STS-121 The Hardest Launch Part 4: Damage to the Heatshield

The ultimate controversy at the STS-121 Flight Readiness Review was the potential of fatal damage to the space shuttle during launch from foam loss from the External Tank.  The possibility of a replay of the loss of Columbia was the nightmare scenario that none of us wanted to experience.

In the first return to flight attempt, STS-114, events proved we had not adequately solved that problem.  Our initial conclusion that foam loss was due to installation error by the workers turned out to be incorrect.  Rather we found in that flight and the investigation that followed, that areas of foam on top of foam – where slightly different formulations of foam were used – would come apart due to something called ‘differential coefficient of thermal expansion’.  I wrote about that in depth earlier:  https://waynehale.wordpress.com/2012/04/18/how-we-nearly-lost-discovery/ .

The External Tank is a thin aluminum structure with surface parts sticking out; it all needs to be insulated because the liquids inside the tank are cryogenic.  Without insulation water from condensation out of the humid Florida air would quickly turn to ice.  Ice is an even bigger threat than loose foam.   So, insulation is required, and foam is the lightest weight type of insulation.  The vast expanse of tank surface area was covered by a formulation of insulation that was robotically sprayed on, but the small sticky-outie areas had to be covered by hand with different types of foam.  These ‘foam on foam’ areas proved to be the problem; they could come off during launch – particularly a from fittings called ‘ice-frost ramps’ (IFR).  We started an effort to shave down the foam as much as possible.  That limited the amount of possible debris.  But losses were still possible.

HPIM0108.JPG

Ice-Frost Ramps of foam cover the attachment points for external lines on the outside of the ET

Using wind tunnels, super computers with Computational Fluid Dynamics programs, and finally Probabilistic Risk Analysis we studied the possible results.  Starting in January there was not much time.  In June, just before the Flight Readiness Review, the first results were finally ready to be revealed.  We needed to know what would be the likelihood of the shaved down foam coming off and critically damaging Discovery’s heat shield. Days before the FRR we got the results.

The results were not good.

NASA uses a matrix to plot the risks involved in any activity.  Five squares by five squares; rating risk probability from low to high and consequence from negligible to catastrophic.  The risk of foam coming off part of the External Tank and causing another catastrophe was in the top right-hand box:  5×5:  Probable and Catastrophic.  That square is colored red for a reason.

Completely unacceptable.  All the rules said no-go.

But the analysts did more than just present the results; they discussed the methodology used in the analysis.  In several critical areas they did not have the information they needed so they made worst case assumptions.  The results, they said, were probably overly bad; but they could not tell us by how much.  Weeks more of additional analysis might yield a more precise answer. And of course, we could return the vehicle from the launch pad back to the assembly areas where we could do more foam removal, if possible. Either way, it seemed like the launch would be delayed by a significant time.

This was a low point.  I felt, as the program manager who had multiple discussions with the analysts, that the results should have been better, in the area where the risk might be acceptable.  But it was hard to argue that the launch would be adequately safe.

Then up jumped the NASA Administrator, Mike Griffin, from his seat in the front row of the gallery, to the microphone.  What followed was a very interesting discussion of probability and statistics and a plausible interpretation that the PRA results were too conservative.  In fact, he concluded, the risk was acceptable.  Even the analysts present agreed with him.

What a turnaround.

With considerable discussion, and the notes penciled in on the Certification of Flight Readiness, the decision was to go ahead with the mission.

Were we smart or just lucky?  Nothing came off to damage Discovery on a beautiful July 4 launch.

As months past, and the analysis got better, the probability of catastrophe – as calculated – became acceptable, even low.

IFR Risk evolution

Reminds me somehow about what Mark Twain said about statistics.

About waynehale

Wayne Hale is retired from NASA after 32 years. In his career he was the Space Shuttle Program Manager or Deputy for 5 years, a Space Shuttle Flight Director for 40 missions, and is currently a consultant and full time grandpa. He is available for speaking engagements through Special Aerospace Services.
This entry was posted in Uncategorized. Bookmark the permalink.

8 Responses to STS-121 The Hardest Launch Part 4: Damage to the Heatshield

  1. denniswingo says:

    Whatever anyone may think of Mike, he does have engineering chops and the guts to make hard decisions.

  2. Beth says:

    Wow. A more than interesting story. We used FMEA in engine design all the time, when I was an engineer with Cummins. The results, as always, are only as good as your data. I think Mr. Griffin was lucky.

    • Patrick Chase says:

      From looking at the PowerPoint (thanks) it appears that they understood at the time that the FMEA grossly over-predicted historical foam-shedding rates. In other words, when the FMEA was run on a pre-STS-116 vehicle configuration it predicted a far higher shed rate than had actually been observed.

      If that was indeed known, then Griffin would have had a sound reason to discount the modeled risk.

  3. Steve says:

    The combination of Mr. Griffin’s on-the-fly clac’s, the other analysts’ agreement/validation of his conclusion, and 100+ launches with no catastrophic loss due to the ice ramps tells me it was more smarts (or experience) than luck. Of course, the fact there even is a chance that things could go catastrophic means every good launch did have a smidgeon of luck associated with it already!

    Experience and gut feelings should always have a place in these sorts of discussions—yes, even with humans riding on those decisions.

  4. Dennis Romano says:

    Any time you launch something there is risk involved; if we wanted to be completely safe, we would never launch. The goal is to understand the risks and minimize them to an acceptable level. Deciding what is acceptable and having the understanding of all of the elements that make up the risk is the problem. It’s a probabilistic determination, and there is some “art” involved in addition to the science and engineering. There is no one correct answer. In this case I don’t know if Mike Griffin was lucky or good; I suspect some of both. It’s like the old saying that there comes a time in every project when you have to shoot the engineers and get into production.

  5. Dan Grey says:

    Luck was not a factor; the information that became available later demonstrated that. I’m really surprised you talked yourselves into launching on the data you had. That reads like something straight from Feynman.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s