-we have some photographs that are earlier than this and that are later than this, but this is just indicative of that.

We can provide you with all of the photographs of every frame of this.

CHAIRMAN ROGERS: I think Mr. Stevenson gave us photographs in Washington which were prior to this one, which showed with a little more delineation exactly where the smoke initially came from. Am I correct in that?

MR. MOSER: The photographs that I remember seeing were about from this same angle, the same camera, as a matter of fact, I was just advised. Yes, sir, the same camera.

DR. COVERT: Mr. Moser, where vertically does the smoke first come out? You talked about the angular

2052

position. How about the longitudinal position?

MR. MOSER: It comes out from, in the proximity of the aft field joint.

DR. COVERT: And that's close also to that ring there that we can see there?

MR. MOSER: Pardon me?

DR. COVERT: We can see a strap going around with some cork insulation or something under it, and that is reasonably close?

MR. MOSER: Yes, sir.

DR. COVERT: And that is also reasonably close to where the external tank attaches to the solid rocket motor.

[1128] MR. MOSER: That is correct, sir.

DR. COVERT: Thank you.

DR. FEYNMAN: Isn't it, so is this the black smoke you're talking about at. 5 seconds? Isn't it true that in even the first few frames immediately after the ignition that you can see some white smoke earlier?

MR. MOSER: From comparing the color of that smoke to this smoke, it appears to be a lighter color, yes, sir. I think there is some disagreement as to what the color actually is, whether it is less dense or whether it is the reflections.

DR. FEYNMAN: I'm not worried about the color,

2053

but the time. It seemed to me that it was an extremely early incident in the pictures that could see that.

MR. MOSER: I don't believe it would be before a half a second, though, sir. That is the first visible evidence that we see.

CHAIRMAN ROGERS: Which is the first visible evidence? How would you describe, based on the first photograph that you've seen, the first visible evidence was what? Was it white smoke or black smoke?

MR. MOSER: It was a lighter colored smoke, and I don't want to say it's white. It was not white like the SRB is white, but a greyish colored smoke. That is the way it appears in the photograph.

CHAIRMAN ROGERS: And that preceded what appears to be blacker smoke?

MR. MOSER: Yes, sir, that is correct. It appeared to be-it appeared to be continuous from, certainly from a half a second to about 3.375 seconds it was continuous. After that, it is very difficult to interpret the photographs as to whether or not there is a continuous stream of anything coming out there. In some viewers' eyes and based upon the photographs that we have today, it appears to last as long as 12 seconds. But that is not conclusive at this time.

2054

What I'm trying to do to set the stage here for some of the other detailed work is to tell you what we know to date with a lot of confidence.

CHAIRMAN ROGERS: Well, just to conclude the thought as far as I'm concerned, would you say that in your observation of the photographs the first thing you noticed was smoke that appeared to be white, and right about the same time some black smoke?

MR. MOSER: After that-first of all, it is a light colored smoke, and then it gets darker, as you see it here, and then it begins to dissipate and leave, especially as the flow around the vehicle begins and the vehicle begins moving. And so it begins light and then it gets darker.

CHAIRMAN ROGERS: But would you conclude it all came from the same area?

MR. MOSER: Yes, sir. It appears to all come from the same area.

CHAIRMAN ROGERS: Okay. Thanks.

MR. WALKER: Mr. Moser, have you verified that this phenomenon was not observed on any previous launch?

MR. MOSER: I'm sorry?

MR. WALKER: Have you verified that this phenomenon was not observed on any previous launch?

2055

MR. MOSER: We have-I have, to my knowledge, we have not seen that event on any previous launch. There was a report at one time that they thought that an anomaly was seen after an [1129] SRB separation, but there has not been any signs of black smoke or any type of anomalous venting of the SRB's on previous launches.

MR. WALKER: Thank you.

MR. MOSER: Proceeding on in the time line, at about 20 seconds is where the solid rocket booster begins to decrease its thrust in getting ready for maximum dynamic pressure during ascent.

If I could have chart M-5, please.

(Viewgraph M-5.) [Ref. 3/7-33]

What I have shown here is some data we have acquired from telemetry, which is a presentation of the pressure, chamber pressure of the right-hand solid rocket booster motor versus time. Everything appears to be nominal at the right-hand solid rocket booster as at about 20 something seconds, 21 seconds, when it begins to decrease the chamber pressure. As it goes into the maximum dynamic pressure, everything is nominal essentially during that time.

If I could have chart M-6, please.

(Viewgraph M-6.) [Ref. 3/7-34]

2056

This is again going back to the time line. Everything is proceeding well in the time line. It goes through the end of the thrust bucket, where it experiences minimum chamber pressure in both left and right-hand solid rocket boosters, and then the pressure begins to increase again, as was shown on the previous chart.

Shortly after that, about four seconds, we see our first evidence of the hot gases of the plume coming from the right-hand solid rocket booster. If I could have chart M-7, please.

(Slide M-7.) [Ref. 3/7-35]

In this photograph you can see t he bright spot on the right-hand solid rocket booster, and what we have done to try and enhance our understanding of where things are occurring on the vehicle, we have generated computer-aided graphics of the entire launch vehicle and overlaid them on the photograph so they are to the same scale.

This has enabled us to pinpoint as accurately as we can, with the accuracy of the photographs and the fidelity of the photographs, what the source is from this photograph.

And if I could have M-8 up now, please

(Slide M-8.) [Ref. 3/7-36]

2057

which is a computer-drawn version of that same view. We have isolated that bright spot to be again in the quadrant, as shown right here, on the right-hand solid rocket booster. And that is the first indication of a visual plume coming out of that booster.

This we have been able to-Dr. Ride asked if we could identify it specifically, and this we have isolated to be at 45 degrees on the circumference, plus or minus ten degrees; and in the longitudinal direction we have isolated it to be at the field joint, within plus or minus one foot.

And the reason we cannot get any closer than that is just because of the granularity of the photographs, and also because of the angle of the vehicle to the camera.

DR. RIDE: Where are you taking zero degrees?

MR. MOSER: Zero degrees is on the bottom of the solid rocket booster, so it would be just about where that arrow is on the Z axis.

DR. RIDE: Say again what the foot measurement was, what you were referring to? You've isolated it within the area of one foot square?

MR. MOSER: In the longitudinal direction, we have isolated the plume which you see in the previous

[1130] 2058

photograph to be in the plus or minus one foot of the aft field joint. We cannot tell any more accurately than that from our photographic data; and circumferentially around the solid rocket booster motor, to be 45 degrees from the Z axis or, in this view, the bottom of the solid rocket booster motor.

We then proceeded into maximum dynamic pressure, and if I could have chart M-9 up, please.

(Viewgraph M-9.) [Ref. 317-37]

At 59 seconds we experienced maximum dynamic pressure on the vehicle, which was about 720 pounds per square foot of aerodynamic load. In comparison to other flights, this is less than some of our previous experience. It is well within the design nominal value of maximum dynamic pressure expected.

And the reason-I should point out also on the scale of time line, below the time in seconds shows the throttle profile for the main engines. At this time we had just gotten back up to 104 percent of our maximum thrust out of the main engines. We had been down as low as 65 percent, and that is to keep this maximum dynamic pressure to the levels that I just reported.

Within about a second after that, at a little over 60 seconds, we experienced a divergence in the solid rocket booster chamber pressure. And if you would

2059

display chart M-10, please.

(Viewgraph M-10.) [Ref. 3/7-38]

If you can zoom in just to the lower right-hand part of that. That's good. Thank you very much.

Here you can see a deviation in the chamber pressure, and that is the internal pressure of the solid rocket booster, to that of the left hand. This is-before this time they had been tracking well within our experience base of comparing pressures between these two motors.

So we are beginning to see evidence here that that plume is consistent with a decrease in the measured pressure.

The next thing that we see is evidence of the plume deflecting. And if I could have chart M11, please.

(Photograph M-11.) [Ref.3/7-19]

The plume has grown in size. It is now being deflected because it is impinging on the external tank or because it is being deflected by the aerodynamics. It appears to us now to be deflecting because of impingement of the external tank.

CHAIRMAN ROGERS: I couldn't quite hear the last part of your sentence. What did you say at the

2060

end?

MR. MOSER: It is impinging on the external tank.

Then at 64.6 seconds, there is, we see with the next chart, which would be-no, I'm sorry. Let me just tell you verbally what we do.

We see a change in the possible LH-2 tank leak at that time, because the pressure-the pressure is decreasing. And that is on chart M-13.

(Photograph M-13.) [Ref. 3/7-40]

DR. COVERT: Did you say, Mr. Moser, that that time corresponded with the pressure dropped in the hydrogen part of the external tank?

[1131] MR. MOSER: I'm sorry? Repeat, please?

DR. COVERT: You said at the same time the plume changed character you had evidence that suggested that the pressure drop in the hydrogen tank or the pressure in the hydrogen tank was dropping; is my understanding correct?

MR. MOSER: Yes, sir. And I will show that to you. I'm sorry I got out of sequence here. I wanted to show you the visual evidence that we are seeing of change in the plume characteristic, which is thought to be from the leak, which is thought to be a leak from the hydrogen tank.

2061

On chart-in viewgraph M-13 is-what you see there, that is a plume characteristic. If you will go to M-15, please, and look at the top part of that plume, you'll see a change in character.

(Slide M-15.) [Ref. 3/7-41]

So that it is deflected more down, or appears to have more of a definite node at the top, as opposed to a rounded condition. That is occurring at the same time as M-17, which is the pressure profile. If you would put M-17 up, please.

(Viewgraph M-17.) [ Ref. 3/7-42]

This is the pressure profile of the liquid hydrogen tank. This is where we see that the decrease in the rise rate of the ullage pressure, that is the gaseous pressure in the liquid hydrogen tank is changing over what it had been.

It had been cycling up to that time as the demand required, and the characteristics of those cycles had been consistent within our experience base. Here we see a change in that pressure rise rate which is indicating that something anomalous is going on, like a leak.

And so when I coupled this with the change in the characteristic of the plume coming from the right-hand solid rocket booster, that is two strong

2062

pieces of evidence that we do have a leak at that time in the liquid hydrogen tank. And I will show you some other supporting evidence to substantial that.

CHAIRMAN ROGERS: At what time was that conclusion that there was a leak in the external tank?

MR. MOSER: That was at 64.64, and that is on chart M-16, at the lower right-hand side, Mr. Chairman.

(Viewgraph M-16.) [Ref. 3/7-43]

That is when we see the change in the plume characteristic, at 64.64. And about three-tenths of a second after that is when we can determine from the measured pressure data that we are seeing a change in the pressure rate.

The data rate of the pressure is about five samples per second.

CHAIRMAN ROGERS: If you can conclude at that time that there was a leak in the external tank, can you also conclude that up to that point there had not been a leak in the external tank?

MR. MOSER: With some degree of rough granularity. There could be a small leak, I think like eight-tenths of an inch in diameter.

DR. LITTLES: About four pounds per second of liquid hydrogen could have been leaking without detection.

2063

CHAIRMAN ROGERS: During the whole 60 seconds?

DR. LITTLES: Yes, air.

CHAIRMAN ROGERS: And what would be the size of that leak?

[1132] DR. LITTLES: It would be about a .8 inch diameter hole. I will discuss that in some of these scenarios that I will present.

CHAIRMAN ROGERS: Fine. Thank you.

MR. MOSER: I would like to add-or to tell the Commission that we will provide them with color photographs of all of the copies that you have in there today. Logistics kept us from doing that, so that will be provided to you today.

DR. FEYNMAN: I got confused in interpreting your charts and in what you said. You saw the changes in plume shape at 64.7 or so, and you see the pressure decrease in the rate of rise at 66.7. So it must be about two seconds between, is that right?

MR. MOSER: Yes, sir. I'm sorry, I did state that incorrectly, yes, sir. Thank you.

The next chart is M-18, please.

(Viewgraph M-18.) [Ref. 3/7-44]

Then at a little greater than 72 seconds into the flight is where we see motion of the right-hand solid rocket booster to the rest of the launch vehicle,

2064

and that is shown on chart M-19, where here I display the rotation-

(Viewgraph M-19.) [Ref. 3/7-45]

-of the pitch of the right-hand solid rocket booster to that of the left-hand.

Not shown on this data is the fact that the left-hand solid rocket booster rate gyro is tracking exactly with that of the orbiter, and that is the way all three of the elements or all four elements-the orbiter, the external tank, and the two SRB's-have been tracking up until this point.

It is 72.201 seconds, we see a deviation from the right-hand solid rocket booster. It is our indication that something has failed in the aft attachment of the solid rocket booster to the external tank, and I will show you more of why we have concluded that.

If I could have chart M-20, please.

(Viewgraph M-20.) [Ref. 3/7-46]

This is a computer-drawn picture of the launch vehicle looking down on top with the solid rocket booster released from its lower link. The evidence that we have is that we have lost the load pad at that link. If that results, then the right-hand solid rocket booster then is free to pivot about its forward

2065

attachment point and one of the remaining aft attachment points.

This is consistent with maintaining a data source from the solid rocket boosters, because the integrity of everything going on in the solid rocket boosters, the data flows through the top aft link. What is hypothesized here, and is supported by the analysis, is that the lower left-hand or the lower link has failed, the solid rocket booster has both rolled about that new hinge line so it has a new pitch and yaw attitude.

That is what we measure from the flight data. When it does that, it impacts the inner tank region, as shown here on this drawing, between the LOX tank and the hydrogen tank, there. It impacts it just at the lower portion of the frustum of the right-hand cone of the solid rocket booster.

If I could have the next chart, please.

(Viewgraph M-21.) [Ref. 3/7-47]

In a different view, we see that the SRB has moved up toward the orbiter at the aft end. And the next view, please.

(Viewgraph M-22.) [Ref. 3/7-48]

[1133] This is a view which looks at that same configuration from the forward end, and here you can get

2066

a better feel for how it has rotated about its new hinge line. This impacts the tank, as I said, causing the tank to load up, rupturing the forward L0X tank, the hydrogen tank, and at the same time probably causing the aft bulkhead of the hydrogen tank to rupture.

DR. FEYNMAN: In order to determine the motion of this thing, of the right-hand booster, you have gyros that determine its orientation?

MR. MOSER: Yes, sir.

DR. FEYNMAN: Do you also have inertia measurement to tell whether it moves forward or back?

MR. MOSER: No, sir, just the rate gyro, sir.

DR. FEYNMAN: You don't have any inertia measurement?

MR. MOSER: No, sir.

DR. FEYNMAN: So there's no way to determine the absolute position except to guess that the upper support hadn't slipped yet, is that right? That is how you did that?

MR. MOSER: That is correct, sir, yes. And then that is part of the continuing photo analysis, too, is to verify that it is in fact still attached there. We did not see any other motion, and I don't know that it is a sufficient solution to look at the rate of change of both pitch and yaw, given that the

2067

fixed geometry, okay, of rotating about those points, all of that data supports itself.

And then looking at the times at which the SRB rotating would have bottomed out and induced high loads in the tanks, is when we see changes in the pressure and also see physical evidence, visual evidence I might add, from the tanks, where they are beginning to lose liquid hydrogen and liquid oxygen.

And so we have about three pieces of data which supports that.

MR. RUMMEL: The aft rupture in the ET is after the explosion, due to explosive force? On what do you postulate the cause to be?

MR. MOSER: I'm sorry, Mr. Rummel. Could you repeat that, please?

MR. RUMMEL: I think you mentioned that after the LOX tank and the hydrogen tank and the inter-tank area had been damaged, that was followed by a separation in the aft end of the hydrogen tank. Did I understand that correctly?

MR. MOSER: Yes, sir. Let me verify that. We first see that, the spillage of the aft dome of the liquid hydrogen tank, at 73.137 seconds. We see-that is visually, and I think I'm going to show you a picture of that in just a moment.

2068

MR. RUMMEL: Well, my question-perhaps you're coming to it-is the cause of the aft rupture. It appears that the SRB didn't hit the tank in that area. Was this due to overstressing from the rupture forward?

MR. MOSER: Yes, sir. The aft attachment is connected, the remaining aft attachment about which it is rotating, is connected right at the seam of the aft bulkhead to the cylindrical portion of the tank. And as soon as it rotates over and interferes with that region, then it loads it up in an out-of-plane load for the tank, and so it should rip the tank right in that region.

[1134] Plus, the solid rocket booster is rotating about 40 degrees per second at that time, and so it fits with the analysis that we have done that says that, it should have in fact tore the tank in that region.

MR. RUMMEL: So you're postulating the failing of that part of the attach fitting that is attached to the ET at that point in time?

MR. MOSER: That is correct, sir.

MR. RUMMEL: Thank you.

CHAIRMAN ROGERS: Mr. Moser, yesterday we looked at the debris and the right frustum is badly damaged. The left one looks as though it's not damaged at all. The right one seems totally consistent with

2069

this photograph.

Have you seen that debris? In other words, the right frustum has damage which would be almost totally consistent with that photograph.

MR. MOSER: It was reported to me. I have not physically seen it myself, but it was reported to me what it appeared, and it does appear to be consistent with our failure model here, yes, sir.

DR. RIDE: Do you think that the contact between the SRB and the upper portion of the tank, the LO2 tank, is what caused the LO2 tank to rupture?

MR. MOSER: Yes.

If we could proceed on to the next chart, please, which would be M-23.

(Viewgraph M-23.) [Ref. 3/7-49]

Here, I have already described the time of events of when we see the ullage pressure drop. Go to M-24, please.

(Viewgraph M-24.) [Ref. 3/7-50]

It is-and I'm going to repeat myself somewhat here. At 72.564 seconds is the point you see here on the ullage pressure of the liquid hydrogen tank. It can now not keep up with the demands, with two flow control valves open.

Up until that time, the pressure had been

2070

decreasing, but it had been maintaining its pressure. Now it can no longer do that. And Dr. Ride, that is when we think that the forward-we have lost the integrity of the forward end of the hydrogen tank.

DR. FEYNMAN: Sir, I hate to interrupt you. While we have the chart up, I notice that the decrease coming down earlier-and we're talking about something earlier and so I'm interrupting-from 64 seconds, the decrease is slower than the previous decreases.

Can we interpret that in some way?

MR. MOSER: I don't think I can give you an adequate discussion of that. We had seen, I think if we go all the way back in the pressure profiles, that that was not uncharacteristic. But I will verify that for you.

DR. FEYNMAN: Thank you. I'm sorry to interrupt you.

MR. MOSER: No, that's quite all right.

If you would go to chart M-25.

(Viewgraph M-25.) [Ref. 3/7-51]

Here we see the actuator motion from the right-hand. SRB, and that is very simply the flight control system trying to respond to what the rate gyro from the SRB is telling it to do. And so that tells us our flight control system is still behaving properly at

[1134] 2071

that time.

It is-

VICE CHAIRMAN ARMSTRONG: Is the rate gyro package a two-gyro package or three?

MR. MOSER: It is a three-gyro package-excuse me. Two axes, two gyros.

On chart M-26-

(Viewgraph M-26.) [Ref.3/7-52]

-now that both the LOX and the hydrogen tanks have lost their pressure, we see the inlet pressure to the SSME's dropping, and that will be discussed more by Mr. Hopson on what that event means to the main engines.

(Viewgraph M-27.) [Ref. 3/7-53]

M-27 is the same type of data for the LOX pump.

If you would go to M-28, please, back to the time line.

(Viewgraph M-28.) [Ref. 3/7-54]

This is where I pick up, at 73.137 seconds, the vapors near the inner tank region, and that is shown on chart M-29.

(Slide M-29.) [Ref. 3/7-55]

It's going to be very difficult for you to see the vapors in the inner tank region. If you can scan up

2072

just a little bit on that, you can barely detect it. This photograph in the display here is not adequate, but that is our first indication that we can see vapors coming from the forward.

Also, at this same time there is spillage from the aft region beginning to initiate. Then in M-30

(Slide M-30.) [Ref. 3/7-56]

-we can see the increase in the vapors coming from forward, and here you can see it along the side of the external tank, just a few tenths of a second later. And then M-31, please.

(Viewgraph M-31.) [Ref.3/7-57]

Again, with the overlay from our computer-aided drawings, that is about the characteristic of the vapor coming from up forward.

M-32, please.

(Slide M-32.) [Ref. 3/7-5581

We now see a bright flash between the orbiter and the external tank, and what that is an apparent-and we can't prove this conclusively, but it appears to be now that that is a reaction or a burning of the liquid hydrogen and liquid oxygen. They have now mixed sufficiently in that region as they flow back to flash. Up until that point, it had just been vapors.

And then the next chart, please, M-33.

2073

(Slide M-33.) [Ref. 3/7-59]

And that same type of thing propagates forward, and continuing to bum.

The next chart, please.

(Viewgraph M-34.) [Ref. 3/7-60]

That is just a highlight of where this rupture initiated with the LOX tank.

M-35, please.

(Viewgraph M-35.) [Ref. 3/7-61]

[1136] What I have done with the time line, as best I can, is to sort out anything-we try to have it as factual and true to feed into the other failure model analyses. We have categorized or

GENERAL KUTYNA: Mr. Moser, before you start on that, I wonder if I could pursue one point on the winds and air turbulence. We saw down at Marshall that the flame appeared on the side of the solid rocket at 58 seconds, and we had our max aerodynamic pressure at 60 seconds, so that was after the flame.

However, I think it is important, as you told us before, that it was quite a bumpy ride prior to that time. There were air currents or wind changes that caused the flight controls to react considerably more than we had seen in the past. While it was not out of limits, there was more activity than you had seen.

2074

Could you characterize that for us?

MR. MOSER: Yes, I will do that. I do not have a detailed discussion for you today, but as the plume emanated from the solid rocket booster we have gone back through simulations and analysis to try and correlate the vehicle response.

GENERAL KUTYNA: No, prior to the plume, as you're going through.

MR. MOSER: Prior to the plume?

GENERAL KUTYNA: Yes. Could you characterize that? You said the nozzles were working harder than they had before.

MR. MOSER: That region, we have reconstructed all of the loads and the dynamic response of the vehicle from liftoff up until that point. The max dynamic pressure region we have not completed yet. I will give you my view of where it is at this time.

Everything appears to be okay, but we have not recreated all of the trajectory parameters.

GENERAL KUTYNA: Jack, do you know what I'm driving at?

MR. LEE: Yes, General, I believe I do. I believe we reported at that time that, even though-well, you characterized it as a rough ride, with game wind shears. They were within our flight data base.

2075

Now, what Mr. Moser is referring to is the Max Q region. We do not have that completely reconstructed yet to be able to relate all the vehicle activities to that.

I would like to point out, General, that even though you mention Max Q at 60 seconds, Max Q really is kind of a region, say from 58 or so. It is not specifically a point. So we do relate the first evidence of hot gas emanating from the solid rocket motor as being in the region of Max Q for our analytical purposes.

GENERAL KUTYNA: But the point I was trying to make, and see if you agree with me, there was quite some load, although not out of limits, but there was some load on that vehicle prior to Max Q, from 40 to 50 seconds, that might have given it some stresses. Not out of limits again, but it could have given it some stresses that could have caused something.

MR. LEE: Yes, sir. At about 40 seconds we did see some wind shears that gave us about a two degree rate, which is not out of our data base again, but it is not exactly nominal.

VICE CHAIRMAN ARMSTRONG: Would you like to comment on the TVC limit cycle in that time?

MR. LEE: As it relates to that, the 40

2076

seconds?

VICE CHAIRMAN ARMSTRONG: Yes, where the limit cycle reached.

[1137] MR. LEE: Can I refer that to Dr. Littles? Do you know that?

DR. LITTLES: I don't believe that the limit cycling at that point in time was really anomalous. I have heard it referred to as we were working them hard and that kind of thing, but I think that is a qualitative assessment.

I think the data we were getting was within the experience base. It is true that at Max Q we were seeing the loads that those may have had an impact, for instance, on the joint if we had something anomalous in the joint already, is what we believe.

The loads don't look to be near design limits at any point in time during there. We do still have some work to do, but the work we have done to date doesn't indicate that the loads are anomalous. We do, however, have more work to do looking at the 51-L loads, specifically as they apply to the joint for 51-L and as they might relate to some potential anomaly in the joint. So we do have some work to do there.

MR. MOSER: Thank you.

I think it is important for this, too, it

2077

really appears now that everything is within the design limits, but what we're trying to do is reconstruct from the actual data and the best estimated winds and trajectories and everything else what the load is. And even if it is 30 percent of the design load, we want to know exactly what it is, to see if it is in fact contributing to already weakened joint.

And so it will be-I think that that analysis will be completed, perhaps this week-I'm sorry, next week is I think the schedule we are on for that.

DR. FEYNMAN: We ought to say what "Q" is. It is the resistance, the force of resistance for moving through the air, or the combination of the density of the air and the speed squared, I think, that you move through?

MR. MOSER: Yes, sir.

DR. FEYNMAN: As it goes faster, it is increasing, but as you go higher the density is decreasing. So it reached a maximum and then falls off as we go into the vacuum of space further UP.

MR. MOSER: Yes, sir, right.

DR. FEYNMAN: It's just worth explaining.

CHAIRMAN ROGERS: Does that complete your presentation?

2078

MR. MOSER: No, sir. On chart M-35, what I have done is I have categorized the anomalies as we know them, and that is our category A, and those are the events that I have just gone through associated with the time line.

There are other possible anomalies, conditions, that we also know of that can be contributors to this accident. For instance, the temperature or the water in the joints, the dimensions at stacking, and on and on.

Now, all of those things then are picked up by the specific element which that can effect its failure and whether it could have caused it, and so that is our category for possibles. And we will have another list of anomalous conditions, those which we have derived, and so we hope to put those in the appropriate basket.

On chart M-36

(Viewgraph M-36.) [Ref. 3/7-62]

-this chart will serve to introduce the very top level of the failure analysis, starting with the explosion and then the external tank breakup, which we know, and then we want to get into unknowns of the causes.

[1138] The color code that you see here is green, a green indication along the analysis path, indicates that

2079

it is improbable.

Today we will talk to you about-if you will move that, your camera, over to the right, please-we will talk about the orbiter, the main engine, and the cargo, the IUS, as being improbable to have caused the accident.

To the left, the things which are still possible are the external tank; and probable is the solid rocket booster.

And I would now introduce Dr. Littles, who will talk about the failure analysis associated with the external tank.

CHAIRMAN ROGERS: Mr. Moser, before you do that, may I have the pictures that we are referring to? I think we referred to them as 35. Can we show that first?

And the reason I want to do this is because there is so much discussion about a white flame first, or white smoke before the black smoke, and there's been all kinds of articles written about it, and so forth. And the photographs really don't show it.

Can you see this?

(Slide.) [Ref. 3/7-62]

MR. MOSER: Yes, sir. That in contrast-the lighting changes here, too, I think, with the

2080

reflections and the intensity of the engines, and so that is one possible explanation for that.

CHAIRMAN ROGERS: But we're all talking about the same smoke?

MR. MOSER: Yes, we're all talking about exactly the same thing.

CHAIRMAN ROGERS: That is what I wanted to got straight for the record, because there has been a lot of discussion about the white smoke and black smoke, as if there were two different accidents or incidents. This suggests there's just one.

DR. LITTLES: I think it is just one instance, but I think if you look at different cameras and with different shadings you can get different impressions, of the color. There is a black and white camera that we have some photographs of, and if you look at that-or when I look at it, and I'm not a photographic expert, but when I look at it the first smoke that I see does look more white, and then later it gets dark.

So I think you get different impressions from different films.

CHAIRMAN ROGERS: Does everyone agree it's all the same smoke?

DR. LITTLES: I believe everyone agrees it is all the same smoke, yes.

2081

CHAIRMAN ROGERS: Thank you very much.

DR. LITTLES: Could I have L-1, please.

(Viewgraph L-l.) [Ref. 3/7-63]

This chart continues where Tom left off, and in his chart he had the external tank and the SRB in a circle, and so I am picking up at that point and carrying to the right a little more detail at this point the items that we have been investigating and some that we are continuing to investigate.

There are some things which we have categorized as improbable and shaded green, both on the external tank and the solid rocket booster. Would you come a little closer to the right top so I can see the blocks a little more clearly. Thank you very much. That's good.

[1139] Okay, coming down from the top, the damage at liftoff and going over to the right, the pad debris. Those we have shaded yellow at this point and I will discuss those later within other scenarios. I won't go any further with that at this point.

Now, premature detonation of the linear shaped charge has been ruled as being improbable. That is based upon physical data, the hardware that has been recovered. We have recovered portions of the linear shaped charge and they weren't detonated, and so we know

2082

that wasn't the cause of the explosion of the external tank.

A structural flaw, I will discuss also later that line, so I will leave that one for now.

Now, structural overload, we have touched on that in the last few minutes. We have looked at the loads. We have a complete reconstruction now of the liftoff loads, and we see nothing anomalous there. The loads are well below design.

We have done a lot of work already on the Max Q and the other phases of flight and, as Mr. Moser said, we haven't completed that, but the data that we already have indicates that that is not a probable cause. We are going to continue to do that reconstruction, and we should finish that within the next I think week or ten days and rule that one out.

DR. COVERT: Dr. Littles, when you say you have ruled it out or potentially ruled it out, do you mean as a single cause in and of itself, but initially there could be other events that took place so that that combined with these loads could in fact be a potential cause? Do I understand you correctly?

DR. LITTLES: Yes, air, that's absolutely correct. As I mentioned a minute ago, we are still particularly interested in these specific loads for

2083

51-L, for instance as applied to the 51-L joint. And so there is continuing work in that area and will be even after we look at the final reconstruction of the loads. I will discuss that as I go through some of these other scenarios.

But we are doing some work in that area and we will continue to do that for awhile.

DR. COVERT: Thank you.

DR. LITTLES: We have lost our screen. I will continue from the chart, then.

All right, then. To the right of structural overload, the block is the thermal protection system on the external tank. We think that to be an improbable cause for initiating the failure. We have done analysis assuming that we have lost TPS in various places on the tank and through the flight regime that we had progressed before we had the problem and the failure beginning at 59 seconds.

We didn't see any areas that would be overheated to the point of having a failure. We also have photographic evidence and don't see anything there, and so we don't believe a loss of any part of the thermal protection system on the tank initiated the failure.

Coming down then to the solid rocket booster,

2084

the same comments that I made relative to the external tank apply to the structural overload and to the liftoff and flight loads. But again, as Dr. Covert points out, we are still interested in those loads relative to other potential failure modes.

Relative to the item on the bottom, the premature linear shaped charge detonation, we know of course that the range safety system operated properly when we gave-when the range gave the boosters destruct at roughly 109 seconds. And so we've ruled that out, or we think that is an improbable cause of failure.

[1140] Now, case membrane anomaly, to the bottom right, that is covered in one of the scenarios that I will address, and so I will cover that one later. And also, the SRM pressure integrity and the joint seal, those are the primary items in the scenarios that I will present, and so I'll cover those in the next few charts.

Going then to L-2 -

(Viewgraph 1,2.) [ Ref. 3/7-64]

What I have on this chart is all of the scenarios that we are pursuing for the hot gas leak. I will step through these one at a time. The line that I will be pursuing is highlighted in red, so you can

2085

follow it through.

What I will do is describe for you the failure mechanism which is hypothesized for each one of these lines. I will mention to you the work that we are doing, the analysis and the tests that we have going on to assess that hypothesis, and then I will give you a summary of our findings to date. And if we think we can say it is not probable, I will indicate why.

Okay. The first one, then, as you see in this chart is the solid rocket motor inhibitor flaw. Could I have chart L-3, please.

(Viewgraph L-3.) [Ref.3/7-65]

Okay. This is a schematic representation of the joint. I think you have seen this before. The failure which is hypothesized in this particular scenario is that we could have possibly had a flaw in the inhibitor. I Come in a little closer, please, just at the top. Move it up to the right, please.

Okay, you see the indication there of the molded inhibitor. If we had a flaw in that inhibitor-and it would have to be fairly large, something like an inch in diameter. If you had a flaw there and you started burning, getting hot gas through that flaw and igniting the propellant and had the propellant started

2086

burning back toward the case membrane, then you could create a situation where in the time frame near 60 seconds you could get a burn-through of the membrane.

In this particular scenario, as you see, it is nut dealing with the joint itself on this leg. It is dealing with the potential of a case membrane burn-through someplace other than the joint.

We have done a number of things in looking at this. We have reviewed the build records and process papers for 51-L, the right aft segment inhibitor. We have reviewed our experience base with these inhibitors, and we have done some analysis to determine whether by analysis that failure mechanism is possible.

One thing that we know is that the molded inhibitor is laid up, it is eight plies of rubber which are vulcanized together. Now, having eight plies of rubber vulcanized together, it is not likely that you would have a flaw in eight pieces. So that is against having this particular scenario be true.

We have had no previous problem with this inhibitor. The problems in this area are not in our data base. The analysis of that, as I mentioned, indicates that in order to get the burnthrough or the burn-back of the propellant and the burn to the insulation and burn through that insulation and do that

2087

in the time frame of 59 seconds would require about two and a half times as much heat transfer as you would expect to get at a maximum there.

[1141] So that doesn't make it look likely.

There are a couple of things that are positive. It could-as Tom mentioned, we saw a pressure change at 59 seconds in the motor. In order to have a failure somewhere inside the motor with anomalous propellant burning, you have to get it at a place where it won't allow the pressure to change in that motor. Normally, if you had a crack in the propellant which came from the middle down, you get a higher burn rate. You would see a higher pressure.

In this particular area, since you're burning back and beneath the propellant, you wouldn't see an increase in pressure. It would be very slight. It would be less than the bit change on pressure, and so that would support it.

But all of these things taken together-oh, another thing, too, of course, is that this would not be consistent with the smoke puff that we see initially. This would happen some time later in flight. And so, taking all of these things together, we don't think this is a probable scenario, and we have listed it as not probable.

2088

Could I have L-4, please.

(Viewgraph L-4.) [Ref. 3/7-66]

On this particular one, I'm going to discuss two routes of a scenario together because they are very similar. This one hypothesizes what was mentioned a minute ago, the small hydrogen leak which you could have and not detect it with instrumentation, and that, as we mentioned a minute ago, is four pounds per second.

If you had a leak of four pounds per second and it leaked and the hydrogen burned and impinged either on the area of the joint, the aft field joint, or on an area of the membrane and heated it up enough, you might generate a failure, and that is what this hypothesis is.

Okay. The failure mechanism again is you have to have either an undetected flaw in the structure of the tank or you would have to have debris or some foreign object strike the tank at or near liftoff and cause the hole to create the leak. And then, as I said, the hydrogen bums and impinges on some location of the solid rocket motor and overheats either the joint or the membrane to cause the failure.

I have mentioned that we have established the size of that hole that is within the limitations of the instrumentation. We have reviewed all of the tank build

2089

records and we are reviewing any potential for pad debris.

We have done analysis to determine what kind of heating we would get if we had burning hydrogen impinging either on the joint or the membrane. And we are also conducting tests to characterize hydrogen burning against the foam thermal protection system on the tank.

DR. FEYNMAN: Is this to explain also the black smoke?

DR. LITTLES: It could explain the black smoke, yes, because if you had the hydrogen ignite and bum on the TPS, you can get black smoke from smoldering TPS. So it could explain that if you had the hydrogen at ignition.

What you have to hypothesize is that actually, of course, the ice team went out, as has been reported, previously to the mission, about 20 minutes prior to launch and they didn't see anything that would indicate a leak. And I believe if there had been a leak there at that point in time, they would have seen some indication of it.

And so the leak somehow has to occur between that point in time and a half a second after ignition to be synonymous with the black smoke. So you're talking

[1142] 2090

about debris or either some overload during the ignition transient. And as I will tell you in a minute, we've already talked about the load thing and we don't think that the load is it.

So it really boils down to a debris or something else causing the hole in the tank.

DR. FEYNMAN: Burning hydrogen making the smoke would not be visible as a flame or a light in the photographs?

DR. LITTLES: Well, it depends upon where it is. You know, there is a considerable area that we can't see between the external tank and the SRB, and so it could be burning in an area where we don't have photographic coverage, possibly.

The smoke that we see initially, it is indicated to be somewhere between zero degrees around toward the tank. It could be burning in an area where those cameras even can't see it, and it could be emanating from the back and coming around. It is hard to say.

CHAIRMAN ROGERS: On the hypothesis, though, don't you have to conclude that debris hit the external tank and caused the leak, and that then caused the-what, it would cause some damage to the right booster, and all of this within a half a second?

2091

DR. LITTLES: No, sir, not all of that within a half a second. If you have the hydrogen burning from the tank

CHAIRMAN ROGERS: On that hypothesis, though, what would cause that? What do you think would cause the leak in the external tank at that point?

DR. LITTLES: Well, it would have to be debris. You would have to have debris or something from the outside, we think. It could of course be a flaw in the structure which is overloaded and leaks.

CHAIRMAN ROGERS: And you've looked at that and excluded it?

DR. LITTLES: We haven't completely excluded it, but it is becoming remote. We are going back through all X-rays and all build records. We have had at least three different people review all of the X-rays, and so far we've found nothing in that area that is anomalous.

We haven't quite completed that yet, but it is

CHAIRMAN ROGERS: Continuing with the hypothesis, though, about the debris, suppose there is debris there. When would that have hit the external tank and caused the leak?

DR. LITTLES: Well, in order to be consistent

2092

with the puff of smoke initially, it would have had to have been at that time or slightly before, some time before that time, to be consistent with the puff of smoke.

CHAIRMAN ROGERS: Okay. Is there any evidence at all of any debris that might have caused that?

DR. LITTLES: We haven't found anything yet. That is still being looked into, but we have no indications of anything anomalous there. That is still something

CHAIRMAN ROGERS: But it is at least a possibility?

DR. LITTLES: It is a possibility, yes, sir. But it is not something that we have seen on photographs or the movies that we can point to. I wouldn't say personally that it is a strong possibility.

VICE CHAIRMAN ARMSTRONG: Dr. Littles, if there were a hydrogen leak that you had at T-zero or approximately and it was ignited immediately, how long do you think it would take for it to heat up some area, to make black smoke?

[1143] DR. LITTLES: We have done that analysis and I'm going to discuss that now. We started this analysis is an iterative process. We started assuming that we had hydrogen burning with complete combustion

2093

somewhere on the tank and flowing down by the tank within the boundary layer and heating up the joint.

That type of heating on the joint did not give us enough heating of either the joint or the membrane to cause a problem. We then went to the assumption that we had a jet of hydrogen coming out of the tank and impinging directly on, over the distances there, impinging directly on the joint or the membrane.

DR. FEYNMAN: By "the membrane," do you mean: the metal surface of the rocket?

DR. LITTLES: Yes, sir. It is a little thinner than the joint. If you move down just a few inches, it is a thinner cross-section.

DR. FEYNMAN: About how thick is it?

DR. LITTLES: I have that on a chart here. I never can remember the numbers. It is .479 inches, the membrane itself.

If you make that assumption, if you assume that the hydrogen is leaking from the tank and impinging directly on the surface, and if you assume that you have complete combustion-that is, you have all of that hydrogen mixing well with air-you get a stoichiometric mixture and it burns.

You can get temperatures under those conditions that would create some problems, for

2094

instance, on the joint. You could have a temperature of approximately 900 degrees. If that happened for roughly 60 seconds, a 900 degree temperature on the joint would open the gap enough to unseat the O-ring, and you could get leakage coming out of there.

During that same period of time, with the same assumptions, you might heat the membrane up to 1300 degrees. Now, those numbers, however, let me quickly add, are unreasonable from the standpoint that we assumed complete mixing to get that. We did that as a test case, to see if we could just put it to bed and forget it. These numbers say that we have to do more work, so what we're doing now is we're going back and doing some jet mixing, get a more reasonable combustion in there, and see what more reasonable numbers will do.

Now, we are also going to do a test. In fact, we have already started some testing where we take a hydrogen tank with a hole in its side, ignite the hydrogen as it flows out, impinge it on a surface with a thermocouple, and get some physical evidence. And so we are doing both of those things to try to put this one to bed, and that is the direction we are going at this point in time.

Okay, could I go to L-5, please.

(Viewgraph L-5.) [Ref. 3/7-67]

2095

The next six scenarios-I'm sorry. Five out of the next six scenarios all deal with the joint itself. Before I move into those, we have been looking very carefully at both the left and righthand boosters for 51-L. We of course have three joints on each vehicle, and we have looked very carefully at similarities and differences between those joints, because of course we had one anomaly on one joint, we had none with the other five as far as we know.

And if you look at the temperatures on all those joints, you find that there really is not a lot of difference in the type of ranges that we're talking about.

[1144] Could you come a little closer to the center so that we can see the temperatures, please. What you see there is, on the right-hand booster the aft field joint, the temperatures around the booster circumferentially range from 28 degrees to 52, and that is about the same temperature that you had at the top.

Now, I'm quoting nominal numbers and these are-we have been through the reconstruction that was discussed earlier with the IR sensor and those have been played into the analysis, and these are nominal numbers that I'm quoting in both cases just for comparison purposes.

2096

On the left-hand boosters, you see roughly the same kind of temperatures, and so the temperatures were roughly the same for all of the joints.

In terms of the loads, the on-pad liftoff loads, where we saw the puff of smoke, the maximum load is not at the aft field joint. The maximum load is at the center joint. The maximum load, however, at Max Q is at the aft field joint, but at the liftoff case, we first saw the puff of smoke, the maximum load would be on the second joint.

If you will move to the right, please. There's a note on the right relative to joint rotation which we will discuss in some following scenarios, and the subject of a lot of discussion.

If you look at the joint rotation that you get on the various joints, the lowest joint rotation that you get is on the aft field joint, because the rotation is a strong function of pressure. As a matter of fact, the pressure is the major driver in that, and you have a lower pressure in the aft field joint than you do at the forward two.

2097

The pressure at the aft field joint is about 760 psi. By the time you get to the forward field joint it's about 900 psi. So the rotation is lower at the aft field joint.

Would you scan to the bottom and pick up the two notes. There are two things that we have discovered that are unique relative to this aft field joint: on the right. One of them is, in a scenario that has been discussed somewhat this morning, we did have to use the rounding fixture which was described earlier to mate those segments.

And the note here that I have says this was the maximum reshaping to date. There is some new data which was mentioned to you this morning, which we just found out yesterday. When we made this note what we were referring to was the data that we had looked at that point in time.

The first thing we did when we started looking at this data base-and we are continuing to do that-we picked all of the segments which had been subjected to this rounding tool, thinking those were probably the population of the worst data and this is the worst one out of that group where the rounding tool has been used.

And there are some others that we will have to look at, but it was anomalous in that data base, in that

2098

if you took the six where the rounding tool had been used, this one would have been at something like a three sigma extreme relative to the amount of rounding that had to be done on it. So it stood out from that standpoint.

We also have another thing that I will discuss, in that on this particular mating, the aft field joint, we have a photograph which indicates a suspect O-ring in the aft field joint, and I will discuss that later.

And so there are some similarities between the joints, the things like rotation going in the wrong direction, temperature is about the same.

[1145] Oh, one thing that I omitted to mention is that if -you look at squeeze on the O-ring-and those numbers are on the chart. The squeeze on the O-rings on the right, on the joints on the right booster, are roughly the same, and they are a little lower on the left-hand booster, and so there is nothing there that stands out.

DR. FEYNMAN: Excuse me. About the squeeze, this is a single number, but as you go around the circumference I presume the squeeze must vary. The two pieces don't fit absolutely perfectly. There are stresses and strains.

2099

So the question is what was the maximum squeeze or the minimum squeeze? How does it vary as you go around? Can we say anything?

DR. LITTLES: Well, you are right. You're absolutely right. What we are quoting here is the minimum squeeze, and you get that minimum squeeze by assuming the maximum eccentricity of the joints and considering the actual dimensions, the measured dimensions of the tang and the clevis for this joint.

Now, you can have cases, I believe, where you can have probably metal to metal on one side, with almost complete squeeze of the O-ring, and then the other side it depends upon what those dimensions are. And so you're right, you're absolutely right, you could have a large variation around the circumference.

DR. FEYNMAN: And that can have an effect, because the thing is cold and it is squeezed very hard, and then due to stresses or with the pressure it changes the dimensions and leaves a little gap because it doesn't have the resilience on account of the lower temperature.

That is an interesting possibility, so that it is important to think about the variation of squeeze around the circumference.

DR. LITTLES: Yes, sir, that is correct. As a

2100

matter of fact, relative to resiliency, the maximum squeeze I'm sure is worst case. That is absolutely true.

So you have to consider both. But on the other hand, if you look at these numbers you can see that the maximum-the minimum is about the same, so the maximum is probably about the same as well. But you are correct.

Okay, could we move on now to L-6.

(Viewgraph L-6.) [Ref. 3/7-68]

Okay. L-6 is the scenario that deals with the topic that was discussed this morning and which was one of the notes on the prior chart, and that is the potential damage to the primary and/or the secondary O-ring at assembly.

Due to the out of round condition, the mating process has been well discussed this morning and so I won't go into that at all. And I've already mentioned that we've made the comparison with some other data and we find this one to be a little anomalous.

We are doing some additional things to evaluate this condition. We are going to do some tests to simulate the conditions, which I will discuss in a moment, that we had on this particular joint. We have a partial segment that we are going to simulate the right

2101

conditions and mate and de-mate with O-rings in there, and see if we can induce some damage. We are also going to simulate defects in some O-rings to see if we can get past the leak check, because if you damage an O-ring during assembly-and this one did pass the leak test [1146] you have to have it in a position some way where you can pass the leak test and still get performance.

We are also requesting, and I understand that it is going to be done, that we de-stack STS 61-G. STS 61-G is one of those which has had the rounding fixture used in mating that joint. It is not as bad as this one was, but it is, I believe, the next worse that we have seen in use of the rounding tool.

And so we're going to request that one be carefully de-stacked, using very careful procedures, to see if we can see any damage there.

MR. SUTTER: Can I ask a question or maybe make a suggestion? I am still interested in the fact that you put a load on that one joint, and you make the note that that is one thing you're going to study, but that load is put on there and the pressure check is made in the assembly hall and then the unit is taken out and put onto the launching pad and it sits there for 28 days.

2102

And I know the metal isn't up to yield, but you've got the insulation and you've got the charge, and maybe it wants to go back to where it was, and what happens in those 28 days? And shouldn't this analysis be expanded to maybe look at the effects of what happens while it's sitting there in the weather for 28 days?

DR. LITTLES: Yes, sir. We have that exact thing going on. We are going to take-start with mating, with stacking the segments, and carrying it all the way through the flow and doing that total analysis. We have that in process.

CHAIRMAN ROGERS: Somewhere along the line I guess we should take a recess for lunch. Is this a good place to stop, or would you rather continue?

DR. LITTLES: It's your pleasure.

CHAIRMAN ROGERS: How much time do you have?

DR. LITTLES: It might be good to stop now. It might take another 10 or 15 minutes to finish this one.

CHAIRMAN ROGERS: Well, maybe we should have a recess.

And are you going to talk about the possibility of ice in the joints?

DR. LITTLES: Yes, sir. That is one of the scenarios I will discuss, yes, sir.

2103

MR. MOSER: Mr. Rogers, I think I didn't give you a crisp answer between the difference in a fault tree and a failure scenario. Let me see if I can do that just a little bit better.

As you continue, these fault trees are the things which could have gone wrong, and the failure scenario then is the process to determine if they did or didn't, what did or didn't, or why that did or didn't go wrong.

CHAIRMAN ROGERS: But then you gradually exclude different aspects of it?

MR. MOSER: Yes.

CHAIRMAN ROGERS: And I gather from reading this that you have, without being totally conclusive, you have generally eliminated the orbiter, the space shuttle main engine, and the cargo inertial upper stage?

MR. MOSER: We will present those facts to you and then present those to the task force, but that is about where we are, yes, sir.

CHAIRMAN ROGERS: Okay. Thank you.

We will come back at 2:00 o'clock.

(Whereupon, at 1:05 p.m., the Commission was recessed, to reconvene at 2:00 p.m. the same day.)

[1147] 2104

AFTERNOON SESSION

(2:10 p.m.)

CHAIRMAN ROGERS: The Commission will come to order.

All right, Mr. Littles, would you proceed, please.

DR. LITTLES: We will proceed with chart L-7.

(Viewgraph L-7.) [Ref.3/7-69]

We were beginning to discuss the out of roundness situation relative to a potential O-ring damage, and again the mating situation was discussed this morning so I won't go into that.

The chart on the screen depicts a number of things, but among those things the dimensions that we actually had on the 51-L right field joint, the first column of numbers. Could you-zoom in on the bottom left, please, se we can read the numbers.

And these were discussed to some extent this morning. The column on the left indicates the initial measurements prior to the beginning of the rounding, and the column on the right the final measurements.

I talked to Bob a few minutes ago and I want to make sure that we are all together. I want to make a correction. He indicated that the dimension was .094 inches, I believe, at the end of rounding, and it was

2105

.094, but that was the dimension before the rounding tool was removed.

The dimension I have on the chart here, .216, is the dimension when the mating was actually made, and so they are both real numbers. It is just at different time frames.

As was discussed this morning, the critical dimension here is the maximum negative dimension, which is in the 120 to 300 degree area of .393 inches. If you will go now to chart L-8.

(Viewgraph L-8.) [Ref.3/7-70]

We have tried to do, Dr. Feynman, something along the lines that you mentioned this morning, to get a feel for what these dimensions mean to us. This is a graphic illustration and it is, of course, not to scale, and what we have done is assume that the clevis is completely round and then take the dimensions that were recorded and move the tang to the outboard leg of the clevis and look at the resulting negative dimension.

And the negative dimension, again, is a potential interference between the surface where the O-rings are and the outboard leg of the tang. And what you see in doing that is that there is a maximum interference potentially of .209 inches.

Now, that is the worst case, of course,

2106

because what that assumes is that you have metal on metal on the outside, and there is a tolerance between the inboard leg of the tang and the adjacent clevis dimension of .184.

So if you subtract those two, you have the other side of that tolerance, which is .025. So depending upon how the tang and the clevis are centered you can have an interference between .025 and .209. So that is of some concern to us.

There unfortunately is no requirement specified on that negative dimension. There is the guideline of the .25 on the positive dimension, but there really should be a tolerance on that side. But that does lead to the potential of having an O-ring damaged as you are mating it, and of course we are concerned about that and that is an active scenario.

I have mentioned that we are going to de-mate STS 6l-G and look at that, and that we are also doing some work at Marshall with some clevis and tang segments, looking at interference [1148] mating and looking at what kind of O-ring damage we might get that might affect the seal and those kind of things.

So we are continuing with that.

DR. FEYNMAN: There's a small trivial point that is confusing me. I don't know how accurate these

2107

drawings are.

DR. LITTLES: They're not accurate at all.

DR. FEYNMAN: Because on the inside where the O-rings are the piece of metal in this drawing has a 90 degree corner, which does cutting much better than if it had a cut on it. And in the previous drawing you had a little cut off of there, and I just don't know.

Does anybody know whether that is a 90 degree piece of metal that comes in?

DR. LITTLES: You're talking about the top of the outboard leg of the clevis?

DR. FEYNMAN: Yes, because on the previous drawing it was indicated that it wasn't so sharp, the one that was on some other speaker earlier on. And I'm just curious.

DR. LITTLES: There is no chamfer there.

DR. FEYNMAN: That is why I mentioned that, because I was told that, by the people who work on it, they've seen this 90 degree sharp piece rubbing up against the curved part as it comes up. You see, as it goes down there is a ramp, so to speak, and they look at it and it worries them. But they haven't communicated it very well up into the system.

DR. LITTLES: Okay. Can we go to chart L-9, please.

2108

(Viewgraph 14.) [Ref. 3/7-71]

We are now going into a leg of the scenario which has four branches, the beginning point for each one of those being a blow-by or leakage of the primary O-ring, and then we will address the four branches individually.

The first one is the secondary O-ring defect. That defect could come from a number of sources: some damage to the O-ring in manufacture, not caught in inspection, or something else. We have been looking at closeout photos from this stacking. We have been reviewing O-ring records. We have been doing special inspections on O-rings.

I will tell you what that has produced, and we are going to do tests to evaluate the performance of a simulated O-ring defect and how it might pass a leak test.

Could we go to chart 10, please.

(Slide L-10.) [Ref.-3/7-72]

There is a closeout photo which I think you've probably seen before for this aft field joint, which has an indication of a potential O-ring anomaly.

Could you go on to chart L-10, please, which is a closeup view of this.

(Slide L-11.) [Ref. 3/7-73]

2109

We have been analyzing this photograph in-house and we have had some experts from outside doing some work

CHAIRMAN ROGERS: Before you do that, could you just explain, identify the photograph, when was it taken and how was it taken and so forth?

DR. LITTLES: It was taken prior to mating, after the O-ring was installed on the aft field joint for 51-L.

CHAIRMAN ROGERS: Do we know the date?

[1149] DR. LITTLES: No, sir, I don't know the date. I have heard it, but I don't have it. I can get that date for you. I don't have it in my mind.

CHAIRMAN ROGERS: But it was some time before the launch, though?

DR. LITTLES: Yes, sir. It was during the stacking.

CHAIRMAN ROGERS: Okay. Go ahead.

DR. LITTLES: This is a closeup view of the same area, and the feature of interest is the apparent increase in the distance between the edge of the O-ring and the top of the O-ring groove. If you look at that, it looks as though there may be an anomaly in the O-ring and some change in the dimension at that point.

The work is still proceeding and it hasn't

2110

been completed, but there have been two estimates of that made and they have both come out in the neighborhood of 15 mils. But we are still working on that.

CHAIRMAN ROGERS: What does that mean?

DR. LITTLES: 15 thousandths of an inch.

CHAIRMAN ROGERS: Is there a deficiency in it? Is it smaller?

DR. LITTLES: Yes, sir, a smaller dimension than it should be. The nominal dimension of the O-ring is .280 inches, and this would be-indicates a 15 thousandths reduction in that.

CHAIRMAN ROGERS: Because the last time we looked at this we were told, I think, that you were uncertain about whether it showed an anomaly or whether this was putty that was put on, that would make it meaningless, or grease, I guess it was.

DR. LITTLES: Grease has been one of the primary concerns in trying to interpret this data, because of shadows it produces and because of the apparent changes in thickness due to the grease.

CHAIRMAN ROGERS: Well, have you decided now it was not grease that made the photograph look like this?

DR. LITTLES: I don't think we can say it is

2111

not grease that makes the photograph look the way it does relative to the streaks. That may be. The thing we are concentrating on is the gap distance between the edge of the groove and the O-ring.

CHAIRMAN ROGERS: In other words, you think there is an anomaly now. At that time you weren't sure; you didn't think there was.

DR. LITTLES: The experts at this point think there is, yes, sir. And it looks anomalous to me, but there is still work going on there and we're not ready to conclude yet. This is an interim report.

GENERAL KUTYNA: Have you looked at the other closeout photos of that ring?

DR. LITTLES: The other closeout photos, as I understand it, have been looked at and they don't see anything.

GENERAL KUTYNA: You might take a look at them. We looked at them a lot the other day and there were a lot of areas of darkness and separation, so that it is tough to tell.

DR. LITTLES: We will look at those again.

VICE CHAIRMAN ARMSTRONG: Have you definitely identified the location of this spot in the clock?

DR. LITTLES: Yes. This is located-the quadrant of interest relative to the puff and the plume

[1150] 2112

is between zero and 270, zero being the Z axis and coming back toward the tank to 270. This indication is not in that quadrant. It is in the quadrant right above it.

It is still in a quadrant that would be hidden and be between the SRB and the tank. So it is in a location where you could have initiated a puff or a leak at that point and have it propagate around.

VICE CHAIRMAN ARMSTRONG: Between zero and 90?

DR. LITTLES: Between 270 and 180.

MR. ACHESON: For the record, does any such slight variation in the gap appear anywhere else on the circumference from the photograph?

DR. LITTLES: Well, we haven't seen it in the photographs we have looked at, General Kutyna indicates that he may have seen something that we should look further at, but we haven't seen it in the things we have looked at.

MR. ACHESON: What I'm getting at is, can you compare this with the remainder of the circumference to see whether-for example, if three or four more such seeming anomalies appeared in the photographs, you would wonder whether this is illusory or significant or what.

DR. LITTLES: Yes, sir, and we have not seen

2113

that. But we will go again and look at those photographs again.

And Jack has pointed out, in this joint we have looked all around it and we haven't seen it.

MR. LEE: In this particular photograph, we have gone as far as we can see on each side of both O-rings and we see no other such anomaly.

CHAIRMAN ROGERS: I'm not quite clear. If this is an anomaly, would it be related to the puff of smoke or is it another area?

DR. LITTLES: It could be related to the puff of smoke. As we've discussed, the exact origin of that puff of smoke is not pinned down. We believe it is somewhere between the plus Z axis or the minus Z axis, excuse me, and around toward the tank, around the SRB.

And we can't see have the two camera locations: D-63, if this is the SRB, pointing in this direction; E-60 pointing in this direction. And if the tank is over here, we can't really see back in this area.

So it could possibly be that, the puff of smoke coming out somewhere in this area and coming around with time. It is possible.

CHAIRMAN ROGERS: When you say it is possible,

2114

but is it realistic to think it is? I mean, is there another area?

DR. Littles: Yes, sir, I think it is realistic to think that it could be. We're only talking now about being 90 degrees away. I will discuss later some results that we've gotten from some small subscale motor tests, where we see with simulated anomalies and O-rings and sealing surfaces, we see leaks starting at one place, stopping at that place, and then starting another place.

And so it is conceivable that you could have had a puff of smoke in a quadrant or in a location that would be 90 degrees around from where you finally had the burn-through. The small motor tests say that that is possible.

Also along the lines of potential O-ring defects, we have been inspecting O-rings and doing some special X-ray on O-rings. X-ray of O-rings is not something that is normally done in inspection. We found two things.

[1151] One is that in reviewing the records of the inspection for the O-rings which were on all of the joints on 51-L, on both right-hand and left-hand SRB, we found that there were seven out of the twelve O-rings which were not subjected to the same level of inspection

2115

as prior O-rings had been.

The situation that occurred was that there was an engineering change order made to transfer some inspection notes from a drawing to an inspection document. It was properly approved, but in the process of making the change to the document there were two steps that were inadvertently left off and not caught.

Now, whether those are significant or not we are not making a judgment at this time. But the two things that were omitted was that: one, there was a requirement for only having five joints in an O-ring, and that was omitted and that inspection was not made at Morton Thiokol by the Air Force.

And the other is-and this one is more interesting to me relative to that photograph-there is a requirement that you can only have a ten mil or ten thousandths of an inch offset where the scarf joint is made, and that inspection was omitted.

Now, that applies to seven of the twelve O-rings. The secondary O-ring in this aft field joint was one of those. Like I say, we don't know what to make of that at this time, but it is something we have learned.

GENERAL KUTYNA: We have been looking at that for about a week now and are closing out that particular

2116

item. I think there were three inspections that were dropped, as a matter of fact.

DR. LITTLES: I'm sorry?

GENERAL KUTYNA: There were three inspections that were dropped when that engineering drawing was changed by Morton Thiokol. And I guess our teams have been looking at that for about a week now.

The one thing we found last night, that those O-rings were inspected by someone at some time, either Thiokol or a sub at least once, and what was missing was the backup inspection by the government.

DR. LITTLES: It wasn't done by Thiokol, but it was done by a vendor.

MR. WALKER: Do you have a record of where the O-ring joints are relative to this particular position?

DR. LITTLES: No, sir.

MR. WALKER: No record is made of where the joints are?

DR. LITTLES: No, sir. Relative to the inspection we've been doing and x-raying O-rings, this is something that is ongoing. Just recently, it started within the last few days, I guess four or five days ago.

We have found one O-ring that has four inclusions in it. The depth is about 25 thousandths and the other

2117

dimensions range from 35 thousandths to 60 thousandths. We don't know yet what the conclusion is. They're still doing chemical analysis on it.

Inclusions of this size probably wouldn't be any problem, but since we've found one we're going to continue to look and see if there might be something worse. So we are continuing inspection and test and photo analysis in this scenario.

[1152] Could we go now to chart 12, please.

(Viewgraph L-12.) [Ref. 3/7-74]

Okay. This is the scenario that you mentioned earlier. Mr. Rogers, relative to ice in the joint, we have been looking at that from two standpoints, the first being whether ice freezing in a joint-could you bring L-3 back up, please?

The first being whether ice could freeze in the joint between the tang and the clevis

(Viewgraph L-3.) [Ref. 3/7-65]

-and exert enough force on it to cause an opening and an unseating of the O-ring; and the second aspect of that being whether you could have water between the tang and the clevis on the inboard side beneath the O-rings and freeze the water and have the water move up and unseat the secondary O-ring.

We have looked at both of those things and

2118

we've run some tests relative to the freezing and the potential gap opening to unseat the O-ring. The movements are very, very small. That doesn't appear to be a problem.

Relative to unseating of the O-ring by freezing of the ice, if you have a situation where you have ice freezing in the bottom of the clevis and drive a column of air above it, you cannot unseat the O-ring that way because you can only get about two psi on the O-ring.

However, if you had a situation where you had a column of grease above the water-and there is liberal grease applied to these tangs and clevises-so that you might have a situation where you had water and had grease above it up too near the secondary O-ring, then if you freeze the water and compress or remove the column of grease hydraulically, you might unseat the O-ring.

So that that one is a possibility, so we are continuing to look at this a bit. We're going to run some tests simulating that kind of condition and see what it does to potentially unseating the secondary O-ring or causing a leakage by the secondary O-ring. So this one is continuing.

CHAIRMAN ROGERS: Would a test be very

2119

conclusive in this instance?

DR. LITTLES: It would not be 100 percent conclusive, no, sir. We can draw conclusions for the test configuration that we set up, but we can't say for this particular hypothesis that you could get that. It is a possibility, is what we can say.

CHAIRMAN ROGERS: Are you familiar with the other occasion when there was ice found in the joint?

DR. LITTLES: Yes, sir.

CHAIRMAN ROGERS: What happened on that occasion?

DR. LITTLES: On that occasion, that was STS-9, and we were not aware of that until after the instant, when we started doing investigations. We didn't know that we had water in the joint, but there was water in that joint.

There was a significant amount of rain and they had occasion to de-stack and when they did water ran out of the pins when they pulled them out. And of course, we had seven inches of rain while 51-L was on the pad.

CHAIRMAN ROGERS: Which was about three times the normal rain, I understand.

DR. LITTLES: Yes, sir. And so there was ample opportunity for the water to get into the tang and clevis area. And then of course, with the cold weather

[1153] 2120

and the freezing, the possibility certainly exists, if you could have the configuration that we have hypothesized, that you might unseat that secondary O-ring.

And with the amount of grease that is in that tang and clevis area, you don't have to stretch your imagination very far to get to the point where you could have water under grease.

CHAIRMAN ROGERS: So probably you won't be able to exclude that as a possibility?

DR. LITTLES: It will be difficult to exclude as a possibility, unless the tests we run, by putting cold grease up against the O-ring, maybe slightly unseating it, and then hitting it with the ignition transient pressure, if that will seal, that would tend to exclude it.

If that doesn't seal, then I don't think you will be able to prove either by test or analysis that you can't generate this condition. So it would remain a possibility.

CHAIRMAN ROGERS: That is likely to be an uncertain area, then, whether the rain and the weather might have caused ice in the seal, and thereby caused the accident.

DR. LITTLES: Yes, sir, unless we can prove by

2121

that test that that would not result in a situation that you would fail to seal.

Could we go now to chart 13, please.

(Viewgraph L-13.) [Ref. 3/7-75]

This scenario deals with a leak in the leak check port. One of the things that tends to put this to bed is, if everyone agrees, is that the initial leak did not come from the leak check port. There are a lot of people who think it did not. There have been a few people who thought it did.

We have had our experts off for the last few days working on that. I was told before I came that they are ready to report to us, and we will be taking that report as soon as we get back and try to draw that conclusion ourselves.

But in our mind at this point in time, it is still a viable scenario. We have done some analysis and tests on this, the hypothesis being that you get a leak through the leak check port at an early time, like a half a second, to generate the puff of smoke, and then you continue leaking through that leak check port until you damage the secondary O-ring or you erode the port enough to blow the port out and then start growing the leak there.

The analysis that we have done indicates that,

2122

with flow rates that are reasonable-and by reasonable what I mean is we have done some analysis and some tests to establish a range of flow rates that you might get if you had an O-ring, for instance, or had a leak check port, somebody left the O-ring off and installed it, you could get leakage.

We've established what that band of leakage is. And then assume that you have that leakage from zero up through 60 seconds. If you do that, what you can do is you can erode or you can damage the secondary O-ring.

You can heat it to the point where it would not maintain a seal any more. You can get it well above 1,000 degrees, and if you did that then you could blow by the secondary O-ring at about 60 seconds, and that could initiate the leak.

CHAIRMAN ROGERS: Why would the leak check port fail, because you hadn't put the plug back in?

DR. LITTLES: Well, if you didn't put the plug back in, certainly that would be a direct leak. What we are hypothesizing here is-to get the small leakages that we are talking about, what [1154] we are hypothesizing is that the leak check port, the plug was indeed installed, but there was some defect in it and it spilled out a small flow.

2123

GENERAL KUTYNA: I don't know anyone who thinks smoke came out of a leak port. Who do you know who thought smoke came out of a leak check port?

DR. LITTLES: Well, I for one, and I'm not an expert and that is why I asked my experts to go off and put together a story and come convince me, because when I look at the black and white photographs I, with an untrained eye admittedly, can see what I think is white smoke emanating from near that leak check port.

Now, they may be able to come convince me that's not true. They may well be able to do that.

GENERAL KUTYNA: Well, does "near" count or does it have to be directly from the port for your scenario?

DR. LITTLES: I think it has to come from the port for this scenario, yes, sir.

DR. FEYNMAN: Might I suggest that on a thing like this the idea of an expert and an untrained eye as compared to a trained eye is a myth. There is no training for this particular kind of observation about leak check ports on a particular booster.

DR. LITTLES: Yes, sir, I tend to agree with that. By "expert" I was referring to people that we have who routinely, every flight, look at all the photographs and become very competent in looking at

2124

these kind of deviants.

DR. FEYNMAN: When you get curious, you can do it yourself and make up your own mind.

DR. LITTLES: That is why I wanted someone to convince me. But we are still working on that one as well.

Could we go now to chart 14, please.

(Viewgraph L-14.) [Ref. 3/7-76]

Okay, this leg of the scenario deals with the situation which has been discussed a great deal, that being that we had a blow-by of the primary O-ring and that we had, with the cold temperatures, we had a situation on the O-ring where we might have had a delay in the actuation time and didn't get a seating.

We're doing a great deal of work on this one, and there is a great deal of work to do. We're doing our work primarily in three areas. We're doing some additional, or have done some additional, tests on basic resiliency of the O-ring, and those data tend to confirm the data that we had before.

It shows that, sure enough, there is an increase in the free-standing response time.

We have also done some additional tests with the O-ring at cold temperatures in a static situation, and by a static situation I mean we don't have joint

2125

rotation there, but with the O-ring in a proper groove and with the proper squeeze, as a matter of fact with a variation on the squeeze, and then hitting that O-ring with the ignition transient pressure to see if it would seal.

And we have quite a number of tests now where we can seal down to minus ten degrees. At minus 20 degrees, we start getting some leakage. And these data really are no more 100 percent conclusive than the resiliency data.

[1155] It is just another data point, but it does indicate that the O-ring is not so hard, not so brick-like that it won't seal. It will seal if you apply proper pressure to it and the joint is not rotated at that point in time to the point where you have a blow-by.

A key part of the work we're doing, of course, since neither one of these things are conclusive, what we have to do is combine all of the effects, the effects of resiliency, the effect of the pressure being imposed on the O-ring, with the deformation that results from that pressure to move it against the seat, as well as the effect of the gap opening due to the joint rotation.

In order to do that, we have designed and

2126

built what we are calling a dynamic test fixture, which attempts to incorporate all of those things. We have the design such that when we apply pressure that there is a nylon sleeve which opens and gives you the gap rotation simulation.

And we are also hitting it with the right pressure transient, and we are doing it as a function of temperature, at various temperatures. So that is an important test for us. The fixture is available now. We are beginning to do some checkout tests with it.

One of the things that concerns me about it is that the design of this fixture is a development effort in itself. It is difficult to get all of those features in one test rig.

CHAIRMAN ROGERS: If it isn't a perfect match, if the test really does not simulate what actually happened, you could come to a very tragic conclusion.

DR. LITTLES: Yes, air, and that is why we're being very, very careful with that test rig. The first thing we are doing with it, or we're going to do with it, is to make sure by calibrating the gap opening that we are really tracking that.

And in addition to that, there is some precursor work that has to be done before we are absolutely confident of the gap opening that we should

2127

have in there. The data that have been used and quoted are maximum numbers. Those data were derived or they came from test data actually.

We have done a number of tests, hydroproof proof tests on segments where we have inserted, we have measured through the leak check port, because that was the only location available without damage to the hardware. We have measured through the leak check port and established a gap opening, and it is those data with that single data point on a segment that have established the test data to show what that gap opening is.

We're doing some additional work on that. We have a test fixture that is now in test. We have just started tests on it. It is a full-scale segment, of course. We have eight holes uniformly spaced around, so that we can get eight measurements.

We are beginning to get data on that, and the initial data I have Been indicates that the gap opening is not as much as the maximum number we have been using. And another thing that is very key, and this is very, very key in my mind, those cases are empty. They don't have propellant in them.

Now, you're certainly going to get an effect on the rate of gap opening if you have propellant in

2128

there or not, because the propellant is going to add stiffness. And we're talking about pressure applications. We're talking about-over a small time frame here, we're talking about milliseconds. The time frame of interest, as you are well aware, is between zero milliseconds and 300 milliseconds.

[1156] So we are doing some analysis on that. We have two models going, one at Morton Thiokol and one at Huntsville, and we should be beginning to get some results on that pretty quickly.

Could we go now to chart 15, please.

(Viewgraph L-15.) [Ref. 3/7-77]

Okay. This scenario deals with the load exceedance. We have discussed loads earlier. We have been, of course, looking at the liftoff and flight loads and Max Q loads in particular. And as we discussed this morning

MR. ACHESON: Could I ask one question, before we leave the other chart? In the tests you're running, do you find any evidence of erratic resealing of apertures, gas leak apertures?

DR. LITTLES: Resealing? I'm not sure I follow your question.

MR. ACHESON: Are you using regular booster fuel for your tests?

2129

DR. LITTLES: No. The static tests we are running are done with cold gas.

GENERAL KUTYNA: But you have used some five-inch motors, right, with real fuel in them, to see what happens when you cut a gap?

DR. LITTLES: Yes.

GENERAL KUTYNA: Could you give us a rundown on the one that opened and closed itself? Are you familiar with that one, the number of seconds that it did or did not leak?

DR. LITTLES: Yes. As a matter of fact, I'm going to discuss that.

GENERAL KUTYNA: Okay, whenever you get to it.

DR. LITTLES: Now, back to the load situation again. As we discussed this morning, we have reconstructed the liftoff loads and relative to comparing those loads to the design case, they're well below that. And as I indicated, for the Max Q case the data we have indicates that we probably won't have any problem there compared to design.

So we have indicated on our chart that this is not a problem. But let me emphasize that this is relative to the comparison of the loads to the design case. The loads are still a very important part of

2130

scenarios that deal with potential damage or to O-rings or other anomalies in the joint.

They are particularly important relative to the concept of the leak, seal leak, which has been discussed very often. It could be that we had some anomaly in the O-ring, had some damage, and then the activity that we see around 40 seconds with the winds, while they are within the experience base, or the conditions that we see at Max Q, while they are within the experience base, might impose enough load on that joint to cause some problems with it.

So loads from that standpoint are still very much a part of our other scenarios. We don't believe, though, that basic loads relative to design are out of bed, and that is why we're putting that part of it in, but the loads stay open for the other things.

CHAIRMAN ROGERS: Going back for a moment to the subject we were talking about a moment ago on the tests, is there any outside group working with you on those tests, other than Thiokol and the people at Marshall?

DR. LITTLES: No, sir, we don't have anyone else doing those tests right now. It may well be that we should, and we will look into that.

CHAIRMAN ROGERS: It is certainly a suggestion

2131

you should consider if you're going to rely on those tests.

DR. LITTLES: We will certainly do that.

[1157] Could we go on now to chart 16, please.

(Viewgraph L-16.) [Ref. 3/7-78]

This scenario deals with a slightly different phenomenon. As you are aware, the joint has putty upstream of the O-rings. The understanding of this joint relative to the putty operation has always been that the putty does not hold the pressure off of the O-rings.

As a matter of fact, after the incident when we were developing scenarios I discussed this with the joint experts and I was assured that the putty will not hold the pressure off the O-ring. But we did make a scenario out of it and we started doing some tests of the putty, and our initial data-and these are not conclusive yet, and I will tell you in a minute why we don't consider them finally conclusive, but the data does indicate that the putty in the joint configuration could hold the pressure off of the O-ring for a long enough period of time for the joint to have rotated.

And that condition, in combination with the resiliency, could cause a problem. The data that we have ranges between temperatures of zero degrees and up

2132

to 70 and, as you would expect, there is an influence of temperature on the pressure-holding capability of the putty.

You see it holding pressure for longer periods of time, of course, with colder temperatures. But the important thing is that, even at 70 degrees and even with putty which has been conditioned at 100 percent relative humidity, the data indicate that you can hold the pressure off for long periods of time compared to .5 seconds.

One of the data points went up to about 38 seconds. So what we have decided is that we have to do a more sophisticated test. This initial test had the joint configuration properly configured relative to the putty dimensions, but it did not have the capability to account for any dynamic effects of that joint.

Of course, as you apply pressure you get some slight movement, which would tend to move the NDR insulation slightly away from the putty. And so we are building another test fixture where we have the capability to induce that dynamic effect, and we should have that one in tests shortly.

But this one remains an open scenario at this point in time.

DR. FEYNMAN: That means the pressure is more

2133

than 200 psi, so that it could hold a pressure more than 200 psi?

DR. LITTLES: Yes, sir, it held pressure up to the full motor pressure.

DR. FEYNMAN: Does that mean the test that was made with the 200 psi beginning to load up the rings is not going to work sometimes, because the putty will keep the leak from appearing even if there was a leak?

DR. LITTLES: Well, that was the first thing I thought about, too, when I saw those data. But that test is conducted, that 200 psi test is conducted, for a 15 minute time frame. So you have a long period of time for that pressure to work its way through the putty and blow through.

And we do have data that says it does that. But it is very much a time function, and it is a temperature function, and I'm sure it is a function, a very strong function, of humidity, the conditioning of the putty.

And it is probably also a strong function of the layup. It is laid up, I believe it is, in seven strips, so there is some variation in the layup as well. There are a number of variables in that putty.

[1158] DR. FEYNMAN: How far around was it? It was a small model, wasn't it, about ten inches or something.

2134

DR. LITTLES: Yes, sir.

DR. FEYNMAN: And you have 37 feet of circumference in the other case. So if the statistics of any kind-of course, the 37 feet one is much weaker.

DR. LITTLES: There would be a higher probability of having some weak point, yes, sir.

DR. COVERT: Dr. Littles, you had said earlier that the effect of loads and flight loads and so forth might be important here; is that not correct?

DR. LITTLES: Yes, sir.

DR. COVERT: Might I suggest, for the benefit of us absent-minded folks, that you might add another box onto this flow diagram indicating that you might put that input in here?

DR. LITTLES: Yes, sir. As a matter of fact, Jack and I were talking about that during lunch, the fact that we have taken these loads out of the design load case. We have to have it visible someplace, and so I agree with that completely. We need to have it reflected at the proper places in these areas, and we will do that.

DR. COVERT: Thank you.

DR. LITTLES: Okay. That finishes the basic elements of these scenarios. I now want to address the

2135

two things-could you come to the right of the chart, please. Move the chart to the left.

To address two elements of the scenario which we have been, along with others, trying to explain, the first being that we see a puff of smoke near zero at .5 seconds and we see the plume come out and the leak start at 59 seconds.

There are two ways that could happen, of course. One is that you have a continuous leak after you get the puff and the joint somehow holds together until 59 seconds; and the other being that you get the leak at that point, something makes the leak stop. Maybe loads, even though they're not outside of design loads, but the loads are increasing and maybe at Max Q it opens the joint up.

And so the first thing I will discuss is the work that we are doing relative to substantiating or refuting the fact that you could have a leak through that joint that would let the joint remain intact between zero seconds and 59 seconds.

We have been doing some work on that in two different areas. We've been doing analysis on it. We've also been doing some subscale motor tests, which General Kutyna referred to a moment ago, and I will discuss those.

2186

I am going to skip charts 17 and 18. 17 and 18 are photos of the initial puff and the plume that emanates at 59 seconds. You've seen those in the time line already, and so I will just go on then to chart 19.

(Viewgraph 1,19.) [Ref. 3/7-79 1 of 6]

We are doing the analysis in an iterative process. Of course, it involves a flow analysis, a thermal analysis, coupled with a structural analysis. We started simply-we are getting more and more complicated-to try to make the model fit what could have happened.

We have a two dimensional model which we have been using for some time, which incorporates the flow, the potential melting of the metal, the - recession of the O-ring material, NDR rubber, and also incorporates 1D spreading, one dimensional spreading. And what I mean by [1159] that is that you have flow which would initially be constrained by the gap in the O-ring, if that is what the problem is, or a flaw in the sealing surface, or maybe by a hole in the putty, since the putty has to erode as well.

And as that flow goes downstream in that joint, it will spread circumferentially, and as it does that it decreases the amount of heat it puts into the

2137

metal. We started off with a 1D flow spreading model and a 2D thermal model. We have now gone to a 3D model, which is depicted at the bottom.

We have also done some structural work to determine how much of the joint you would have to heat up in order to have it fail with various conditions. The preliminary data that we have back doesn't allow us to say that we could sustain a leak that long, but we are still doing some work on that. I still think it may be possible.

We, with the 3D model now, are showing that we would get a burn-through in 35 seconds if we started at time zero. But I hasten to add that there are some things we have not included yet. We have to look at the spreading profile some more. We have to put some better 3D conduction effects in the model. And the third thing is, that is very important, is as you get flow through that joint, the products of combustion are going to allow you to deposit aluminum oxide as the hot gas flows through.

And what that does, of course, is two things. It will give you, where you deposit it, it will give you a resistance to heating at that location, because it gives you an insulating effect; and the other thing it will do is it will tend to block the flow and further

2138

reduce the flow rate, to reduce the heat transfer.

We don't have that included in the models at this point in time. As a matter of fact, frankly, it is going to be difficult to do. We are working on it, but that is going to be a difficult thing to do.

But in conjunction with this, if you will go to-no, you don't have a chart. Excuse me.

In conjunction with this, we have been doing some subscale motor tests. We are doing that two ways. We have some motors at Thiokol which can burn-they are called five-inch motors. They can burn for three seconds.

And we have some larger subscale motors which can go for 24 seconds. And what we are doing is inducing various types of defects, either in the sealing surface underneath the O-ring or in the O-ring itself. And we have gotten some very interesting results out of that.

We have had a test with a 24-second motor where we had damage in an O-ring. We had the O-ring cut an eighth of an inch, and that particular one we had smoke for 24 seconds, but we didn't have any damage. We have had two cases, one where we had-we cut a-put a scratch in the sealing surface of 20 mils without putty in the joint, and that one ran for 24 seconds, but

2139

there was significant metal damage in that one.

We had another one where we had the same type of scratch in the sealing surface, about 20 thousandths. In this case we had putty in the joint. The putty held the pressure off apparently for about ten seconds, because for ten seconds we didn't see any leakage underneath that scratch, and then for about five seconds you did see smoke come out, and then the flow stopped again and for the remaining part of the test, between about 15 seconds and 24, there was no leakage.

[1160] And so that is qualitative data that indicates to us that you could have a situation with a certain type of flaw in there and get a flow either intermittent or maybe even continuous.

And another thing, too, is the five inch CP motors are indicating, as you would expect, that you can also have aluminum oxide deposited at locations where you have leakage, and it builds up and it will make the flow switch around to another area.

And this is a thing relative to whether the initial leak might have been in some quadrant other than where we finally saw it. You could have that initial leak somewhere else, have it stop up, but had accumulated enough damage in the other quadrant for that to break loose and cause the final failure to be in

2140

another location.

Could you go now to chart 16, please.

(Viewgraph L-16.) [Ref. 3/7-78]

We will dispense with chart 21 as well. That is another photograph you have seen.

This last item relates to one of the things that had been discussed earlier, and that is relative to the fact that we saw vehicle rates after we had the plume coming out-we had vehicle rates and TVC gimbal angles that were larger than would have been predicted with the conditions that we knew we had.

So we have been doing a lot of work to match the vehicle conditions we had with what we know about the plume characteristics. We have estimated forces and moments necessary to match the observed response. We have evaluated the plume characteristics using the film data to determine the vent forces and the aerodynamic influences.

And we established from that that you can get about 130,000 pound force, 130,000 pounds of momentum in the correct quadrant, and that doing that you can recreate the vehicle responses, both relative to rates and TVC gimbal angles.

That is a very brief, cursory description of a great deal of very good work. As a matter of fact, our

2141

people say, and I believe that JSC people agree, that this is the best match we have ever had. So they have done a good job of matching that, and we are confident now that what we see with this plume did indeed cause those vehicle rates. They agree very well now.

Could I go now to chart 22, please.

(Viewgraph L-22.) [Ref. 3/7-79 6 of 6]

This is by way of summary. I've discussed all of the scenarios and, as we have indicated as we've gone through it, we think that the inhibitor flaw is improbable, that the load exceedance relative to the design load situation is improbable, and we still have work, both analyses and tests, associated with those other legs of the scenarios.

That is my final chart.

CHAIRMAN ROGERS: Thank you very much.

MR. ACHESON: I would like to ask, in relation to your earlier testimony, I thought I understood you as saying that the smoke at ignition could be seen in the general area of the test port, and I thought I had previously understood from other testimony that the test port was about 90 degrees of arc away from where the smoke had been seen,

Could you clarify that, please?

DR. LITTLES: Well, I don't believe it is 90 1160

[1161] 2142

degrees away. The leak check port, if this is the tank and this is the SRB, is on the bottom right here. The plume as we see it later emanates from this location. And really, the leak could be anywhere in this area, because we can't see it.

Now, the question is whether with the photographic coverage we have it is coming from this location right here or somewhere around there. And again, there are a lot of people looking at those photographs who conclude that it is indeed not from the leak check port, and we may well be convinced of that after we get the report when we get back home. But I am anxious to see it because, as I said, I'm still one of those who believe I can see it from that area.

But I may be able to be convinced to the contrary.

VICE CHAIRMAN ARMSTRONG: The simulation work that you referred to at the end, the match, is that completed now?

DR. LITTLES: Yes, sir, that is completed.

VICE CHAIRMAN ARMSTRONG: Will there be a report generated for that?

DR. LITTLES: Yes, sir, we will do that.

VICE CHAIRMAN ARMSTRONG: Thank you.

CHAIRMAN ROGERS: Do you think the tests that

2143

you are running would ever-and maybe this isn't a fair question-that the tests you are running would ever re-establish confidence in that joint and those O-rings without change, so that subsequent flights could continue with the same equipment that was on 51-L?

DR. LITTLES: Yes, sir, that is a tough question. I believe that the tests we have, the test fixtures that we have, if they operate the way we plan for them to, will prove whether or not the joint rotation is a contributor or potential contributor to that leak.

CHAIRMAN ROGERS: Well, maybe I shouldn't press it. But anyway, you're trying-the simulations that you're testing, you're doing in trying to simulate conditions, you think will be fairly conclusive. But it seems to an outsider that it's going to be very difficult to simulate these tests with all of the conditions that existed on 51-L in a way that would help you with any assurance in the future.

DR. LITTLES: I agree with that. I very carefully added in that statement, if they work the way we hope they will. But as I pointed out earlier, this dynamic test fixture or any test fixture like that-and we have looked at other versions of that-is a very difficult fixture to put together and get it to do

2144

what you want it to do.

I personally have some question as to whether it is going to work. It may, but it may be another design than the one we have now. It is not an easy set of conditions to simulate in a subscale test rig.

MR. SUTTER: These tests are aimed at trying to understand the cause of the accident, aren't they? Isn't that their primary purpose?

DR. LITTLES: Yes, sir. That is their sole purpose.

CHAIRMAN ROGERS: But as my previous question suggests, the people who are running the tests are really in the position of running tests which, if they were successful, would prove they were right after all. In other words, the Thiokol people, the engineers, thought that, in view of the weather conditions, that flight should not be launched, and of course your people at Marshall felt the same way, and you are the very people that are conducting these tests.

[1162] That is why I suggested that if might be wise to think of some other outside independent source to work with you on the tests.

DR. LITTLES: We will certainly be responsive to that, and of course the tests that-this dynamic test fixture is one that is being used at

2145

Morton-Thiokol, and of course we have people there. And we would welcome anyone participating in that or any other ideas and concepts that anyone might have relative to a test fixture to do this. We would welcome that.

CHAIRMAN ROGERS: Thank you.

DR. KEEL: I've got one question with respect to this last chart, if you will put that back up on, your summary chart.

DR. LITTLES: Chart 22, please.

(Viewgraph L-22.) [Ref. 3/7-79 2 of 2]

DR. KEEL: Let me just ask the question while they're looking for the chart. When you started off with your fault tree analysis, you had three categories of probability: probable, improbable, and possible. And you labeled a fault in the external tank leading to a fault in the SRB as just possible.

Now, this final summary chart, though, has the leak in the external tank as being probable. So how did you get from possible to probable?

DR. LITTLES: That is as it affects the SRB. The initial chart there on the tank had the overall tank yellow, with some items red and some items green. But again, this relates to the impact of that on the SRB. There may be, as I think about it here, a little bit of inconsistency in that.

2146

MR. LEE: If you look at the overall fault tree, the external tank was colored yellow because we had not completed all of the evaluation assessments, and I think in particular the review of records relative to structural flaws.

That makes the external tank as the failure mode, if you will, to be still suspect. If you notice, in the same fault tree there is an arrow from the external tank into the SRB, which still is a viable potential contributor to the SRB failure. So that is the reason we painted it red or colored it red here and yellow in the overall chart.

DR. KEEL: It still looks to me to be an inconsistency.

CHAIRMAN ROGERS: Pursuing that just a bit further, every time I've gone back to that, each time that representatives from Marshall have testified they've pointed to the external tank as the number one suspect. And I notice Mr. Lucas said that in his press conference the other day.

And yet, ostensibly it seems as if the joint seems to be the number one suspect. And I don't quite understand it.

MR. LEE: I didn't mean to imply that. We don't think the external tank is the number one

2147

suspect. It is a potential as a contributor only. We know that the SRB failed, and until we complete all of the analysis associated with things such as a potential hydrogen leak at liftoff, then we can't close that out.

We know the SRB is the failure.

DR. KEEL: But is the only reason you have this labeled red is because you chose just to use red and green on this chart? If you had used yellow, would it have been yellow?

[1163] MR. LEE: I could have used yellow there, you're right. But as it relates to the SRB in general, it is still red.

CHAIRMAN ROGERS: Okay.

MR. LEE: This completes the summary of the failure scenarios and findings. We are now prepared to go into the summary of the other elements if you like.

CHAIRMAN ROGERS: Very good. Thank you.

(Witnesses sworn.)

[Please note that some of the titles to the references listed below do not appear in the original text. Titles are included to identify and clarify the linked references- Chris Gamble, html editor]

[1164] [Ref. 3/7-30] Incident Investigation Process.

[1165] [Ref. 3/7-31] STS 51-L Timeline.

[1166] [Ref. 3/7-32] Puff of smoke at aft field joint of the solid rocket motor.

[1167] [Ref. 3/7-33] Chamber Pressure of Right-Hand SRB motor versus time graph.

[1168] [Ref. 3/7-34] STS 51-L Timeline.

[1169] [Ref. 3/7-35] Not Reproducible.

[1170] [Ref. 3/7-36] E203 MET 59 Sec (Computer drawn version). [Ref. 3/7-37] STS 51-L Timeline.

[1171] [Ref. 3/7-38] Pressure v. time graph.

[1172] [Ref. 3/7-39] Photo showing deflection of SRB plume.

[1173] [Ref. 3/7-40 1 of 2] STS 51-L Timeline. [Ref. 3/7-40 2 of 2] Not Reproducible.

[1174] [Ref. 3/7-41] Not Reproducible. [Ref. 3/7-42] Pressure v. time graph.

[1175] [Ref. 3/7-43] STS 51-1L Timeline. [Ref. 3/7-44] STS 51-L Timeline.

[1176] [Ref. 3/7-45] Graph showing the rotation of the pitch of the right-hand SRB to that of the left-hand. [Ref. 3/7-46] Computer-drawn picture of the launch vehicle looking down on top with the SRB released from its lower link.

[1177] [Ref. 3/7-47] Computer-drawn picture as Ref. 3/7-46 but viewed from a different angle. [Ref. 3/7-48] Same computer-drawn picture as Ref. 3/7-47 viewed from the forward end.

[1178] [Ref. 3/7-49] STS 51-L Timeline. [Ref. 3/7-50] Pressure v. time graph.

[1179] [Ref. 3/7-51] Pressure v. time graph.

[1180] [Ref. 3/7-52] Pressure v. time graph.

[1181] [Ref. 3/7-53] Pressure v. time graph. [Ref. 3/7-54] STS 51-L Timeline.

[1182] [Ref. 3/7-55] Not Reproducible. [Ref. 3/7-56] Not Reproducible.

[1183] [Ref. 3/7-57] Computer-aided drawing showing characteristic of the vapor coming from up forward. [Ref. 3/7-58] Bright flash between Orbiter and External Tank.

[1184] [Ref. 3/7-59] Not Reproducible. [Ref. 3/7-60] Computer-aided drawing showing highlight of where rupture initiated with the LOX tank.

[1185] [Ref. 3/7-61] Preliminary STS 51-L Anomaly List.

[1186] [Ref. 3/7-62 1 of 2] 51-L Fault tree.

[1187] [Ref. 3/7-62 2 of 2] Not Reproducible.

[1188] [Ref. 3/7-63 1 of 2] STS 51-L SRM hot gas leak failure scenarios.

[1189] [Ref. 3/7-63 2 of 2] 51-L Fault tree.

[1190] [Ref. 3/7-64 1 of 2] Scenario 1.

[1191] [Ref. 3/7-64 2 of 2] SRM hot gas leak failure scenarios [Ref. 3/7-65] Aft Segment/Aft Segment Field Joint Configuration.

[1192] [Ref. 3/7-66 1 of 2] Failure Scenarios 2A and 2B. [Ref. 3/7-66 2 of 2] Failure Scenarios 2A and 2B. (continued).

[1193] [Ref. 3/7-67] SRM hot gas leak failure scenarios.

[1194] [Ref. 3/7-68 1 of 4] SRM hot gas leak failure scenarios.

[1195] [Ref. 3/7-68 2 of 4] 51-L Field Joints. [Ref. 3/7-68 3 of 4] Failure Scenario 3.

[1196] [Ref. 3/7-68 4 of 4] Failure Scenario 3.(continued).

[1197] [Ref. 3/7-69] Scenario 3 (continued).

[1198] [Ref. 3/7-70] 51-L RH SRM Aft Field Joint Mating.

[1199] [Ref. 3/7-71 1 of 2] Failure Scenario 4A.

[1200] [Ref. 3/7-71 2 of 2] SRM hot gas leak failure scenarios. [Ref. 3/7-72] Not Reproducible.

[1201] [Ref. 3/7-73] Not Reproducible.

[1202] [Ref. 3/7-74 1 of 2] Failure Scenario 4B.

[1203] [Ref. 3/7-74 2 of 2] SRM hot gas leak failure scenarios.

[1204] [Ref. 3/7-75 1 of 2] Failure Scenarion 4C.

[1205] [Ref. 3/7-75 2 of 2] SRM hot gas leak failure scenarios.

[1206] [Ref. 3/7-76 1 of 2] Failure Scenario 4D.

[1207] [Ref. 3/7-76 2 of 2] SRM hot gas leak failure scenarios.

[1208] [Ref. 3/7-77 1 of 3] Failure Scenario 5.

[1209] [Ref. 3/7-77 2 of 3] Failure Scenario 5 (continued). [Ref. 3/7-77 3 of 3] SRM hot gas leak failure scenarios.

[1210] [Ref. 3/7-78 1 of 2] Failure Scenario 6. [Ref. 3/7-78 2 of 2] SRM hot gas leak failure scenarios.

[1211] [Ref. 3/7-79 1 of 6] Joint leak Observed Near 59 sec. (event common to scenarios 3, 4, 5 and 6) [Ref. 3/7-79 2 of 6] Thermal Analysis of Flow Thru Clevis.

[1212] [Ref. 3/7-79 3 of 6] SRB Clevis 2D Thermal Model Node Location. [Ref. 3/7-79 4 of 6] Joint Leak Observed Near 59 sec. (continued).

[1213] [Ref. 3/7-79 5 of 6] Plume Emanating From SRM After 59 Sec. (common event for all scenarios). [Ref. 3/7-79 6 of 6] Summary.

[1214] TESTIMONY OF: GARY COULTAS, ASSISTANT MANAGER, ORBITER PROJECTS, JOHNSON SPACE CENTER; AND GEORGE HOPSON, DIRECTOR, SYSTEMS ANALYSIS AND INTEGRATION LABORATORY, MARSHALL SPACE FLIGHT CENTER

MR. LEE: Mr. Chairman, would like now to summarize the three elements which we believe are non-contributors to this incident. If you remember the overall fault tree which Mr. Keel referred to, there were-each element was recognized as a potential contributor initially, and that would be the orbiter, the shuttle main engine, the IUS or inertial upper stage, the external tank, and the solid rocket booster.

We believe that, from the data that we have available to us - and we believe we have all of the available data-that three of those elements are non-contributors. And at this time I would for us to present to you in summary fashion the rationale for why we think that is the case.

And I would like now to introduce Mr. Gary Coultas from the Johnson Space Center to summarize for you that rationale for the orbiter.

CHAIRMAN ROGERS: Very well.

MR. COULTAS: I'm Gary Coultas. I'm the

2149

assistant manager for the orbiter project at the Johnson Space Center. I have held this position for about two and a half years. I have been with NASA for 22 years, and I have been involved with the orbiter project for a good deal of that time.

Let me start out with chart C-2.

(Viewgraph C-2.) [Ref. 3/7-80]

This identifies the basic configuration of the vehicle. The orbiter vehicle started out its career as static test article 099. We completed a test program, a structural test program, in 1979 to validate our stress analysis.

We knew going into that test program that we would ultimately make this into a flight vehicle. So as we went into that test program we took great care not to overstress the basic airframe. We did predict as we ran that test program what we would expect from the loading that we induced into the vehicle; what kind of responses we should see. We monitored those responses and we did not exceed those during the tests.

After that test program, we tore the vehicle down, installed systems and wiring and components, and it was delivered as a full operational vehicle in July of 1982. It flew nine flight missions from the period of April 1983 to October 1985.

2150

During that time period, we had a couple of problems that did not cause us any in-flight problems. These were turn-around issues post-mission. We had two problems with the OMS pods. The OMS pods are the propulsion modules on the aft of the vehicle. We had an ice impact problem [1215] which caused some loss of the thermal protection system in that area and also a bonding problem on 41-G. We had to remove those pods from the vehicle for repairs and other pods were substituted.

Also, after the 41-G mission, we lost a tile during that mission and subsequent analysis and review indicated that we had a problem with incompatibility between the waterproofing material that we were using and the tile bonding material. We subsequently replaced around 4,000 tiles on the bottom of the vehicle.

For STS 51-L, we did go back and review all of our documentation and vehicle processing records associated with the Challenger vehicle, which included the design configuration, the modification work that had been done, partial modifications that were in various stages of completion, waivers, deviations, etcetera.

We also had - the Challenger vehicle was one of the two vehicles that we were provisioning to carry Centaur cargo and payloads later this year, and those mods, they were not totally complete. We had been

2151

installing those over an incremental period of time. We made no mod specifically for Centaur during the flow for 51-L and those mods and the partial configuration were certified.

The bottom line in terms of the configuration and the hardware of the Challenger vehicle itself is that we found no anomalous conditions that would give us any concern relative to the pre-launch processing.

Chart C-3.

(Viewgraph C-3.) [Ref. 317-81]

What I would like to do now is go through the various functional areas of the vehicle and just give you some highlights of our findings and observations in these areas. And we have got a few acronyms in here, and I will try to cover those, and if I fail to give you the right information or there is still some misunderstanding, please don't hesitate to call out as we go.

These charts are set up - these next two charts are set up in a propulsion and power area. Starting with the orbiter maneuvering system, these are the maneuvering engines which are in the pods on the aft of the vehicle, that take us into orbit and take us out of orbit.

We evaluated all the measurements associated

2152

with those engines and that propulsion system. We found nothing anomalous with the data. One comment is that these OMS pods were originally built and used for the OV-102 Columbia vehicle, and this was their first use since STS-9 in October 1983.

They had been extensively reworked, with external TPS being put on, thermal protection system, and also the propellant tanks had been reworked since their prior use. And that is just a note. We found nothing anomalous in the data that would indicate any contributory cause there.

The reaction control system consists of numerous engines on the front and the aft of the vehicle that provide us with attitude control maneuvers in space and during re-entry. We reviewed all the measurements associated with those engines and the propulsion systems, and we also reviewed the flight photos.

All of that data again was nominal. These engines do show at around the 73 second time frame an onset of high pressures. They are basically monitoring or sensing the exterior pressure. Just prior to loss of data, some of those pressure indications were up to around 200 psi, indicating a pretty high overpressure on the vehicle.

We did have a Right anomaly. We lost a

[1216] 2153

temperature sensor on one of the engines. It failed at liftoff. There was no mission effect from this.

Another interest item is that we have heaters on the thruster systems to provide thermal conditioning in orbit. We normally launch with the heaters ON on our vernier engine systems, but they are normally OFF on the primary thrusters.

Because of the cold weather, we did turn those thruster heaters on and we launched this way during ascent. We have done this also on the 51-C mission in January of 1985.

The reason that we turn these on is that we can, if the engine valves get cool, you get shrinkage in the valve seats and you could get propellant leakage. And knowing this was a concern, we did turn these heaters on pre-launch and we flew that way.

The next subsystem is the auxiliary power unit, which consists of basically - is a hydrazine system that runs through a turbine to provide energy for the hydraulic pumps. Again, all of the measurements in this system are nominal. We did have - APU No. 3 did exhibit some differences, again within our experience base. APU 3 was new for this particular flight.

The hydraulic system provides hydraulic system for gimbaling the main engines, for the control valves

2154

on the main engines, and for the aero surfaces on the vehicle. We reviewed the fluid dynamic measurements, flows, pressures, temperatures, in that system, and again all were nominal.

We have a fuel cell system and a cryogenic storage system which supplies-basically generates electric power for the vehicle. All measurements in that system were nominal, again nothing anomalous.

Chart C-4, continuing with the propulsion and power system.

(Viewgraph C-4.) [Ref. 3/7-82]

The pyrotechnic system that we have on board. We reviewed all of the measurements of the NASA standard devices, which are the electrical initiation devices for the pyros. We reviewed all of that data.

The orbiter to ET forward attach bolt was a new design that had a strain gauge in it, and we went back and reviewed all of this acceptance test data to make sure that there was nothing anomalous in that, since it was the first time we had flown that particular design.

Again, we reviewed the recovered debris and the flight photos. Our findings there were that there were no unintentional firing commands. All the hardware that we did find on recovery looked okay. We found no fired pyros, either electrically or thermally induced,

2155

in that area.

We also looked at the battery systems, primarily the SRB and ET, the SRB recovery batteries. And again, everything there was nominal from our perspective.

Chart C-5, the avionics areas.

(Viewgraph C-5.) [Ref. 3/7-83]

In the GN and C area, we had sensors on the SRB, SRB rate gyros. We had sensors on the orbiter, flight control sensors. These sense the characteristics of the vehicle. That data is assessed, messaged essentially through the on-board flight software. Commands then are sent to the SRB actuators and the SSME actuators, the effectors we call them, to steer the vehicle.

And that is the flight control loop, basically, that we fly the vehicle with. We reviewed all of the measurements associated with that system, both internal software measurements that are [1217] sent down to the ground in addition to the actual measured data from the sensors and the effectors that are positioned, and so forth.

We also did off-line simulations to confirm that the data was all consistent, and we again reviewed the flight photos. The system response for the flight

2156

control system for the whole stack, response is as designed.

And we have heard several discussions about transient behavior in certain periods of time, 40 seconds, 52 seconds, and near the end. In all of these areas, the flight control system was responding to the external stimuli, either wind induced or plume induced. And we see nothing anomalous in the behavior of how it did respond.

In the 62 to 65 second time period, we do have a wind-induced transient in that period of time and, as you've heard also earlier, we have a contribution from an external force associated with the plume. We did see just before the vehicle breakup, acceleration spikes, positive and negative, and also, as you've heard earlier, the deviation between the right SRB and the rest of the stack in terms of what the rate gyros were saying.

Several interest items. That has been brought out before, but let me just amplify on that a little bit. We did have a slightly higher, two degree higher, max roll error. Now, as we're going uphill we are basically flying, and as we get a wind-induced - as we get wind shears, the vehicle will roll with the wind so it doesn't try to fight it.

2157

And in the past the most we have seen with that kind of a maneuver is about nine degrees. This time we went up to eleven. Again, it is consistent with our flight control design, but it is higher than we had seen before.

GENERAL KUTYNA: What time was that?

MR. COULTAS: Around the 40 second time frame.

Also, we have what we classify here as a hot SRB, which in our guidance philosophy what we are looking at is velocity as a function of time. And we have in our on-board guidance the ability to detect whether we're running a cold performance or a hot performance, so that we can limit the loads on the vehicle during the Max Q regime.

And so, because of variabilities in the SRB ballistic and performance characteristics, we actually monitor that in real time in the flight. And we have certain points in the trajectory that we will throttle down the main engines in anticipation of not exceeding our design criteria in the Max Q regime that would occur later on.

We would have predicted at this first throttledown point to go down to about 103 percent from 104. We actually, because we were fast or, so to say,

2158

hot in this time frame, we throttled down at the first throttle point to 94 percent and eventually down to 65 percent in the throttle bucket, and then back up again. We have seen this behavior many times before and it was unexpected, but not anomalous.

The data processing system, the DPS, consists of the -

DR. FEYNMAN: Do you mean you have an accelerometer so you can determine -

MR. COULTAS: We measure velocities with the IMU's as a function of time. We get inertial velocity and compare that with, at a given time -

DR. FEYNMAN: It's not rotational velocity; it's absolute velocity?

MR. COULTAS: Absolute velocity.

DR. FEYNMAN: So acceleration you measure?

[1218] MR. COULTAS: Yes, we're actually monitoring acceleration integrated over time, basically, to get the velocity. And we have velocity time points during the ascent trajectory, and if at a time point, if we are high in velocity, we throttle down. If we are low on velocity, we don't throttle down, basically to fly a velocity profile.

DR. FEYNMAN: Thank you.

MR. SUTTER: This could produce a different

2159

load on the mounts between the main tank and the solid rocket boosters?

MR. COULTAS: It is intended to control those loads, and so we actually take into account in real time what the performance is of the vehicle stack, so that later on that we limit the max dynamic pressure, and that is a measure of load, basically, on the vehicle, as we get further up into flight.

MR. SUTTER: But I was thinking of the case where the solid rocket motors don't change thrust much and the main engines you say are dropping thrust quite a bit. So that produces some kind of a bending load or a shear load on the mount between the solid rocket booster and the main tank, wouldn't it?

MR. COULTAS: Well, the main engines are designed to throttle and the whole stack is designed to follow a thrust time or velocity time profile, basically. And yes, it does change from, you might say, a nominal.

But again, the flight base or our experience base or our design base takes that into account, and so we have an envelope that we can fly within.

MR. SUTTER: I wasn't thinking of the orbiter as much as I was thinking of what happens to that structure between the main tank and the solid rocket

2160

booster. And we keep looking at that joint and wondering why it did perform the way it did. This could be another item that added to changing its load.

MR. COULTAS: Well, as we are looking at, as Marshall and ourselves are jointly looking at the total load profile through the mission, and that in a reconstruction of the real loads, this is automatically taken into effect, the way we flew it on the day we flew it, basically.

And a loads calculation or a loads profile all the way up is being developed.

Again, the bottom line is that those loads as we see them today are well within our design base, except, and as Marshall has indicated, they need to understand, even with the low loads with an anomalous joint, is there some combined effect that it could be a problem or an issue.

The data processing systems is our on-board software system, consisting of our general purpose computers, and they're basically interfaced with the rest of the vehicle through what we call MDM's. We have again the software, the operating system software which keeps our four machines in synchronization, and then the displays, the crew, and the keyboard functions that the crew can put in.

2161

Again, in that system all the measurements were nominal. We had no errors on those data buses and so forth. Everything was nominal.

We did put in a program, a special precaution to the recovery crews that if we recovered any computer that we would keep it immersed in salt water until we could get at it. There are some non-volatile memory in those computers that we could perhaps preserve, and so that standing statement is out to the recovery crews.

[1219] The display and control system, electrical power distribution system, are all nominal. The communications and tracking system, again everything was nominal there. We did have a couple of data dropouts during the flight, again not anomalous. We have seen these many times before.

The dropout at four seconds is, we believe, due to an antenna. We have to select and deselect antennas as we are flying, depending upon where the ground station is and also to avoid the attenuation through the plumes.

And the one second dropout we also believe was due to plume attenuation.

Instrumentation system, again everything is nominal there. We also got a special request out to the recovery team: Any tape recorder which is recovered, we

2162

have special procedures for recovering the tape and drying the tape in a controlled manner so that we can recover any data off of that.

Of special interest there is a data system that we have that is not telemetered, which has got a lot of environmental data in the cargo bay and external to the vehicle. We have not gotten those back.

(Viewgraph C-6.) [Ref. 3/7-84]

Chart C-6 is our structures area, consisting of the primary structure, purge vent and drain system. We have to vent this vehicle as it goes, as we go into space. We have to repressurize the structure, the cargo bay, and the wings, et cetera, as we re-enter. And we have special doors that open up at certain times in the flight that do this.

We also have included in this system all of our thermal subsystem, our tiles, and so forth. Looking at all of the measurements we have in these areas, the hardware mods that we made specifically for this mission, and again the flight loads, we see nothing anomalous within any of that data.

(Viewgraph C-7.) [Ref. 3/7-85]

Chart C-7, our mechanical subsystem area, consisting of doors, payload bay doors, the vent doors which I mentioned, which are up and down the sides of

2163

the vehicle, the main landing gear and nose landing gear doors, the retention system-these are the latches which hold the cargo in the cargo bay, also a latch-down for the remote manipulator arm.

We also have in that system, mechanical system, at the umbilicals, the large umbilicals, feeding the propellant into the vehicle. And we also have the hatches on the vehicle, the side hatch and overhead emergency egress hatch.

All of the data that we can see there and the flight photos indicate everything is nominal there. One point of interest is that all of the umbilicals between the orbiter and the external tank and between the external tank and the right and left SRB's were all mated until the loss of signal of all of the data. So there was no premature separation of any of the umbilical functions.

DR. FEYNMAN: I thought there was some fussing about with the hatch door.

MR. COULTAS: We had on the launch attempt on the previous day, we did have a problem with the hatch. We have readouts that tell us whether all of the hatch latches are all down, and we had a readout problem with one of those. And we also had a problem of getting a GSE, a ground support handle, off of the hatch on the

2164

prior day.

[1220] We have looked at that and we see nothing in that information that would cause us any concern. Actually, we're going to fix the problem that we have had with the GSE handle, but on the day that we did launch it was not an issue.

CHAIRMAN ROGERS: Thank you, Mr. Coultas. We appreciate it.

Mr. Hopson.

MR. HOPSON: Mr. Chairman, Commission members:

I'm George Hopson. For the past four years, I've been assigned as director of Systems Analysis and Integration Laboratory at Marshall.

CHAIRMAN ROGERS: Mr. Hopson, would you move your microphone over a little bit.

MR. HOPSON: Prior to that time, I was assigned as director of the Systems Dynamics Laboratory. My present assignment is chairman of the SSME investigation with regard to flight 51-L.

Could I have the second chart, please.

(Viewgraph H-2.) [Ref. 3/7-86]

Here are some of the characteristics of the shuttle main engine, and I will just say it is capable of about a half a million pounds of thrust and it is

2165

throttleable down to 65 percent.

The next chart, please.

(Viewgraph H-3.) [Ref. 3/7-87]

Our first task on our team was to verify, based upon our ground test experience and using the telemetry data that we received from Challenger, that we would be able to discern an engine failure. And we did verify that capability.

The data that we get, the telemetry data from Challenger, is 25 samples per second, and we did verify that we could pick up, based upon our past experience, an engine problem with that sample rate.

We reviewed all of the data during all phases of the engine operation for any sign of malfunction or degradation in performance, and I will report on these findings subsequently.

We also re-reviewed the records of the pre-flight condition of the engines and found no omissions or discrepancies.

Lastly, we inspected the recovered engine hardware to compare the condition of the engines with what the telemetry data had indicated, and I will report on that also.

(Viewgraph H-4.) [Ref. 3/7-88]

Addressing pre-flight, there are several

2166

measurements that we can use that we do monitor preflight, that have to do with temperature. One thing that we are looking for in the engine compartment is any evidence of a propellant leak, where abnormally low temperatures would be indicated by these measurements that are in the engine compartment. We found no evidence of any propellant leak in the compartment.

We also look at component temperatures to make sure that they are within the limits that those components are designed and have been demonstrated to operate at. All components within the engine compartment were within acceptable temperature limits.

The next chart, please.

(Viewgraph H-5.) [Ref. 3/7-89]

I would like to look now at the start transient. This curve shows the chamber pressure buildup for all three of the Challenger engines during the start. The outer bounds that you see there are the chamber pressures which are acceptable as a function of time during start, and you can see that all three Challenger engines came up well within the acceptable bounds.

[1221] So there was nothing abnormal whatsoever about the start.

The next chart, please.

2167

(Viewgraph H-6.) [Ref. 3/7-90)

I have taken a little bit different tack on this one. This is also a start transient chart. One of our most important measurements as far as determining the health of the engine is the discharge temperature from the high pressure fuel pump.

These three curves that you see on this chart are those type measurements, But rather than being the three Challenger engines, I have picked engine number one from-they are all Challenger engines, but only one of them is from flight 51-L. The other two are from the two preceding flights.

So the message from this curve is - well, there's two messages. One, that performance has been very consistent during those flights, one flight to another; and the other is it is a very satisfactory start as far as those temperatures are concerned.

The next chart, please.

(Viewgraph H-7.) [Ref. 3/7-91]

Now we want to go to - we have looked at the transient and we want to look at the main stage performance, that is after we get up to power. And as it was stated earlier, we start and we go up to 100 percent, and we stayed at 104 percent for a while and then dropped down to, what was it, 95 or 96 percent, and

2168

then down to 65, and then back out of the start bucket up to 104 percent.

Now, for the first 73 seconds we have got something like - we've got something like 115 measurements of each engine, and we get a measurement every 40 milliseconds, and so we get 25 samples per second from that number of measurements, plus we have some orbiter measurements that we also look at, and we looked at in great detail every measurement during not only this main stage operation, but the transient and naturally during the incident.

Everything was nominal up until about 73 seconds, where this curve goes to -

MR. SUTTER: Is this engine versus thrust time programmed? Is that automatic?

MR. HOPSON: Yes, that is a closed loop control system.

MR. SUTTER: How many flights other than this one did you drop down to the 65 percent? Is that usual?

MR. HOPSON: Every one of them. On these particular engines, two of the engines, this was the fifth flight. We had four previous flights, or was it six? I think we had four previous flights on two of the engines and three previous flights on one of them.

2169

And in all cases we dropped down to 65 percent during the Max Q regime.

The next chart, please.

(Viewgraph H-8.) [Ref. 3/7-921

Now, this shows, this is an expanded chart and the whole chart only covers one second, and this again is of our high pressure fuel turbopump discharge temperature. Our red line limit, as you can see, is 160 degrees roentgen. That red line, if we exceed that red line the controller automatically shuts that engine down.

And you can see that up until - up until 73 seconds - well, in fact past 73 seconds, the data looks very normal and that is what it is supposed to look like, what it looks like here.

[1222] We did notice at a little bit before 73 seconds that we had a decrease in oxygen and hydrogen inlet pressure to the engines, and then about two-tenths of a second later than that, then we started seeing things happening. We saw the flash between the orbiter and the external tank, and we saw the turbine discharge temperature start to go up.

Now, this is blank here, that was during the explosion of the external tank and the data was blacked out during that period of time. We didn't get anything during that period of time, but then we did

2170

pick the data up again a few milliseconds later. And as you can see, it first approaches and then exceeds the red line.

Now, we've got indication that the way the shutdown goes, the computer makes a cycle every 20 milliseconds, and so when that computer gets an indication that this red line on an engine has been violated, that is what we call one strike. That is one indication.

The computer has got to have three consecutive indications of violation of a red line and then it gives the orbiter a signal - or the controller shuts that engine down. So on engine number one, we verified that we got three strikes and that the engine had been - the shutdown had been initiated.

On the other two engines, we got indications that at least one strike had occurred on both of the other two engines. And so we were in the process of shutdown on all three of those engines, and that is the way it should have been.

When you see something like this, when you see those temperatures going up to the red line and exceeding it, what that is indicative of is a LOX-rich shutdown. Whenever the LOX supply gets too high, that is when the temperatures go up and that is when we burn

2171

the internal parts, the hot gas parts of the engine.

And we have seen this in test stand accidents before, and so we would expect, having seen a curve like this, that the engine would pretty well be gutted in the hot gas regions of the engine.

And the next chart, please.

(Viewgraph H-9.) [Ref. 3/7-93]

When we looked at the recovered hardware, that is in fact what did happen.

I would say first that all of the engines were recovered in close proximity to each other, and in fact looked like that they were still attached to the thrust structure and the bulkhead at water impact. The bearings, the gimbal bearings, had failed in an overload mode and so the engines and the thrust structure did appear to be together.

In other words, it didn't blow up and scatter the parts over a wide distance.

All of the fractures were looked at, and the fractures all had the appearance of ductile overload. That is, overload due to like impact from another piece of structure or impact, more likely, impact with water; and that there was no engine explosions involved.

The engines did have burn-through damage in the hot gas regions due to these expected internal

2172

over temperatures. All three high pressure fuel pumps were burned through.

One thing of particular interest to us, there was no - the housing was burned through, but it was not ruptured or burned through in the vicinity of the turbine blades. And so that told us that the turbine blades - that there was no turbine blade came loose and damaged anything, but they got burned off.

[1223] And so I guess in summary, we have looked at the data in great detail. The engine operated perfectly normally, well after, in fact 14 1/2 seconds after, flame was observed coming from the side of the SRB and several other events along those same lines. Engine performance was perfectly nominal. In fact, the engines were even running after the external tank had exploded.

And so our findings are that the engines were in no. way associated with the failure of flight 51-L.

CHAIRMAN ROGERS: Thank you very much, Mr. Hopson.

Mr. Lee.

MR. LEE: Now, Mr. Chairman, I would like to now discuss the inertial upper stage. I was not the chairman of this particular working group. The results seem reasonably straightforward. So with your permission, I would like to present those results.

2173

The approach to this investigation was similar to the ones that you have heard before. In fact, each of these elements were almost identical, and in the case of the inertial upper stage the team was made up of NASA personnel, Air Force Space Division personnel, the Boeing Company, the prime contractor for the inertial upper stage, and the Aerospace Corporation.

We reviewed every technical discipline, as has been indicated in the previous reviews.

(Slide.) [Ref. 3/7-94]

What you see now on the screen is the inertial upper stage with the tracking and relay data satellite attached forward. To give you an example, it is made up of really three major elements: the satellite, the black or darker portion forward; the white portion with "USA" on it is the two-stage inertial upper stage; and then the third element and very significant element is the airborne support equipment, and that is the equipment which hold the IUS or inertial upper stage in the orbiter bay. It's very critical to the entire operation for launching and separation at orbit.

Now, to give you an idea of the dimensions, the stage is approximately 17 feet in length, about 9 1/2 feet in diameter. The payload, that total IUS or the stage weight is approximately 35,000 pounds, and the

2174

satellite is about 5,000 pounds.

Could I have the next viewgraph, please.

(Viewgraph J-2.) [Ref. 3/7-95]

MR. LEE: This is a continuation of the fault tree you saw initially, where the three major areas that we believe that could contribute to a cargo or inertial upper stage failure would be: one, a premature ignition of the propulsion system; two, an explosion or fire due to other reasons in the bay; and three, element separation.

And I would like to address each of those if I could. In the case of premature ignition, there is three different types of premature ignition we believe we can get.

First let me say that the inertial upper stage is relatively quiescent relative to-during the ascent phase of flight, meaning we have little or no electronics or avionics on, we have little or no instrumentation coming back to ground during that phase of flight. And so what we are having to construct this with with our rationale for acceptance is based on other data, plus other instrumentation data, flight data, plus recovered hardware.

We have been very fortunate in recovering a sufficient amount of the stage to be able to prove our

2175

rationale or support our rationale.

[1224] On the premature ignition of the stage, we found three different areas that could postulate three different types of ignition: one would be from an electrostatic discharge; an inadvertent ignition command that would ignite the motor; and an auto-ignition. And if I might, I would like to talk about each of those briefly to give you our rationale for why we think that we didn't have this case.

I will take the premature ignition first. The orbiter payload bay does in fact have a number of temperature sensors in the bay, and we believe that if we had ignited the stage that we would have had a tremendously high temperature rise rate, which would have been detected by those temperature sensors. As we progressed through the flight, those temperatures remained stable throughout the entire phase of flight until we lost signal.

The second is, if we had ignited that stage we would have no doubt had a tremendous shock within the bay. The orbiter instrumentation indicates no such shock. Plus, the payload, the tracking and data relay satellite, does in fact have an instrumentation which would allow you to be able to detect motion on that stage, which is being transmitted back during the ascent

2176

phase, and we saw nothing on that telemetry.

The main thing I guess would be the inspection of the recovered hardware, which included the alarming devices, igniters, and we found quite a bit of unignited propellant. So that the recovered hardware plus that amount of instrumentation leads us to believe that we did not have a premature ignition during that phase.

The second is the explosion or fire, and we have postulated the only possibility for being able to got a fire other than a premature ignition would be the reaction control system failure, a battery failure, an explosion of a battery, say, some other cause for the solid rocket motor propellant to become-to burn, and that may be from a shock, electrically induced fire, or some - or radio radiation that caused some activity, some activation which we didn't anticipate.

In each of those cases, we found that on the recovered hardware, that the place where the areas where this sort of thing would happen there was no fire indication. The same temperature sensors that I referred to before in the payload bay gave no indication, obviously, of overheating, and so we believe there was no fire from any other source in the bay.

The third category or third area for suspect would be the separation of the elements, and the

2177

separation of the elements we are talking about here is the entire payload separating from the orbiter some way inadvertently, the two stages separating from themselves and the payload separating from the stage.

Based on the same data, telemeter data we got back from the orbiter that I mentioned earlier, we saw no indication of any abnormal movement of the stage in the bay. We have electrical power going from the orbiter into, throughout the inertial upper stage to the payload, and we believe if there had been any separation of any of that we would have lost continuity electrically.

In addition, in the recovered hardware we see no evidence of any abnormal separation between those stages. Based on - and this is a brief summary, but based upon those findings - and we were quite lucky to get as much of the hardware back which proves this point - we believe that the inertial upper stage and the attached TDRS or the tracking and data relay satellite did not contribute to this incident.

CHAIRMAN ROGERS: Thank you very much, Mr. Lee.

[1225] Well, let me express our appreciation for these reports, which have been very helpful. I would like to ask, do you plan to have a written report in

2178

addition to what you presented here today?

MR. LEE: Yes, sir. We will have a separate independent report. We will probably, in the case of the inertial upper stage and the shuttle main engine, we are probably less than a week away, and I would have to defer to Mr. Coultas on the orbiter.

MR. COULTAS: The same on the orbiter. We plan to have a report out by the end of next week, really.

[Laughter.)

CHAIRMAN ROGERS: You don't think you could get that down to five days?

[Laughter.]

CHAIRMAN ROGERS: Well, thank you very much. We appreciate it.

That concludes the meeting for today. Thank you.

(Whereupon, at 4:00 p.m., the Commission was adjourned.)

[Please note that some of the titles to the references listed below do not appear in the original text. Titles are included to identify and clarify the linked references- Chris Gamble, html editor]

[1226] [Ref. 3/7-80] STS Orbiter and GFE Projects Office (JSC): STS 51-L Orbiter Team Configuration.

[1227] [Ref. 3/7-81] STS Orbiter and GFE Projects Office (JSC): STS 51-L Orbiter Team Propulsion and Power.

[1228] [Ref. 3/7-82] STS Orbiter and GFE Projects Office (JSC): STS 51-L Orbiter Team Propulsion and Power. [Ref. 3/7-83] STS Orbiter and GFE Projects Office (JSC): STS 51-L Orbiter Team Avionics.

[1229] [Ref. 3/7-84] STS Orbiter and GFE Projects Office (JSC): STS 51-L Orbiter Team Structure.

[1230] [Ref. 3/7-85] STS Orbiter and GFE Projects Office (JSC): STS 51-L Orbiter Team Mechanical.

[1231] [Ref. 3/7-86 1 of 2] Space Shuttle Main Engine. [Ref. 3/7-86 2 of 2] Space Shuttle Main Engine Characteristics.

[1232] [Ref. 3/7-87] Space Shuttle Main Engine. Team Investigation Approach.

[1233] [Ref. 3/7-88] Space Shuttle Main Engine: Prelaunch Engine Compartment Temperatures.

[1234] [Ref. 3/7-89] Space Shuttle Main Engine: Main Combustion Chamber Pressure (Start Transient). Chamber pressure v. Time from Start Command graph. [Ref. 3/7-90] Space Shuttle Main Engine: High Pressure Turbopump Turbine Discharge Temperature (Start Transient). Temperature v. Time from Start Command graph.

[1235] [Ref. 3/7-91] Space Shuttle Main Engine: Main Combustion Chamber Pressure (Mainstage -ME-1). Chamber presssure v. Time from Liftoff graph.

[1236] [Ref. 3/7-92] Space Shuttle Main Engine: High Pressure Fuel Turbopump Discharge Temperature. Temperature v. Time from Start Command graph.

[1237] [Ref. 3/7-93] Space Shuttle Main Engine: Inspection of Recovered hardware.

[1238] [Ref. 3/7-94] IUS + TDRS in Shuttle Payload Bay.

[1239] [Ref. 3/7-95] IUS Fault Tree.

March 7, 1986 Session (part 1) | Volume 5 index | March 21, 1986 Session (part 1)