• FEBRUARY 13, 1986 SESSION. [part 2 of 2]

  Richard Kohrs.

  Charles Stevenson.

  W. Lucas, J. Moore, M. Silveira, G.Hardy, H. Lamberth and J. Harrington.

  Jack Lee

  George Hardy

  Richard Bachtel

  Thomas Moser

   

   

   

Note:

Centered number = Hearing page

[bold number] = Text page.

MR. LEE: I am Jack Lee. I am Deputy Director of the Marshall Space Flight Center, Bill Lucas' deputy, and the day of the incident I was assigned by him to head the Marshall contingency investigative team for the elements for which the Marshall Space Flight Center is responsible.

(Viewgraph. ) [Ref. 2/13-28]

MR. LEE: We want to cover two subjects today. I would like to give you a brief summary of our contingency team activities, and more specifically, what you have been waiting for is a status report on our failure analysis.

Could I have the next chart, please?

[496] (Viewgraph. ) [Ref. 2/13-29]

MR. LEE: We are operating under a contingency plan which was approved prior to the 51-L flight by Bill Lucas. It consists of working groups for the inertial upper stage, the external tank, the Shuttle main engine, the solid rocket booster, the solid rocket motor, and for this particular activity we established a systems team because a number of these elements come together. Our team is comprised of both NASA and the contractor personnel. We located these people in the Huntsville

Operations Support Center at Marshall Space Flight Center, and we have impounded the data as directed by Jesse Moore, and we have maintained the impoundment of this data with the possible exception of in some areas we have to take film out for special analysis or some data for special analysis, but it is under our control, and we have a secure area at HOSC.

The areas we chose to review, as they were directed by the contingency plan, is the entire manufacturing process, manufacturing and processing for each of these elements, the acceptance test packages. That is, in the case of a Shuttle main engine, that would be not only the static testing but the factory checkout from the time it leaves the factory until it goes through the prelaunch processing here at the Cape.

In the case of the solid rocket boosters and the used cases of the solid rocket motor, that would include the refurbishment and reprocessing of each of those, and that is acceptance and transportation. We include the transportation from the manufacturing site to the test site and to KSC. Specifically what we are looking for here is any unusual environments which the hardware goes through, usually humidity environmental, accelerations and so forth.

We have reviewed the data packages for the

prelaunch activities here at the Cape and the actual flight data. Now, within those reviews, the status of those reviews, we vary from 75 to 100 percent of that activity. Thus far we have looked at all of that data. That does not mean we have completed the analysis and stopped looking at that data. That means that one of our teams has looked at that from at least 75 to 100 percent of them.

Could I have the next viewgraph, please?

(Viewgraph. ) [Ref. 2/13-30]

MR. LEE: This is a graphical time line.

MR. SUTTER: Excuse me. You are doing this test and analysis?

MR. LEE: No, no, no, this a review of past history of this hardware. Now, what we are doing in relationship to the failure analysis, we have another presentation to go into detail on that, but this is a category review, if you will. We have looked back to see if there were any configuration changes or anomalies or problem reports in the history of this hardware that have been identified which could contribute in any way, either directly or indirectly, to this.

DR. COVERT: Does this also include the catalogue of waivers?

MR. LEE: Everything.

MR. SUTTER: There have been a lot of design changes.

MR. LEE: No, there haven't been a lot of design changes.

MR. SUTTER: In my opinion there have been.

MR. LEE: Not on this vehicle.

[497] MR. SUTTER: There have been a lot of design changes from the first one to this one, and this one is the last one that had all of them.

How do you go back and look at that as you progressively put them in, and one of them may have tripped an incident.

MR. LEE: Let me clarify. I did not explain properly. This is the deviations from the previous, from previous vehicles. In other words, we are looking at changes specifically to this vehicle and anomalies against this vehicle from previous flights, and we did not go back at this time to the first Shuttle flight. I misrepresented that if that is what you understood.

MR. SUTTER: Well, maybe you are going to talk about this, but one of the things I think is necessary is to look at all of these changes, and yes, the last flight was successful and this one wasn't, but just looking at what happened between this one and this one, maybe it was one of these other changes that because

something wasn't critical on this flight you got by with it, but when you add them all together on this flight, one of those other things may have tripped it over the edge.

MR. LEE: And we intend to progress progressively further back into the review. When we get to - this is our first blush at all of those elements. As we hone in on a particular like the solid rocket motor, like the external tank that we talked about, we will in fact do that, and we are doing that part of it. If in the case of - -

MR. SUTTER: Including waivers and including things that were suggested as waivers and didn't get up to design review board, and including changes that were suggested and were passed over?

MR. LEE: That's right. We will do that for sure on the suspect elements, and the thing I have reported here is we have only gone to the deltas from the last flight. We will progress back into that, yes, sir.

Does that answer that?

MR. SUTTER: Well, I think at least some members of the Commission, I think, would like to somehow review that whole history and review the actions you have taken on waivers, and how it was concluded

that, for instance, taking the loads on the main tank went down, why was it concluded that the initial design was one way and then somebody thought that he could change the design criteria? Those are some of the things that I think some of us, to do a thorough analysis of everything that has happened, some of us would like to go right back to that.

CHAIRMAN ROGERS: Could I just say that we are looking for a way of setting up subcommittees, and it just occurred to me how to establish one. You are the chairman of that subcommittee.

Who else would you like to have working with you on this aspect? I mean, it should probably be only two people.

MR. SUTTER: Anybody that wants to volunteer. I have got some ideas of guys that could help. Maybe we ought to have a separate meeting on that.

CHAIRMAN ROGERS: Anyway, well, you chair the subcommittee, and I think that is a perfect thing for you to do.

MR. LEE: Our configuration, control, identification, and our problem reporting system will allow us to track that, but we will probably have that in our files.

What I would like to do here is show

graphically a time line that we talked about that at least two of the other presenters have talked about, and the reason for the underlining in red - and this is a preliminary time line, it was as of - when I made the chart it was on Monday. There have been slight adjustments. There is only, I believe there is less than around a tenth of a second off. The sequence is right, but those times need to be adjusted.

And for my presentation purposes, that tenth of a second is not critical at this time.

Let me start with we ignited the SMSEs at T minus 6.6 seconds, as planned. T zero is the SRB ignition and lift-off. The first instant we report - and by the way, I am reporting what is predicted and was planned in some cases, and some not necessarily anomalies but some things that might be slightly off nominal, and some items that are actually anomalous by our interpretation, and I will distinguish those for you.

The famous black smoke that we just discussed, we see that first indication about a half a second, and we think we see it up until about 12, a little over 12, between 12 and 13 seconds.

I would like to add one other piece of information that didn't come out in the previous

analysis of that smoke. It is not all black. There is some white smoke in it, too. Just for clarity and for information about this particular column of smoke, it is very essential to us that we understand the location and the time of that smoke, and the camera angles that you have seen are not adequate to be able to produce that for us yet. We are going through some gas dynamics calculations to be able to try to relate that to the vehicle motion so that we can pin that time down exactly.

At about 5 to 9 seconds, we did see a slightly high performance on the right hand solid rocket motor. This was well within our experience base, and we don't indicate that as an anomaly, but because it changed, shifted our Shuttle main engine thrust bucket, where we go from 100 to 104 percent down to 65 percent and back up to 104 percent again, it shifted it slightly, so we went from 104 to 94 because of this higher performance here, which is still well within our experience base.

DR. COVERT: What does that say, 26 or 2 Gs or what?

MR. LEE: This is 2 sigma high performance. That is equivalent to about 18 psi, 17 to 18 psi.

DR. COVERT: 2 sigma is five times in 100?

MR. LEE: It is about three percent off of 100.

DR. COVERT: I'm talking about statistically 2 sigma being about five times in 100?

MR. LEE: Yes.

GENERAL KUTYNA: What could cause something like that?

MR. LEE: That is just the way the sample that we - the test fire sample of the actual grain, the five inch motor, and its performance is comparable to this. It will be a slight, not a defect, a flaw or a crack in the propellant would give you an increased irregular grain rate for a longer period of time. It is just an irregular shaping of the grain maybe, nothing - I mean, not anything abnormal about that at all from our experience base. The only reason I put it up there is to explain the Shuttle main engine throttling and because we were looking for everything that could be slightly unusual.

At 40 seconds we see a 2 degree gimbal angle on the - on both the solid rocket boosters. This is well within our experience base, and we explain that because of winds, it is directly related to some winds. We don't see anything unusual, so we don't worry about that.

[499] The first incidence that we see of an intermittent hot gas emanating from the right hand solid

rocket motor is about a little over 58 seconds. When we see it continuous, it is about 100 milliseconds after that. So from intermittent to continuous, and continuous is throughout the flight, this corresponds very closely to the reconstructed Max Q time.

MR. FEYNMAN: This observation is the photographs?

MR. LEE: These were observations of the photographs. These are Max Q reconstructed.

DR. COVERT: I want to go back to that earlier point, please. You sort of gave me a nice warm feeling about this 2 sigma business. You have fired 50 of these things in flight, 25 flights, I believe, and you probably have fired another dozen or so at Thiokol and in the qualification testing and so forth, so that 5 percent is 5 out of 100. So we are talking about a possibility of one failure, having one rocket having this degree of exceedance from normal, and I guess that wouldn't give me a warm feeling under the circumstances.

MR. LEE: This is 2 sigma of performance around the main performance for that time.

DR. COVERT: I understand exactly what that means, and what I am saying is if I take 2 sigma as being a variance that occurs at some degree of

confidence, five times out of 100, or which is one time in 20, you take the total firings you have faced, you haven't had very many exceedances of 2 sigma.

MR. FEYNMAN: Well, he has presented the data. He has told you what it is. It is 2 sigma, and it is up to you to interpret whether you think the 2 sigma is significant or not.

DR. COVERT: Okay, fine. Press on.

MR. LEE: It is in our experience. That's all I can say. It is within our experience base.

Now, the next event we see is the right hand - and this is just after we see the continuous flow from the right hand solid rocket motor, we see a divergence of the chamber pressure from the mean, from the mean of previous flights and also from the left hand solid rocket motor, and so you kind of expect that with the flow, the hot gas flow coming out of the side of the SRB.

The next event we see is the evidence of impingement of that hot gas on the LH2, the liquid hydrogen tank.

MR. FEYNMAN: Evident through pictures?

MR. LEE: Yes. That is still photographs. In this period of time we have a 2 degree per second body motion or body rate on the SRBs that we don't totally

understand. We have some wind sheers and some loading that we can get from what we anticipate this thrust to be. We don't have that completely reconstructed, and so I will have to say that we see this on our instrumentation, but we don't totally explain that.

GENERAL KUTYNA: Jack, let's go back to Max Q. At Max Q we have the max stress on this particular joint that we think failed.

MR. LEE: We have the maximum stress of any field joint in flight, on this particular aft joint at Max Q.

GENERAL KUTYNA: So it happens on that joint at Max Q.

Now, how sharp do we come to Max Q? Does it just happen at 58.83 or does it build up?

MR. LEE: It builds up. It could be two or three seconds.

GENERAL KUTYNA: So, at Max Q, the effect on that joint could have happened before the hot gas flows out?

[500] MR. LEE: I would say yes, and the guys who reconstructed this would probably agree with

MR. RUMMEL: How does the stress on the load on the joint at Max Q compare to the so-called tang load in the second joints?

MR. LEE: The bending load at lift-off, at the tang load, is high. I think it is - I believe - do you know, George, exactly?

MR. HARDY: I don't know the numbers.

MR. LEE: We will get that for you. It is higher. I know that. It is higher at lift-off.

The next event that we see is the first evidence of the liquid hydrogen tank leaking, and you would expect that from the impingement of the hot gas from the solid rocket motor.

MR. FEYNMAN: That evidence was not photo, that was pressure gauge?

MR. LEE: No, that is still photo evidence.

Now, the next one is pressure gauge evidence. The pressure transducers in the liquid hydrogen tank - there are three of these - at 67 seconds we see a decrease, a decrease in the rate of increase, which does not say that we are decreasing the LH pressure; we are decreasing the rate of increase.

DR. WALKER: And that is anomalous?

MR. LEE: That's anomalous.

MR. HOTZ: Could you just go back one event on the first evidence of the hydrogen tank leak? Where physically in the tank does that evidence occur?

MR. LEE: It is in the same vicinity that you saw the plume come out here.

All right, the next thing we see is another measured event on the liquid hydrogen pressure at about 72 seconds, and we differ a few milliseconds. That has to be adjusted, but at this time we see a decrease in the hydrogen tank, in the ullage of the hydrogen tank, and we are trying to make that up with the pressure, but we are not able to. So we know that the two flow control valves that feed the pressure into the hydrogen tank are in fact full open. and they are trying to make up that ullage.

MR. FEYNMAN: It is leaking out faster than the gas is going in?

MR. LEE: That's right. It's leaking out faster than the gas is going in. At the same time period we see an unusual occurrence of the right hand, what appears to be the right hand solid rocket booster, the base, what appears to be at the base coming out, okay. So like it is pivoting about the top, and it is in fact rotating relative, at an angle relative to the rest of the stack. And we compare that data with what is happening in the orbiter and the other SRB.

MR. FEYNMAN: And you have gyros in each instrument that are different from each other?

MR. LEE: That's right, and the way we would explain that would be that base rotating out. In the

same time period we get a lot of high rate actuator commands between, say, a little after 72 seconds up to about 72 1/2 seconds, and those are not all tied together and explained. We think we have come detached at the base, and then -

MR. FEYNMAN: The actuators are the gadgets that turn the elevons, is that correct?

MR. LEE: The actuators are the hydraulic pistons, if you will, that gimbal the engine.

MR. FEYNMAN: Okay.

[501] MR. LEE: At about 73 seconds we then see a very distinct anomaly in the right hand solid rocket motor chamber pressure, and we are seeing about a 20 psi loss in chamber pressure there at around about 600 psi, and so we are seeing a definite anomaly in the right hand solid rocket motor.

So then the terminal events are a little suspect still. We are using some film data, as you have seen, and some instrumentation, and we put just for reference purposes a time out where we saw the right hand solid rocket booster nose cap separate.

Could I have the next viewgraph, please?

DR. WALKER: Could I ask a question, please? Do you have separate measurements of the ullage in each

of the Shuttle main engines, or is that a single measurement of total feed?

MR. LEE: We have tied to each engine an ullage pressure measurements which allows what we call a flow control valve to divert in this case gaseous hydrogen to go back into the hydrogen tank to pressurize it, if you will, and each of these engines has two flow control valves. In other words, two of these become flow control valves.

DR. WALKER: So all three of them are shown?

MR. LEE: Yes.

(Viewgraph. ) [Ref. 2/13-31]

MR. LEE: The way we proceeded at Marshall for investigation is we start with the end item as we see it and work back to build a fault tree, and our end item was the explosion, and we tied that to a rupture or a breakup of both the liquid hydrogen and liquid oxygen tank. We built a fault tree, and this is just the overall major fault tree. There are probably 200 or 300 different elements. If I spread the whole thing out, it would be 200 or 300 elements that make this up.

Just to identify how we construct this, one area would be, to break up the external tank, would be the external tank and the solid rocket booster attach fittings fail. One would be overload of the tank or

load exceedance, and that could come from a number of things, control, winds, thrust imbalance. The Shuttle main engine structural failure could cause an external tank rupture. Overheating of the external tank could cause it. The external tank flaw, that would be a manufacturing flaw, or some external damage, some flaw in the manufacturing. A premature detonation of the linear shaped charge would give you a rupture of the external tank. A premature ignition of the inertial upper stage that is in the payload bay - -

DR. WALKER: Where is the linear shaped charge?

MR. LEE: That is on the external tank, as well as the solid rocket booster, here and here and comes down to about here on each of these, and then down the inside.

DR. WALKER: That is the destruct?

MR. LEE: Yes.

MR. ACHESON: Which one do you mean in that box?

MR. LEE: I mean all of them. Another would be, say, an explosion or a fire in the payload bay. Another would be damage at lift-off or premature separation of the solid rocket booster.

Now, what we have still all of these open,

there are two that we have close to exonerated, but we are not yet able to we are not allowed to, from the flight data that we have reviewed would be the Shuttle main engine, and we have good [502] evidence that the Shuttle main engine performed just as prescribed. We actually have data after what you see as the explosion, because we are getting our data at - our 60 kilobit data that we got longer than we did the 128 kilobit information, plus the photography that we saw. And so actually, the engine was actually still running at the time of the explosion because the feed line propellant and the fact that we got data longer, we went to the point of actually, because of the overheating or the high temperature indication on one of the turbopumps, which is a red line that would cause you to cut that engine off, and we think we can see that in the data. We actually went through the process of hitting a red line and cutting the engine on after, pretty much after.

So based upon everything we have seen from flight data and photography, we do not see any connection, any connection whatsoever between the Shuttle main engine and this incident.

We believe we can almost exonerate the inertial upper stage also. We do not have flight instrumentation of that during the ascent phase because

we don't need it, I guess, but it is in the bay, and we don't have instrumentation on it. We have enough orbiter instrumentation and enough payload instrumentation to be able to see in detail what is happening to that structure. We are able to look at temperature measurements. So we are reasonably sure the solids didn't fire. Everything we have looked at compares very favorably or exactly almost with the previous flight we had with the IUS, so we believe we can - we know that we can't tie the information we see today to that.

GENERAL KUTYNA: For the record, I would like to say that's the first nice thing NASA has said about the IUS in the last four years.

(Laughter. )

MR. LEE: Now, what we are leaving open with all of this - and there is a lot of it - is what happened, what could have happened with the solid rocket booster and the external tank. So we haven't tried to close out any of the external tank or solid rocket booster items. Where we will be taking off from today and in the next presentation will be the solid rocket motor failure and then some of the things associated with all aspects of the external tank.

For this, I would like to now go into the

presentation that we have been trying to - the group here has been trying to discuss, and I am not criticizing you for that, but we have discussed a lot of items already that we are going to tell you about now. But this is the way we see at least two very probable failure scenarios, how we went about arriving at the scenarios, the processes that we go through for identifying the trails, if you will, how we go about doing the analysis and tests, and we are going to provide to you today what we have completed and the results of what we have completed and the analysis and tests and give you an indication of the type of tests that we presently have planned.

With that I would like to introduce George Hardy who acts as my alternate for the investigating effort at the Marshall Space Flight Center.

MR. CRIPPEN: Jack, while George is getting up, just a little bit further on the IUS.

So we have recovered portions of the IUS, and that includes chunks of solid fuel that show no signs of ignition.

[504] [Ref. 2/13-30] [Marshall Space Flight Center - STS 51-L TIMELINE PRELIMINARY; From: T.J. Lee; Date: February 11, 1986]

[505] [Ref. 2/13-31] FAILURE TREE.

MR. HARDY: Mr. Chairman, members of the Commission, I would like to discuss with you some of the failure analysis work that we are doing under the purview of the task force.

Could I have the first chart, please?

(Viewgraph. ) [Ref. 2/13-32]

MR. HARDY: I will discuss some of the failure scenarios, potential failure mechanisms or causes that set those scenarios, and then work in progress, which work in progress is a continuation of the development of the scenarios, particularly that has to do with the analysis and test work.

Could I have the next viewgraph, please?

(Viewgraph. ) [Ref. 2/13-33]

MR. HARDY: Just as a summary, the approach that we have taken is I think somewhat classical. It is not unique, develop failure scenario assessment matrix with that. That means to establish event one, event two, event three, etc., and with data that is in hand, the observations, film data, telemetry data from 51-L, special analyses that are run as well as tests, and our experience base. This matrix approach, then, takes each one of those events and attempts to either support it or refute it.

Now, in many cases, as I mentioned, that does take a special analysis and test, and in some cases we have run some of those tests and analyses, and in many cases we are still in the process, and I will try to describe that to you as we go through. But successfully completing that first step, one comes to the most probable failure scenario.

I am not prepared today to tell you which that is. I am just describing the process.

The next step, of course, is define failure mechanisms and causes. If you can make the scenario fit, something still has to cause that, and there we look at again the 51-L hardware pedigree, anything in the manufacturing of the hardware, the handling of the hardware, any design changes that might have been made. We look at our experience base, if there are any clues there, the actual design itself, all the way back to the initial qualification of that design, and then experience base, by the way, that would look at previous loads that we have exposed to various elements, compare that with our design qualification load base.

We look at launch processing, launch flight, and again, in most cases have to generate special analysis or special tests to either verify or refute a particular cause. And then, of course, if one has done

that successfully, you get to the most probable failure mechanism.

Now, I am going to talk to you about this and some of the work that is going on right here.

Could I have the next viewgraph, please?

(Viewgraph. ) [Ref. 2/13-34]

MR. HARDY: Before I get into the details of the failure scenarios, with respect to the propulsion elements of the booster, we have identified three failure scenarios, defined as first event.

The first one is an external tank hydrogen leak. The second one is a solid rocket booster joint leak, and an unanticipated vehicle loads and dynamics.

[507] There has been a lot of discussion here today about lift-off loads, the effect of lift-off loads on the attached structure, the effect of loads at Max Q, and I can assure you that we are vitally interested in that. And at this point in time, since much of that has to be reconstructed, I have not developed a detailed scenario that uses these vehicle loads and dynamics as the first event or the first offender. But we plan to do that as that data becomes available.

Now, I would also hasten to say that one can get into permutations and combinations of these failure scenarios. We are quite aware of the fact that there

comes a point in time, about 60 seconds in flight, where indeed the aft joint of the solid rocket motor is leaking. I think that is undeniable. The question is is that the cause or the effect.

Could I have the next viewgraph, please?

(Viewgraph. ) [Ref. 2/13-35]

CHAIRMAN ROGERS: Does D include on that chart the third one, the unanticipated vehicle loads, does that include the launch problems, or is that a separate category?

MR. HARDY: No, sir, that would include, even include prelaunch activities.

CHAIRMAN ROGERS: I see.

MR. HARDY: If there was some procedural error in making the attached struts or temperature conditions, the temperature around this motor case, as I will show you later, is about a 22 degree profile from the inside to the outside, and so it would include temperature conditions. It would include the effect of ice on the launch pad, if that had any significance.

CHAIRMAN ROGERS: I see. That clarifies it, thank you.

MR. HARDY: And just one other thing I would mention, too, that goes significantly into the dynamics at lift-off. We have heard mention about the bending

over of the booster, but it is also cantilever dynamics of the lift-off, with the simultaneity of release of the booster from the launch pad. I don't know if that has been explained to you or not, but on each booster there are what we call four hold-down posts, a total of eight, and those are released about a three and a half inch explosive bolt, or rather it has an explosive nut on it, but it has a three and a half inch bolt with an explosive nut on each one, and they are released simultaneously, they are fired simultaneous with the ignition of the solid rocket motors, and so we will be looking at the timing, for instance, of the release mechanisms themselves, anything that can put unanticipated, unexpected dynamics into the vehicle.

But as I mentioned, the detailed development of this scenario has to follow the generation of that data, and it has to be reconstructed. So I am going to be talking in more detail about these two. But we certainly will be working this one. And again, this scenario can interplay with either one of those.

What I would like first to do is to discuss just the overall scenario, the events associated with Scenario A, which is external tank leak, and then I am going to take each one of these events and tell you what we have in 51-L observed data, or what we have in

analysis to date, what we have in test to date, that either supports or refutes any of these steps, and I will also tell you what we have yet to do.

In the process, if you fail to refute any of these blocks, then that chain has to stay open. At any point in time you can deny one of these things happening and then you block that scenario right there, and that part of the scenario is ended. If, of course, you block it back here, then the entire scenario is ended, but this scenario has again, let me emphasize, and I am talking events [508] that occur at this point, not necessarily causes, not necessarily why they happened, but it has an external tank leaking at or near lift-off.

Let me go now if I could to the next block, and so I can talk in more detail on each one, could I have the next viewgraph, please?

(Viewgraph. ) [Ref. 2/13-36]

MR. HARDY: I am going to address now the external tank hydrogen leaks and this hydrogen burns. When this hydrogen burns, it overheats the aft joint on the solid rocket motor, and the O-ring seals become heated to the point that they can no longer hold the pressure. They fail.

And then we go to the next step which is impingement on the aft struts and the external tank and that starts a major event.

Now, I am not carrying on beyond the major event. I am just trying to get to that point, and I will go through each one in detail, but I thought it would be better just to talk about them one at a time first. An alternative to the hydrogen leaking and burning is if the hydrogen leaks, it doesn't burn but it cools the joint to the point that the O-rings get so cold that the structural integrity of the O-rings is affected, and they break loose, they can't hold the pressure anymore, at which time the joint starts leaking, and I get on to this next step.

MR. RUMMEL: Excuse me. Why wouldn't it burn?

MR. HARDY: Well, I think some of it will burn, but it may not all be consumed?

MR. RUMMEL: In other words, it might burn but not impinge?

MR. HARDY: That is correct, or the flame front may be - the flame propagation may not be through all the hydrogen. It may be concentrated to the point that there's not enough oxygen there for it to burn.

DR. WALKER: Could we just return to these infrared images from which temperatures are derived, and the possibly anomalously low temperature on the right hand solid motor? Are you going to talk about that?

MR. HARDY: I will touch on that, yes.

Just again, let me just show you the general timeframe I am talking about these events happening. I am not really trying to tie them all down, but this first, as I say, it happens at or near lift-off. This is occurring from lift-off to about 58 seconds. This occurs at around 58.3 seconds, and that is an observation from the film. And then this also is an observation from the film.

Okay, looking at Event A-1 there, it overheats the right hand half of the field joint. The observation is that we have this anomalous smoke, we have at or near lift-off, and this could be -I am not saying it is, but it could be external tank TPS burning. So at this time - -

DR. COVERT: That TPS is the insulation?

MR. HARDY: Yes. At this point in time that observation would not deny this scenario. I am not saying that is what happened, but it wouldn't allow us to block this scenario.

So the analysis, some of the analysis we have done Dr. Lucas already mentioned. We asked ourselves, well, how much hydrogen could I be leaking and not detect it in the flight instrumentation of the tank, and the analysis says we could be leaking 4 pounds per

second out of a hole of eight-tenths an inch, and it would not be detected with instrumentation.

The next step was to, can I structurally survive an eight-tenth inch hole, and the answer to that was yes, it was considerably greater in the area of interest than eight-tenths inch. So I can [509] leak hydrogen and not detect it with instrumentation. I can have a hole of the size that would be undetectable in instrumentation, and it is structurally sound, the vehicle still is structurally sound, the tank is.

Now one of the thing that we are trying to do - and I am not an expert in this area, but is through film enhancement, to attempt to see if there is evidence of hydrogen, either free hydrogen or burning hydrogen in the area of interest any time from lift-off through the major event.

DR. COVERT: George, what kind of pressure difference would there be between the hydrogen tank and the outside from the insulation?

MR. HARDY: I don't know the answer to that.

DR. COVERT: Have you guys done any experiments with that pressure difference, that the hydrogen would work its way through the insulation?

MR. HARDY: I don't have the answer to that. I feel confident it would because the head of hydrogen

you have got there, I think that is right.

Now, at this point in time we can't block this scenario because we have found nothing in tests or analysis to date that says that at this point in time that that can't happen. So we go to the next step, and we say, well, okay, so what if it is happening, can you overheat the joint?

Could I have the next viewgraph, please?

(Viewgraph. ) [Ref. 2/13-37]

MR. HARDY: This is event A-3, assuming that everything in front of it can happen and maybe did happen, and this addresses the fact or makes the statement in the scenario that the joint is overheated to the point that the O-rings fail.

Well, certainly the observation of the fact that we have a blowing leak at the right hand field joint in the timeframe of interest here that of course would not deny it. The fact that we have chamber pressure diverging would not deny that. And the fact that we have some excursion in the control system would not deny it.

The analysis that we have under way - and we have some preliminary results from these analyses, but we are refining them at this time - the question is can you get a heating rate to get the temperature of that

joint high enough in the 58 seconds that you have available, that is, from near lift-off to the time you see the joint leaking, can you have a heating rate high enough to overheat the O-rings to the point that they would fail? We have not concluded that analysis. A preliminary assessment of that indicated that we would heat that joint to - can you give me the number on that, Rick?

MR. REINARTZ: About 450 degrees.

DR. WALKER: Fahrenheit?

MR. HARDY: We would heat that joint to about 450 degrees fahrenheit. Now, that is assuming a perfect mixture of hydrogen with the oxygen available, that is burning, and that heat is flowing over to this joint and is being added to the aerodynamic heating that is already there.

Our preliminary assessment is that the O-rings, heated externally, would have to be heated to somewhere in the neighborhood of 500 to 600 degrees before they lost structural integrity.

Now, we haven't made a fit of that element of the scenario yet, but it is close enough that we have to continue to analyze it.

MR. RUMMEL: Can I ask over what period of time would they have to be heated to that temperature?

MR. HARDY: The analysis is taking it from

essentially lift-off or very nearly lift-off, that burning hydrogen is - the heat from the burning hydrogen is coming into that joint, to 58 seconds where we know the joint leaks. We know that without question.

There is work to be done, both in the analysis area, and we are in fact going to set up a test to pressurize a joint with O-rings and heat it from the outside and see what temperature we have to get those O-rings up to so that they would fail. So at this point in time this event is not blocked. So that scenario is still open.

DR. COVERT: When you make this experiment, obviously it is going to be on a small scale, so you are going to maintain the gap size and the compression ratio in the O-ring and those geometric factors, which means it is going to be at least big enough around so the other curvature is important, is that correct?

MR. HARDY: Yes, and we are considering putting transverse loads on it, too, the kind of loads you would have at a Max Q.

GENERAL KUTYNA: How do you simulate the air flow varying anywhere from zero to Mach 2?

MR. HARDY: Well, what we plan to do is, as best we can, is to calculate the heat rate and then we

are just going to apply that heat rate directly to the joint.

DR. COVERT: And there will be no insulation on the inside and no putty or anything like that, it would just be a clean metal gap on the inside?

MR. HARDY: Well, we will make the inside of the joint without propellant, but otherwise we will make it very similar to the flight vehicle.

MR. WAITE: Wouldn't the cooling effect of the propellant change the results?

MR. HARDY: No, I don't think so.

DR. COVERT: I would be more concerned about the chemical activity of the combustion products.

DR. WALKER: Ordinarily you bake O-rings at 250 C, so they ought to be able to take this temperature.

MR. HARDY: That is true. We estimate now that they would hold structural integrity to 600, maybe less than that.

MR. SUTTER: In a test like that you will probably run a variation of seals and variations on that to find out how much slack you've got?

MR. HARDY: Yes, we would plan to do that. We will not run a test like this, one sample test set up one way and say that's the results.

MR. FEYNMAN: How about if you take a clamp and you tighten it up in a glass of ice water?

(Laughter. )

DR. COVERT: The other thing, George, you might consider is seals that have been eroded.

MR. HARDY: Let me say that in these scenarios - well, let me wait until I get to that point.

DR. COVERT: I'm sorry, I didn't mean to get ahead of you.

MR. HARDY: Could I have the next viewgraph, please?

(Viewgraph. ) [Ref. 2/13-38]

[511] MR. HARDY: Now we come down to the bottom leg of this scenario, the hydrogen is still leaking from the tank, but now we are looking for cooling effect on the joint. Event A-2 says this hydrogen cools the right hand field joint. The problem we've got with that is that does not support the observations, that doesn't cause the black smoke. So the anomalous black smoke that you saw early on would have to be assigned to some other cause, but we are proceeding, recognizing the fact that the instrumentation would allow us to have a leak, and recognizing, and not be detectable, and recognizing structural integrity would allow that. We are

proceeding with the analysis to determine how cold we can get the joint. Preliminary analysis of that would indicate that we cannot get the joint in 58 seconds cold enough that it would seriously degrade the structural integrity of the O-rings.

So we have a temporary block on this leg of this scenario, and we haven't quit work on it, but it is not a prime candidate.

Could I have the next viewgraph?

(Viewgraph. ) [Ref. 2/13-39]

MR. HARDY: I think I have already covered this. Although we think we have blocked that leg of the scenario, we are still going to do the cooling rate analysis to see how cold it could get in 58 seconds.

Could I have the next viewgraph, please?

(Viewgraph. ) [Ref. 2/13-40]

MR. HARDY: Now, failing to block either one or both legs of this scenario, we come to the point that approximately at about 58 seconds there is clearly hot gas leakage around this aft field joint, and that is observed both from the film data. It is also evidenced in the tank pressurization instrumentation, and it is also evidenced by the fact that that tank is calling for more pressure to keep that pressure up. And so I think there is no disagreement on any of these scenarios that

we are working that eventually we get to the point where the SRM joint is leaking.

DR. WALKER: There is another sort of combined scenario in which the leak could be there before ignition and it could have cooled the O-ring and then at ignition the leak, the hydrogen leak, ignites, but now the O-ring is pretty cool, and so it may be more likely to get damaged or eroded, meaning that you have also got in addition to burning hydrogen, you have also got a weak O-ring. So you could actually combine those two scenarios in some sense.

MR. HARDY: Yes. That is one of the main reasons we haven't closed that scenario out. And you notice this scenario was built to start with the hydrogen leak at lift-off, but we need to back that up and see what happened before that.

MR. WAITE: Your hydrogen detectors don't or wouldn't be sufficient to detect this sort of a leak?

MR. HARDY: I believe Horace said the hydrogen detectors are at specific locations, disconnects in other areas where we might have some suspect for leaks, but general acreage of the tank, a survey is not covered for hydrogen leaks.

DR. WALKER: So these are near valves?

MR. HARDY: Near valves and disconnects and

things of that sort.

[512] Okay. I would like to go now to the next scenario which addresses the first offender being the SRM joint.

Could I have the next viewgraph, please?

(Viewgraph. ) [Ref. 2/13-41]

MR. HARDY: This scenario says - and I'm going to talk to each one of these in some detail, too - that I have primary O-ring blow-by. That is, I have gas past the primary O-ring. The secondary O-ring does not seal, which means now I've got gas to the outside or the secondary O-ring does seal and I have leaked past the leak check port. In either case - and I will discuss this in detail - in either case, the scenario says that the joint is either - has either leaked and stopped or it has continued to leak for this period of time from lift-off to this time here, and then we see a major hot gas leak out of that joint which goes on to the same point that the other scenario was going to take all the scenarios and with this, all the scenarios have that in it because that is well established in observation.

Could I have the next viewgraph, please?

(Viewgraph. ) [Ref. 2/13-42]

MR. HARDY: Now, let me say at this point, and

Dr. Lucas has already mentioned this, and I will elaborate on it a little bit more, but we have great difficulty analytically starting a leak or having a leak past both O-rings at or near ignition, and have that leak remain relatively well behaved, and I say that because I don't know just exactly how well behaved it stays, but to have it relatively well behaved in terms of the expansion of that leak and the leak area through that joint up to 58 seconds. But I am going to talk about that a little bit more.

But as has been mentioned here, we are looking at scenarios that - it leaks, then it seals, then it leaks again. That is not easy to come by either. This material, the O-ring material, subjected to the gas temperatures for any period of time, seconds, doesn't tolerate that very well.

DR. COVERT: You are going to talk, I assume, about combinations of these so you might have one of these that seals and then later the high load and vibration?

MR. HARDY: Yes.

DR. COVERT: Okay. Press on.

MR. HARDY: Well, let me just say now, in the scenario of the leak-seal-leak -

DR. COVERT: Let's stick with this one. I

didn't mean to get you off. I just wanted to know if you were going to that.

MR. HARDY: But if I don't cover that, remind me.

Looking at event B-1, which says primary O-ring blow-by, now we have that in our experience base. Our experience shows that the joint seal design can result in what we refer to as blow-by, which is during a transient build-up of pressure. While that primary O-ring is pressure actuated - could I have the next viewgraph on the right hand screen?

(Viewgraph. ) [Ref. 2/13-43]

MR. HARDY: I think you have probably seen this a few times, but the primary O-ring is located here, and the secondary O-ring is located here. The leak test port is located in such a way that we pressurize the annulus, or the volume in between here, and you have heard the description as to how that is done, I believe. It is pressurized up to 200 psi, and it is held for ten minutes, is that right - no, 15, and then that is for two reasons. One is to seat the O-rings or put the O-rings in a position where they can seal, and the other is to ensure that we don't mask a leak in the primary O-ring by the putty holding the pressure.

DR. COVERT: George, in Larry Mulloy's slides where that zinc chromate putty comes down and seats against the tang, his were always very carefully had a gap there, which is the real configuration.

MR. HARDY: This is not correct. That putty is terminated about halfway back up here.

DR. COVERT: Thank you.

MR. HARDY: I might say this dimension is exaggerated, too. That gap probably shows there about twice as wide as it is configured.

MR. RUMMEL: May I ask when these units are assembled, I guess they are assembled vertically and one unit goes down on top of the other and that tang goes in the clevis. Do they always go in and go home the first time, or is it necessary to pull them out or twist them or somehow displace that putty?

Do you know, in the process of assembly?

MR. HARDY: I believe that Mr. Lamberth is planning to discuss that in quite some detail, is that correct, Norm?

MR. LAMBERTH: That is correct, George. Our briefing will go into that, but to answer your question, no, we do make the measurements that ensures ourselves that we have the proper turns before we mate the joint, and we have never had to come back out unless we had a

leak or something like that where we had to change the O-ring.

DR. COVERT: Let me ask again, is that gap really that big between the propellant in one segment and the propellant in the next?

MR. HARDY: That is generally representative, is several inches. I can get that number.

DR. COVERT: I don't need the number. It just sort of looks like a big crack in a way.

MR. HARDY: I think you could probably put your hand in there.

MR. SUTTER: That sketch is correct in that the test port and O-rings are tied together so that you could have a combination failure of O-rings and test ports all being involved in the failure?

MR. HARDY: Yes. In fact, that is one of the scenarios I will talk about. But what I wanted to make here, talking about the incident of the blow-by, I guess what I'm trying to say is that we have experience, event No. 1, we have experienced it several times. So I don't have to prove that can happen because in fact it has happened. I was just explaining the primary reason for it to happen is when we do pressure check here, this graph doesn't show it too well, and I've got one later that shows it a lot better, but this O-ring, the primary

O-ring can move back and does move back against this edge of the groove, and the gap between the other side of the O-ring and this other side of the groove, of course, depends upon several things, not the least of which is the diameter of the O-ring. But it also can be because of the allowable dimension on this groove here, it can be anywhere from 15 to 30 mills.

So when the motor is pressurized and the pressure first hits this O-ring, this is what we refer to as pressure actuating. It has to move back to the side.

Now, I am going to go into more detail about that with some better diagrams in just a few minutes, but I only wanted to point out that we believe that that is where we occasion what we call blow-by. But we do know from experience that you can establish for a transient period of time some blow-by of the primary O-ring. In every case it has been limited. It has been limited [514] by the sealing, first of all, by the fact that the secondary O-ring is sealed, the leak port has sealed, so there has been no way for the gas to continue flowing.

Could I have the next viewgraph, please?

DR. WALKER: Before you do, I just want to ask a couple of questions on that.

How many threads are engaged in that plug, in the leak check port?

MR. HARDY: I will have to get the answer to that.

DR. WALKER: I don't see the steel band. It is not shown.

MR. HARDY: The steel band is right here underneath the cork. What is represented here is a shim, and I will talk about that a little bit later.

DR. COVERT: George, Larry Mulloy again said there were two O-rings on that leak check port, and your diagram only shows one.

MR. HARDY: There are two O-rings on that, and I will get this diagram corrected before I show it again.

DR. COVERT: I don't mean to be a nitpicker but as you know, I get confused easily.

MR. HARDY: I think that is a good point. We should represent truly what it looks like.

Could I go to the next viewgraph, please?

(Viewgraph. ) [Ref. 2/13-44]

VICE CHAIRMAN ARMSTRONG: That is threaded, too, isn't it?

MR. HARDY: Yes, it is.

Now, this is the incident of blow-by that we

have seen on the primary O-ring, and I think most of you heard a good bit about this in Washington. But I just wanted to show that we have had four instances of blow-by, and I distinguish blow-by from O-ring erosion because those can occur together, they don't have to occur together, and in fact, there is a slightly different mechanism that causes each one of them to happen.

There does, for just a matter of interest, seem to be focused around this leak check port area here. Now, we have at this point in time assigned - haven't assigned any great significance to that. It may well have to do that this is where the gas enters to do the leak check, and there may be some more disturbance of that primary O-ring pushing it back in that area versus in the other area.

GENERAL KUTYNA: That's a contradiction of what we heard in Washington because we asked Mr. Mulloy at least twice, was there any area in which this was localized, and he said no, it was pretty well distributed, and you are now saying that it is at that bottom of the Z axis.

MR. HARDY: Well, Larry may have been referring to the fact that it is not total. We do have one over here, but I will check my facts on this, but

I'm pretty sure I'm correct.

DR. WALKER: Maybe he was talking about the erosion rather than the blow-by.

MR. HARDY: Now, that is true on the erosion. In fact, the open circles is where we've had erosion, and the half-opened, half-closed is erosion and blow-by. So on erosion you can see that there doesn't seem to be any pattern where you've got erosion on the O-rings.

GENERAL KUTYNA: And yet he did say that given the choice between the two, the blowby was the more serious.

MR. HARDY: Yes, and I agree with that because the blow-by can in fact get us through the first event in this failure scenario.

[515] Could I go to the next viewgraph, please?

MR. FEYNMAN: I hope it's not improper to bring up something slightly different. The question is whether there is a correlation between the blow-by and the accuracy with which the gaps and so forth were fitting, the mechanical fit of the particular joints when they were put together. There must be, of course, all kinds of records, and you must have heard that a million times, does it turn out the blow-by occurred when the gaps - -

MR. HARDY: There's a number of things that we are attempting to correlate blow-by with, environmental conditions, specific configuration of that joint, material vendors, whether there were more than one material vendor, was there one material that performed a little bit better than the other, and as you correctly state, the dimensions, specific dimension of each joint, and we are correlating all of that, and we see some correlation in certain areas.

I am really not prepared to talk about it right now because I can't remember all of the details.

(Viewgraph. ) [Ref. 2/13-45]

MR. HARDY: The second event I would like to go to first is to take this trail down here and look at event B-2. This says if I get blow-by of the primary O-ring and this leak check port is leaking, the first question we ask ourselves, could this anomalous smoke starting at or near liftoff, could that be from the leak check port, and I guess there is some difference of opinion among the film analysts at this time, and I am not going to try to pick sides, but I am going to work to find out which one is right, that there is film that says that we can see the leak check port, you heard that discussion earlier, whether we really know whether we are looking at the right place, that say you can see the

leak check port, and the leak check port is not leaking. At this point in time we have not put a block on that. It may get blocked if in fact we can verify from observed data that that port is not leaking.

DR. COVERT: George, what is the diameter of that leak check port?

MR. HARDY: Three-eighths is the number I remember.

DR. LUCAS: But it's a one-eighth inch hole.

MR. HARDY: Yes. You saw from the drawing that the hole that went directly into the cavity is one-eighth inch. But as long as we can block this - as long as we can't block this, then we look at the analysis to see what are the thermal flow characteristics of this leak check port. If the leak check port is leaking, it could be several things, theoretically, that could cause it. One would be missing O-rings. The other would be not missing O-rings but damaged O-rings. The other potential could be lack of proper torque.

Now we set up a series of tests. That is shown right here.

DR. WALKER: Do you know that the plug was there?

DR. COVERT: I think if the plug wasn't there,

when we looked at that white paint, although three-eights is pretty small compared to that - -

DR. WALKER: Do you have some photographic evidence?

DR. COVERT: We looked at it. Didn't we look at the closeout pictures of the ring?

MR. HARDY: I don't know if we have close-out pictures on the photos or not.

[516] MR. LAMBERTH: Yes, George, there are - a close-out photo is not required, but in the area you can see the hole there, and you can argue about the plug being there or not. It looks like it is there, and all of our paper and everything shows normal, buy-off and everything normal.

DR. COVERT: On that Eastern airliner that lost those O-rings in the oil, they had all the right paperwork, too.

MR. LAMBERTH: George, just to kind of correct the record, the drawings and everything, in our architecture there is one O-ring on the leak check plug.

MR. ACHESON: In real life there is one?

MR. LAMBERTH: Yes, and this is a plug and an O-ring.

MR. HARDY: So this chart is correct. I had

heard that two different ways.

But in any case, what we want to do is characterize the leak. What would be the leak rate for various conditions of anomalies of that plug? And that is important in order to determine - to do the flow analysis and the thermal analysis. And we have done the thermal analysis and determined that for any leak rate we just about we want to pick out of that plug, whether we want to consider the plug is gone, the O-ring is gone, or neither are gone, but there is a very low leak rate out of that plug, we have determined that the secondary O-ring will degrade and erode to the point of failure before the threads are heated to lose structural integrity and blow the plug out.

So as I said, very key in this scenario is coming to some grips with whether or not that might be the source of the black smoke because this scenario would fit the incident of a small leak early on, and then the joint failing at 58 seconds.

MR. FEYNMAN: This way the idea is that it starts to leak through the leak check port, through the primary, and that perpetual gas going through there ultimately destroys the secondary O-ring?

MR. HARDY: That is correct. The thermal damage and strength loss in the threads would not be

sufficient for it to go 58 seconds, but the secondary O-ring erosion would.

Now, in characterizing this leak, we are going to do cold flow and hot flow tests because I believe, as Dr. Lucas also mentioned, we believe that it would be possible to get let me say, a relatively high leak rate out initially, but as the aluminum oxide and other products of combustion flow through those threads, it would tend to slow that leak rate down.

So we are using a variable leak rate in these analyses. But in every case we see a secondary O-ring failure before we see the leak check port.

GENERAL KUTYNA: Why is that secondary O-ring eroding? There is no flow; there is stagnation at that point.

MR. HARDY: Well, if I am flowing through here and I am flowing out here, I am pumping heat into this gap.

MR. FEYNMAN: It is circumferential.

MR. SUTTER: The first ring is getting cooked fast, but the second one could last a lot longer because there isn't flow by it.

MR. HARDY: Well, there is flow into this cavity.

MR. SUTTER: But if it is sealed, it isn't

flowing- -

MR. HARDY: But if I am pumping 5,000 degree gas in here, in order to get out right here, I am severely degrading that O-ring.

MR. SUTTER: But I am just curious, is that plug, what I see here is just a plug screwed in and some guy torques it, and there's no locking device on it?

MR. HARDY: You are correct, to my knowledge, that is correct.

MR. SUTTER: Are there other nuts and bolts like that, too? It doesn't seem like a standard design practice. I am just curious.

MR. HARDY: Well, it is a standard design process for a lot of electrical connectors and many of the structural fasteners.

DR. WALKER: Did you say it is locked tight?

MR. HARDY: It is standard practice to lock wire or lock tight electrical connectors.

DR. COVERT: This is aluminum tightened into a steel. Is there some sort of a frictional seizing, like if you put brass into steel and tighten it down, why, then there would be a sticking there.

MR. HARDY: This plug is steel.

DR. COVERT: Where did I get the idea it was aluminum?

MR. HARDY: I'm not sure.

(Laughter.)

MR. SUTTER: The only safety of that system, then, is quality control?

MR. HARDY: That is correct.

MR. SUTTER: And it is a single item.

MR. FEYNMAN: Well, it is supposed by itself not to be a problem because the primary ring is supposed to hold. That is why it isn't at the same level as we are now thinking about it, and we now are thinking about primary rings failing, and that hasn't been communicated that the check valve therefore becomes a critical item.

MR. WAITE: Would you say if the plug were left out that you would have O-ring failure? MR. HARDY: No, I would not say that. I would not like to have the plug left out because, as I experienced for occasions of blow-by, if it was in one of these cases, then I think I would be in for trouble.

MR. WAITE: Then you would have flow that would cause the secondary seal to degrade? MR. HARDY: That's right.

MR. ACHESON: In cases of blow-by past the primary ring, what is your experience on the condition of the plug and the check port?

MR. HARDY: In every case that we have seen

blow-by, we have post-recovery, in examination of the article, has shown that that blow-by is limited to soot deposit back here, and on no occasion have we seen any violation of the secondary O-ring or any violation of the leak check port here.

MR. ACHESON: I see.

MR. HARDY: If I might go on to the next one and mention that this track stays open for the time being, and now I would like to look at the B-1 event.

Could I have the next viewgraph, please?

(Viewgraph. ) [Ref. 2/13-46]

MR. HARDY: Now, the B-1 event follows the blow-by on the primary O-ring, and it says that - and these are for the secondary O-ring seals, and therefore I establish flow past both O-rings, the anomalous smoke starting at or near lift-off could be from that field joint, and it could be from gas passing through both O-rings. And I think it has already been mentioned the grease in this joint. From that grease we would see black smoke. We have identified in the investigation a suspect secondary O-ring which is indicated in the close-out photos, and let me hasten to mention before we show you this that we are still collectively trying to interpret these photos. It is not immediately obvious what we are

[518] seeing, and that is the reason I classified it as a suspect close-out photo. I have some viewgraphs, and Bob looks like he has got a big blow-up, and so let's put the viewgraphs on, please.

The next viewgraph.

(Viewgraph. ) [Ref. 2/13-48]

MR. HARDY: No, I'm sorry. They are out of order.

Do you have the picture viewgraphs?

Take down the viewgraph on the right hand screen.

Jack, could you help me back there get the picture up?

(Viewgraph. ) [Ref. 2/13-47]

MR. HARDY: You can probably see better on what you have there, but what you are looking at, maybe I can locate you the features and then you can look at the blow-by that you have.

What you are looking at is a clevis. This clevis has been prepared, this is the upper side of it, and this is the inner leg that you are looking at. The primary O-ring is here. This is a land in between the primary and secondary. This is metal, and this is the secondary O-ring right here. And these are close-out photos that are taken as a part of the process.

I might mention to you this joint. The metal, before the O-rings are put on, the metal is greased. We put a heavy coating of Conoco grease, which is a stiff grease that is put on this joint, and it is put on there for two reasons. One is, the primary reason is to provide corrosion protection for that joint, and the other is to provide ease in assembly of the installation of the O-rings. The O-rings are delivered prelubricated from Thiokol to Kennedy, certified ready to install, and the secondary O-ring is put on, and I am not going to go into great detail about this because you are going to hear a lot about it and maybe even see it tomorrow, but the secondary O-ring is put on around the vehicle, over this joint, and then the primary O-ring is put on.

And what we view, the area right here in the secondary O-ring, that gives some appearance of depression and raised area, and it also gives some appearance, and you can probably see it a lot better in what you've got, of the reduction in cross-sectional area of the O-ring.

Now, if I could have the next viewgraph.

(Viewgraph. ) [Ref. 2/13-48]

MR. HARDY: We have a picture of one here that has been somewhat enhanced, and again, not too clear up here is the primary O-ring, and this is the land between

the two grooves, and this is the secondary O-ring, and this is the area of interest, and here is the area which concerns me, indicating some reduction in cross-sectional area.

DR. WALKER: It looks like a gouge almost.

MR. HARDY: Possibly.

[519] MR. FEYNMAN: What is that slightly white area? Do you mean that slightly white or black area in there?

MR. HARDY: In here.

Let me explain what we do know. What we do know is that there is, as I mentioned, this joint is greased rather heavily, and we are quite confident that this is grease that is smeared across here either at the time of application or installation of the O-ring. Again, without getting into too much of what you are going to hear tomorrow, after the O-ring is put in place, the operators with surgical gloves, with greased fingertips, do by procedure go around and push this O-ring into the groove, make sure it is fitting in the groove before they mate the joint.

So there is a question as to whether this represents grease smears also or whether it is some form of a distressed O-ring, and I use that term because I would not describe it as a twist; I would not describe

it as, at this point in time, as a deformation. I will only say that without being able to totally interpret it at this time, it is a piece of data we are working with. We have some photo enhancement activities going on with expertise that we believe can give us more insight into whether or not that is grease smeared across the O-ring or whether that is in fact some form of defect in the O-ring.

GENERAL KUTYNA: Is this the flight motor or is this just a sample?

MR. HARDY: This is the flight motor.

GENERAL KUTYNA: Is this the flight joint?

MR. HARDY: This is the flight joint.

DR. WALKER: That particular one down there?

MR. HARDY: It is in the correct hemisphere. It is on the inside, and it is not in the same quadrant as the point where we see the blowing leak. All I can say at this time, it is in the right half of the motor. It is in the half of the motor adjacent to the external tank.

CHAIRMAN ROGERS: Can you tell us how this picture was taken? I assume - when? When was it taken?

MR. HARDY: It was taken as a matter of procedure when this joint was being made.

CHAIRMAN ROGERS: What is the purpose of the picture?

MR. HARDY: It is what we refer to as closeout photos, and there are a number of operations here at Kennedy that require that closeout photographs be made. These closeout photographs can be used for many purposes. In some cases they can be used as a quality assurance validation, and in some cases they can be used in anomaly investigations.

CHAIRMAN ROGERS: What about this case?

MR. HARDY: In this particular case, Horace, I will let you explain it.

MR. LAMBERTH: These were closeout photos sir. We had photos that covered the entire 360 degrees of the putty lay-up and so on.

CHAIRMAN ROGERS: Somebody looked at this ahead of time but didn't notice it?

MR. LAMBERTH: That's right.

DR. COVERT: The inspector did not call attention to this change in the gap?

MR. LAMBERTH: No, Sir.

DR. COVERT: Well, how much could you see on that without having to call it? What is the spec on that?

MR. LAMBERTH: We did not have a spec.

MR. RUMMEL: There appears to my eyes to be a ridge, a small ridge around the secondary O-ring. Is that - -

MR. HARDY: We believe that is the grease that it picked up when it was rolled over the edge of the groove. That is our best guess.

MR. LAMBERTH: George, all of the engineers and all of the techs and the QC and advisors looked at this photo still feel that this is a result of the grease streaks and shadows, but nothing was written on any notes or anything when we actually made the close-out photos and made the joint.

CHAIRMAN ROGERS: Do we know who it was that signed off on this?

MR. LAMBERTH: Yes, sir.

CHAIRMAN ROGERS: Is that person - does he say he didn't notice this?

MR. LAMBERTH: We haven't interviewed that particular person formally yet. On all of the notes, they make notes of anything that they notice or anything, and none of the notes - all of the notes have been reviewed, and no notes specify anything.

CHAIRMAN ROGERS: Is there more than one person who does this?

MR. LAMBERTH: Yes, sir.

CHAIRMAN ROGERS: In other words, is there

somebody who looks at this and signs off on this, and then somebody checks him?

MR. LAMBERTH: It is about four or five techs that put the O-ring in, and then they go around with gloves like George said, and QC goes around and makes a circle and looks.

CHAIRMAN ROGERS: But I am talking about the picture afterwards. You take the picture, and the picture is taken in order to see if - -

MR. LAMBERTH: The picture is not part of the logoff records. Sometimes the picture does not get looked at.

CHAIRMAN ROGERS: Why is that?

MR. LAMBERTH: Well, there is a requirement to make these photos and document that they have been made and log them. The buy-off is the actual visual inspection at real time. The photos are for records.

MR. FEYNMAN: You talk about the streaks on the metal. For the moment I am not concerned with that on the O-ring, but the streaks like that - are streaks like that on the metal very common?

MR. LAMBERTH: Yes, sir.

MR. HARDY: The grease streaks would be, yes, sir.

MR. FEYNMAN: They look more or less like

that.

MR. HARDY: Yes, I believe that is the case.

MR. FEYNMAN: Thank you.

DR. WALKER: Could I raise a question?

Shouldn't you expand your scenario backward, because suppose there's a low point in the putty and the putty doesn't seal properly? That could be a problem as well.

MR. HARDY: We do have the putty in the failure scenario. One particular aspect is the putty is cold, and how does cold putty affect the performance of the seal?

[521] DR. WALKER: But suppose there is a low point in the putty here which leaves a gap? Is there some inspection of the putty? Does somebody measure the uniformity of the putty?

MR. HARDY: Yes, it is, and I need to point out to you, I don't know the exact dimensions, but as you see that putty there, it is up I'm going to say three-fourths of an inch or so, or in the neighborhood of three-fourths of an inch, and that is compressed into I would say a third or less of that dimension.

DR. WALKER: But there could be a gap in there.

MR. HARDY: We do believe, however, that the primary O-ring erosion occurs when we have what we refer to as a blow hole through the putty. So we can concentrate hot gas on the primary O-ring. So weak places in the putty, weak relative to other places in the putty where the gas would go through first could be a contributor to primary O-ring erosion, the primary O-ring erosion that you heard about yesterday or the day before, I have forgotten which now, in Washington, which we believe is a limiting failure mode.

CHAIRMAN ROGERS: I would like to go ahead with this.

When was the picture taken prior to launch?

MR. LAMBERTH: We stacked in December the 7th, so it was right about that timeframe.

GENERAL KUTYNA: On the back of the picture it says 12/7/85.

CHAIRMAN ROGERS: Now, you said sometimes these were looked at for safety purposes and sometimes they weren't.

How do you make that decision?

MR. LAMBERTH: Well, usually these are placed on record, and many times they are looked at by a group of people just looking at closeout photos, and review might occur a week or several week afterwards. The procedure does not require a review and a verification

of the closeout photos. It requires a verification from the staff that the closeout photos are taken.

CHAIRMAN ROGERS: Was that practice changed? Did you used to do that? In other words, did you use to take the picture and then look at it before you signed off?

MR. LAMBERTH: No, sir.

CHAIRMAN ROGERS: It has always been that way?

MR. LAMBERTH: Yes, sir.

MR. HARRINGTON: The corresponding requirement for this is for postflight analysis of an anomaly.

MR. LAMBERTH: This is for questions that might come up later in the paper or anomalies.

MR. RUMMEL: A picture is taken at the time of the visual inspection, prior to the accident

MR. LAMBERTH: Yes, sir. We have a requirement that after we put the joint in the configuration that you see it here, from the time we start this joint to the time we mate is 24 hours, so the picture and the work all gets done within that period of time. We actually did this one in about ten hours.

CHAIRMAN ROGERS: Just because you are going to be asked eventually a lot of questions about it, what is the purpose of keeping the picture if you are not

going to look at it before launch?

MR. LAMBERTH: Just like we are doing here now, sir, so that if some question comes up on the paper later that some anomaly or some question - -

[522] MR. HARRINGTON: A record of the condition that gets closed up by the flight configuration that you can look at later to examine it in the case of an anomaly, which we are doing.

CHAIRMAN ROGERS: But it seems illogical if you are going to save it for a record to show the failure.

MR. HARRINGTON: Well, you see, if we didn't know today there were two O-rings in there, and we didn't have a picture, we would have a difficult time ascertaining that somebody did put two in. We would have to take the word of the paperwork trail and the inspector. In this case we have a picture that says they definitely were there.

CHAIRMAN ROGERS: I just don't follow that. Why is it better after the fact to look at it than before the fact?

MR. LAMBERTH: Well, let me clarify that. Real time we have a buyoff by the technician that does the work, by a contractor inspector and a NASA inspector that this job was done properly and all the inspections

were made, that is, by visual and buyoff procedure.

CHAIRMAN ROGERS: Let me press that point just for a moment.

So you have two humans or three humans that look at it.

MR. LAMBERTH: Yes, sir.

CHAIRMAN ROGERS: And then you have a record, which is even better, because it shows it.

Now, if you don't compare the record ahead of time with what the humans have done, and now you have a record that the humans failed because they didn't see this, and assume that's a fact, now, what is the point of having the picture?

I mean, it would seem to me that this may explain the failure after the catastrophe?

MR. FEYNMAN: Might I make a suggestion? Just as a suggestion as to what, it might be a very logical reason for doing this, whatever procedure you use, no matter how many inspections you use with people and whatever, then you have to decide sometime to close it up. It would be very handy to have a record to look at later in case there is some kind of a thing that you didn't know was important because you find some kind of a flaw, let's say blow-by. Later on you want to discover what did you do. You discover that every time

there is a blow-by, there is a little extra grease mark that you hadn't realized was of any importance, and therefore the record would be very useful when looking at the thing later to discover whether something that you are not considering as important, which you are allowing to pass. That is, let us suppose that the usual rule is that when an ordinary human being looks at this picture he doesn't think there's anything wrong with it, which as a matter of fact, I do think there is nothing wrong with it. So it would pass everything, but the real thing is you would like to get a record of what it looks like so that in case later on you discover there is some other condition that too much of this grease or something like that, or a special color grease that you never knew or that you changed or something like that becomes of importance, but you hadn't realized that when you were putting it together.

And I see therefore some logical reason to have such records.

MR. CRIPPEN: Mr. Chairman, I guess that is our standard practice for keeping records, not for inspection, and in fact, I would submit that probably somebody - if somebody had inspected this picture while it was being put together, at a later point, and we had not had a problem, that it would have probably gone

through and been looked at because it is still not obvious to even all of the experts looking at it today that that is really a problem area. It is just something that we - since we know we had a problem in this area, that looks a little bit different and people are out exploring.

DR. COVERT: In fact, Mr. Chairman, the fact that there is no specification calling for more than a minimum acceptable gap or a maximum acceptable gap suggests what Mr. Crippen is saying is so. If there is no spec to measure it against - -

CHAIRMAN ROGERS: Well. I guess I understand. I am not convinced. I think it is going to be difficult to explain if you have - maybe the answer is that you didn't think you could find anything by looking at your pictures, maybe that is a better answer.

MR. RUMMEL: I think there might be some validity to that because the human eye looking at that object in three dimensions I think usually is far more accurate of the perspective.

CHAIRMAN ROGERS: That is a better answer to me. It seems to me the human inspection is better than a visual inspection, a photographic inspection, but I'm not sure people are going to be convinced by that.

VICE CHAIRMAN ARMSTRONG: May I ask, the

yellow, is that the putty or is that the insulation, the yellow material?

than photographs because

MR. LAMBERTH: That is the putty.

CHAIRMAN ROGERS: In this case, do we know who the ones were who looked at it visually and signed off on it?

MR. LAMBERTH: Yes, sir.

CHAIRMAN ROGERS: How many were involved?

MR. LAMBERTH: It is four people who usually handle the O-rings, and then we have a NASA QC and a contractor QC, and the technicians.

DR. COVERT: Could I ask a different question that has to be asked at this point, not directly relevant. In this organization, does QC report directly to the Director independent of the manager?

MR. LAMBERTH: Yes, that is correct.

MR. SMITH: Let me clarify the point. There is a quality organization within the Shuttle Directorate, the Shuttle Operations, under Bob Sieck, that does report to him. I have a center quality organization that is a procedures and holding function. That does not do the detailed inspections. The detailed government inspectors in this case do report to Mr. Sieck.

DR. COVERT: Is there the possibility - and I only raise this as a devil's advocate viewpoint, but is

there a possibility that there may be a mild conflict of interest here because the guy on the one hand who is responsible for quality control and safety of the Space Transportation System reports to you, and you are also the man who is responsible for maintaining schedule and all of these sorts of things? And I don't mean to imply you are putting any pressure on your safety people or anything like that.

DR. SIECK: Well, that is a tough one to answer.

DR. COVERT: I did not mean to say when did you stop beating your wife?

MR. SMITH: Gene, I have gone through that process several times since I have been here. I have asked that question, I have talked with people. I have in my own mind been absolutely [524] convinced that we do not have a conflict of interest, primarily because the first charge is a safe launch and not schedule. And I know at least 300 times I went through and made sure to my personal satisfaction that that was not a conflict because I recognized the apparent conflict.

DR. COVERT: You understand - -

MR SMITH: Absolutely, I understand the question.

DR. COVERT: Thank you, Mr. Chairman, for that.

CHAIRMAN ROGERS: Going back to the picture for a moment, do you have pictures of, a lot of previous pictures of the O-rings from previous launches?

MR. LAMBERTH: Yes, sir.

CHAIRMAN ROGERS: And do you now, looking back at it, find other suspected areas?

MR. LAMBERTH: I am not prepared to answer that, sir. I don't know how many we have looked at. I am not aware of that. I need to check how many we have gone back and looked at.

CHAIRMAN ROGERS: How did you find this one?

MR. LAMBERTH: This was the inspection. We formed a special team to go back and rereview all of the procedures involved in this specific launch and review the closeout photos and all documentation, and it was reviewing these closeout photos where we picked up this.

CHAIRMAN ROGERS: But that was just 51-L that you reviewed?

MR. LAMBERTH: Yes, sir.

CHAIRMAN ROGERS: Thank you.

GENERAL KUTYNA: The team that stacked - this was a restack of this particular segment, is that correct? Didn't you stack it once and take it down and restack it?

MR. HARDY: No. I think that was incorrect

information. There was another segment that was initially designated to be stacked here, and there was a redesignation of segments.

MR. LAMBERTH: George, we are going to cover that in our briefing, and we will go through that specifically, but the answer is no, sir.

MR. HARDY: Let me just say this about the picture. I cannot interpret the picture. I do want you to know, however, that we have engaged and are in the process of engaging what we believe to be the best photographic enhancement and photographic interpretation assistance that is available, and that should be going on, if not in fact today, within the next day or two.

CHAIRMAN ROGERS: Could I just make this one comment?

I appreciate, as Chairman of the Commission, that you showed us this photograph and enhanced it and made it available to us. I mean, it is the kind of cooperation that I think is very important, and you are to be commended for it.

MR. HARDY: Let me just mention one other thing that we are also going to do in the task of trying to interpret this picture is that we have set up on the full scale segment to try to simulate as nearly as possible what we see here, and prepare the joint, put

the secondary O-ring on, the primary O-ring, and we will do at least three things that we can think of and anything else that we can think of around that O-ring, that we will twist it, we will smear grease on it, trying to match that pattern of grease as nearly as we can. We will indent it, deform it. We will do the things that we think might simulate that.

[525] Then we plan to take photographs as best we can matching the camera angles, the lighting conditions, the distances and so forth, to see if we can make any reference photographs which would lend any support to interpreting what we see there.

DR. COVERT: George, just one other thing, and I hate to always go back to what Larry Mulloy said, but he led me to believe on Tuesday that in fact people did measure the diameter of the O-ring at the time that the O-ring was taken from its envelope, that there was essentially a receiving inspection procedure?

MR. HARDY: I am sure Larry knows.

DR. WALKER: That was only every two feet.

DR. COVERT: But if there was a ding in it - -

MR. HARDY: I know Larry knows how this is done, and maybe we have a miscommunication here, but the O-ring is measured at Thiokol. It is lubricated at Thiokol. It is placed in a sealed bag, and it is

delivered here certified flightworthy, and the inspection here is to ensure that the bag has not been opened, to make sure there has been no tampering with it.

But there is no requirement on KSC to verify the O-ring diameter. In fact, with the grease on it, it would be difficult for them to do.

DR. WALKER: So Thiokol measures the O-rings.

MR. HARDY: Yes.

DR. RIDE: Has that always been the case, that KSC hasn't verified the diameter?