[E1] I. Summary
The Independent Test Observer Team was appointed by the Commission to assist its Accident Analysis Panel in the investigation of the Space Shuttle Mission 51-L accident by determining if the tests and analyses being performed by the Marshall Space Flight Center (MSFC) and Morton Thiokol, Incorporated (MTI) were adequate to provide the information needed by the panel. This included assessing whether the right tests and analyses were being done, whether the resulting information was being properly interpreted, and whether the information was sufficient to evaluate all the joint leakage failure mechanisms that were considered.
We have found that, with the exception of analyzing for partial joint rupture from all sources of preexistent cracks, MSFC and MTI have done the appropriate tests and analyses and collected and used the information properly. This has been sufficient to identify several possible mechanisms which acting either singly or in combination can lead to a joint leak.
If it is necessary to obtain more information regarding the leakage mechanisms of the joint, we recommend that full-scale testing be performed. Some members of the team have made specific recommendations regarding additional full-scale testing. We believe further sub-scale tests will not provide additional insight because the scaling factors between sub-scale and full-scale O-rings and joints are not well established.
II. Organization and Responsibilities
A. Charter
The Independent Observer Team was formed by the Commission to review and evaluate the Solid Rocket Motor's (SRM) joint and O-ring tests and the analyses being conducted by MSFC and MTI. Our charter was to answer the following questions:
The answers to these questions were reported to the Accident Analysis Panel of the Commission, led by Major General Donald Kutyna, and are part of this report.
B. Organization
The members of the team and their affiliations are:
|
Eugene G. Haberman (Chairman) |
Air Force Rocket Propulsion Laboratory |
|
Mohan Aswani |
The Aerospace Corporation |
|
Laddie E. Dufka |
The Aerospace Corporation |
|
Don E. Kennedy |
TRW |
|
Michael L. Marx |
National Transportation Safety Board |
|
Wilbur W. Wells |
Air Force Rocket Propulsion Laboratory |
C. Approach
The team took a step-by-step approach to observing the tests and analyses being performed. The initial steps were an overview of the activities at MTI and MSFC and a review of how each possible leak mechanism presented by NASA related to the SRM joint and O-ring was supported by specific tests and analyses. We then looked at each test and analysis to assess its objectives, approaches, and results; the interpretation of these results and the conclusions drawn; the relationship between specific tests and analyses; and the adequacy of the information provided to evaluate the proposed leakage mechanisms. Finally we summarized our observations, reached conclusions and made recommendations to the Commission's Accident Analysis Panel.
Throughout the process members of the group made comments on the testing and analyses to the people involved. As a result, several changes were made, such as including grease in the O-ring resiliency tests (since the O-rings in the joint use grease), turning on the instruments during assembly of the referee joint to determine clevis leg deflection caused by placing the shims during assembly, and conducting 70-pound motor tests with undamaged O-rings.
At the midway point, we briefed senior MSFC members of the NASA Task Force Failure Analysis Team. Before preparing our final report, we briefed our observations and concerns to members of the Commission's Accident Analysis Panel and NASA's Task Force. We subsequently held detailed discussions with senior NASA personnel to resolve outstanding issues and to further discuss our observations, concerns, and recommendations.
[E2] III. Tests Evaluation
Tests conducted at both MSFC and at MTI in support of the STS 51-L accident investigation fall into the following categories:
A. Basic Material Characterization
The basic material characterization tests included O-ring properties characterization and joint material burning tests. Among these tests, resiliency characterization is by far the most comprehensive test, and the results clearly indicated the slow rebound response of O-rings at cold temperatures. The test results, therefore, support the O-ring actuation time delayed by the low temperature failure mechanism. The O-rings were also tested for the presence of defects and inclusions, and the results indicated their influence on the resiliency was minor. The joint material burning test was strictly qualitative and indicated the potential sources of black smoke. An additional observation was that white or gray smoke could turn black in the presence of oxygen.
Several areas of uncertainty relative to O-ring quality became apparent during this review. Splicing is carried out by a proprietary process, which precludes positive control to assure that changes that may require requalification are not introduced without approval by the customer. There is no requirement in the controlling documents that precludes splicing in a permanent twist that could distort the O-ring in its groove, nor is there an inspection procedure at MTI to detect a built-in twist.
Inspection of O-rings for inclusions has revealed high density metallic slivers and particles of iron oxide, silica, and calcium salts. Acceptance specification STW-7-2875 prohibits acceptance of hard white inclusions over O.010-inch diameter, all visible black inclusions, and metallic inclusions of any size.
In one instance, traceability of one group of O-rings to the parent material's source and lot was completely lost by the supplier. Parts or materials of unknown pedigree therefore apparently were accepted for critical application.
B. Cold Flow to Characterize Joint Performance
In an attempt to characterize joint performance, several tests were carried out. Among these, the most significant tests were the O-Ring Blow-by Dynamic Test, the Discrete Increment Piston Cone Test, and the Ice in Joint Test. The O-Ring Blow-by Dynamic Test simulated the full-scale joint rotation, pressurization rate, and O-ring cross section (0.280-inch diameter) but was sub-scale with respect to the diameter of the joint. The results provided information about the influence of cold temperature of initial squeeze, and of gap opening on the sealing capability of the joint and effectively used resiliency data to predict the leakage. They showed that low temperature and high squeeze consistently resulted in leakage, thus supporting O-ring seal failure mechanisms relating to low-temperature and high-squeeze effects. The Ice in Joint Test qualitatively demonstrated that the secondary O-ring could be pushed off its seat, thereby preventing it from sealing properly.
Putty installation into the small diameter full cross section joint used in the MTI Dynamic Vacuum Putty Extrusion Test appeared to be nonrepresentative of the full-scale joint. Applying putty layers into a small diameter restricted area, as compared to a large diameter (virtually straight) annulus, could create different putty functional characteristics. However, the results indicated that joint assembly could create black blowholes in the putty and that cold putty (30°) without blowholes could significantly delay pressurization of the primary O-ring cavity.
The other tests in this category, such as Putty Blow Through, provided qualitative indications further substantiating that putty could hold pressure off the primary O-ring. The colder the temperature, the longer blow through was delayed, possibly holding pressure off the primary O-ring long enough for joint rotation to occur. The O-ring Leak Port Integrity Test showed that leakage from this port was highly unlikely.
C. Full-Scale Joint Simulation
MTI has completed two phases of a three-phase test series designed to characterize the behavior of the clevis joint. The objective of the tests was to provide reliable displacement data for a typical lightweight joint under a constant internal pressure. The gap opening was compared with an analytical model, and the comparison was reasonable. It is our observation that this setup can be used to conduct several more tests to fully characterize the clevis joint and further validate the model.
The "Short Stack" full-diameter abbreviated segment apparatus was used to determine the influence of ice in the joint and its effect on the spreading of the clevis. The deflections measured were very small, which indicated that ice would not appreciably distort the joint.
D. Hot-Firing Environmental Simulation
The 5-inch-diameter hot-firing motor tests were conducted to get preliminary data for O-ring response to various defects and to develop design data for the 70-pound (propellant) hot-firing motor. Hence, while the motor operated at high-pressure and high-temperature conditions it was configured with only one O-ring and did not represent the true motor geometry. Qualitative data indicated that an O-ring joint can sustain leakage without an immediate burn through.
The 70-pound motor was a test bed that used the full-size clevis joint cross section and a motor diameter of 10 inches with durations of up to 70 seconds. It did not allow for dynamic joint rotation and, therefore, tested only the static joint condition. The results indicated that a leaking joint could be plugged by aluminum oxide and other deposits in induced leak paths. There was considerable randomness in these results when burn through mechanism simulation was attempted. The results, however, showed that a slow leak in the joint could eventually result in burn through at the joint or that an initial leak could be plugged by combustion products.
E. Assembly Damage
The full-diameter "Short Stack" was used to conduct tests for possible O-ring damage produced during joint assembly. During these tests, the segments were purposely misaligned axially while being assembled. Results showed that even during extreme conditions, no appreciable damage to the O-rings was found. However, because of the short height of the segments, the configuration was considered too flexible to provide meaningful results. The degree of misalignment was also believed to be extreme relative to realistic stacking conditions.
A similar test conducted by MSFC on a small sector of the fullscale joint showed that slivers of metal could result from improper assembly of the segments when they are excessively out of round or when assembly techniques produce too much interference causing a flat-on-flat condition. Both the small sector and "Short Stack" assembly tests also showed that considerable O-ring stretching can occur during an out-of-axial alignment assembly. Overall these tests indicated that improper or careless assembly could produce damage or contamination contributing to initial seal leaking in the joint.
IV. Analyses Evaluation
The following analyses were performed in support of the STS 51-L investigation:
A. Structural Analyses of SRM Segments, Field Joints and Seals
The loading environment for structural analyses was determined from telemetered data, flight event reconstruction analyses, and measured natural environments. A number of finite element models ranging from 2-D axisymmetric to 3-D nonlinear were prepared to evaluate the dynamic effects of bending and shell [E3] modes on field joint response, the effects of elastic propellant, the interaction of joint and pins, and O-ring response. The results of analyses performed by MSFC and MTI match very well with the "Referee Test" data. However, the comparison was made only for one case of constant internal pressure.
The O-ring response analysis, based on the assumption that the O-ring is made of a linear elastic material, has provided qualitative data regarding the sealing mechanism. The analyses indicate that too much compression in the O-ring is harmful. In that event, when the O-ring occupies almost the entire gland volume and touches gland walls, it may not actuate properly to provide an effective seal. The assumptions made in the model make the results valuable for qualitative purposes only. These results tend to support the contributing mechanism of maximum O-ring squeeze limiting pressure-assisted actuation of the seal coupled with low temperature limiting the O-ring's capability to follow the sealing surface.
The fracture mechanics analyses conducted at MSFC, with respect to joint rupture due to mating loads and membrane rupture resulting from in-flight stresses showed that case rupture due to assembly and in-flight membrane rupture were unlikely. There is, however, a need to carefully examine the stresses in the clevis joint due to residual stress and induced loading, including mating, to adequately determine whether the joint could partially rupture from an undetected preexistent crack.
B. Flow and Thermal Analyses
Flow and thermal analyses were performed by MSFC in an attempt to explain the transition of the puff of smoke observed at O.668 seconds into a hot jet at 58 seconds. The three scenarios considered were (1) the initial leak at liftoff continues throughout the O to 58-second period, limited by the deposit of aluminum and other debris; (2) the initial leak at liftoff continues throughout the O to 58-second period, limited by alumina and/or insulation and putty deposits, and at 58 seconds the blockage breaks open due to vibrations or closing of the joint resulting in burn through; and (3) the initial leak at liftoff does not continue past 5 to 6 seconds, and the leakage is sealed by alumina and/or insulation and putty debris, and at 58 seconds excessive vibrations or joint motions break the alumina deposit and cause rapid burn through. The analyses conducted thus far have not been able to favor one scenario over the other.
Additional flow and thermal analysis was conducted to determine the effect of inhibitor flaws and whether a debond between the propellant and the insulation could result in case or joint burn through at the appropriate time. Inhibitor flaws and debonds on both the upper and lower segments were analyzed, and the results indicated that burn through was not likely at the time and place it is believed to have occurred.
V. Conclusions.
The review of Tests and Analyses conducted at MSFC and MTI led us to the following conclusions:
1. Inadequate quality control procedures for determining O-ring quality was indicated.
2. Insufficient analysis was performed for partial joint rupture emanating from all sources of preexistent cracks.
3. Adequate analyses and tests have been conducted to indicate that SRM inhibitor flaws, propellant debonds adjacent to the joint, leak check port leaks, and case membrane rupture from a preexisting crack are unlikely sources for burn through in the SRM.
4. Tests and analyses performed indicated that putty holding pressure, thereby delaying O-ring pressurization; low temperature adversely affecting O-ring resiliency; ice unseating the secondary O-ring; case diameter mismatch, resulting in near metal-to-metal contact, producing excessive squeeze that delays or prevents pressure-assisted actuation of the O-ring; and assembly damage could contribute to seal leakage.
5. Testing and analysis were performed which only approximate the operation of the full-scale joint and possible leaking mechanisms. Therefore, some caution is needed in projecting the operation of small-scale tests to full-scale hardware. In fact, it is apparent the operation of the full-scale joint and its leakage mechanisms is not fully understood.
6. Tests appear to support that a slow leak or a leak which becomes plugged by combustion products and soot can occur. Analysis indicates that a delay burn through is possible as a result of a slow leak or a leak that stops and later resumes.
7. Tests and analyses need further correlation.
8. In general, the results of the tests and analyses performed were interpreted properly, and the data was used correctly.
VI. Recommendations
I. If it is necessary to obtain more information regarding the leakage mechanisms of the SRM joint, we recommend that fullscale, full-diameter testing of the SRM joint be performed.
2. A more in-depth analysis for partial joint rupture emanating from all sources of preexistent cracking in the joint should be done.
3. Better O-ring quality control is needed, especially in the areas of avoiding twist in splicing, inspecting for inclusions, and pedigree.
4. Correlation of analyses and test results should continue.
VII. Additional Comments
Several members of the team (Haberman, Kennedy, and Wells) have strong recommendations for what should be included in additional tests. The remaining members of the team (Aswani, Dufka, and Marx) believe that specific test recommendations are not warranted and should not be included in this report.
From Haberman, Kennedy, and Wells:
Additional full-scale, full-diameter tests are recommended to provide increased understanding of how the SRM joint operates if it is necessary to further define joint operation and its leakage mechanisms.
The joint's operating environment should be simulated as accurately as possible during testing and should include consideration of external loads (due to "twang," External Tank attach struts, aerodynamic forces, etc.); internal loads (due to motor pressure, pressurization rate, thrust, etc.); temperature; water or ice in the joint; variations in hardware dimensions (i.e., O-ring dimensions, seal gap, segment ovality, inhibitor gap, repaired sealing surfaces, etc.); and putty variations (as affected by aging under representative temperature and humidity conditions, joint rotation, inhibitor gap, leak check pressurization, etc.). Many of these variables could be evaluated adequately in cold-gas pressurization tests with the MTI Short Stack and Referee Test hardware. The Short Stack could be used for assembly and O-ring leak-check tests to determine when and where back blowholes occur. It could also be used to evaluate the initial response of putty and O-rings before joint rotation. The Referee Test hardware, which is already well-instrumented, could be used for cold-gas pressurization tests that should include the effects of joint rotation water/ice in the joint, dimensional/fit variations, external loads, as well as temperature and putty conditions.
Critical points of interest in these tests are how the primary O-ring seal moves and seals as the joint rotates open under the influence of internal motor pressure and how O-ring performance is affected by the above variables. An important question, not answerable in sub-scale tests is, "Will the full-scale O-ring move and seal if part of it starts to do so?" This is important because the compression of the O-ring (which is a critical factor in 0-[E4] ring sealing, especially at low temperatures) is not uniform around the full-scale joint.
We also recommend that further full-scale tests be done to characterize SRM joint performance under hot-firing conditions to assess the viability of the slow leak and the leak/stop-leak/leak scenarios as explanations for the STS 51-L SRM joint failure. The joint environmental simulation hardware could be used for these tests; however, a minimum duration of 5 seconds should be considered. Specific test variables should be selected based on the results of the already completed sub-scale tests and the full-scale tests recommended above.