CHAIRMAN ROGERS: I will call the Commission to order, please.
The first witnesses this morning will be Mr. Mulloy and Mr. Hardy. Will they please come forward.
(Witnesses sworn.)
CHAIRMAN ROGERS: Welcome, gentlemen. Will you begin by identifying yourselves and giving a little background of the experience that you have had with NASA and your present assignment? I assume that you have some information you want to start with this morning.
Which order do you want to go in?
MR. HARDY: I believe Mr. Mulloy will go first.
CHAIRMAN ROGERS: Thank you. Proceed.
MR. MULLOY: Mr. Chairman and members of the Commission: [Ref. 2/14-2]
I am Larry Mulloy. I am currently the manager of the space shuttle solid rocket booster program at the Marshall Space Flight Center. I joined NASA in 1960. 1 worked as a loads and dynamics analyst, and then in the Apollo program I worked in the structural subsystem area of the second stage of the Apollo program.
Subsequent to that, I was on a leave of
absence for a year for some postgraduate work, doing doctoral studies in public administration; and subsequent to that I was assigned as the chief engineer of the external tank project at the inception of the space shuttle program. I held that position until approximately 1979, and then I was the chief engineer for NASA on the inertial upper stake in conjunction with the Air Force until 1982.
In November of 1982, I was assigned as the project manager for the solid rocket booster program. I have a B.S. in engineering from Louisiana State University, a master's in administration from the University of Oklahoma, and, as I previously stated, some postgraduate work in administration at the University of California.
CHAIRMAN ROGERS: Mr. Hardy.
MR. HARDY: Mr. Chairman, members of the Commission: [Ref. 2/26-1]
My name is George Hardy, and I am currently the deputy director of science and engineering at the Marshall Space Flight Center.
I joined Marshall in 1960. I served for a number of years as project engineer on the Saturn 1B booster. I later served as an assistant program manager on that program.
From about 1967 to 1974, I was in charge of program engineering and integration on the Skylab program. In 1974 1 became project manager of the solid rocket booster and served in that [827] position until 1982. Subsequent to that, I served in the position as associate director for engineering in the science and engineering directorate.
I graduated from Georgia Institute of Technology. After approximately six years service in the Navy, I was employed by the Army Rocket and Missile Center.
CHAIRMAN ROGERS: Thank you.
May I ask the still cameras now to take your pictures, and then during the testimony I would ask you to refrain from making shots. It is distracting to the witnesses to have so many shutters clicking each time. And so if you want a period now of taking stills, go ahead, and then I would ask you not to do it during the testimony.
(Pause.)
CHAIRMAN ROGERS: It's not that we object to you taking pictures. We want this to be an open hearing. But with all of the clutter and all of the shutters clicking at one time, it's awfully distracting and unfair to the witnesses.
Okay. Mr. Mulloy, will you proceed?
MR. MULLOY: Yes. Mr. Chairman and members of the Commission, yesterday in the testimony that was given before this Commission, and before that I think in more dramatic statements that have been attributed to Thiokol personnel by the media, a picture has been painted of the events of January 27th that I think at best may be misleading.
Mr. Chairman, with your permission, I would like to state the facts of the events of January 27th, beginning with the 8:45 telecon. I believe there has been a great deal of testimony as to the events leading up to the 8:45 telecon and, with your permission, I would like to begin at that point.
CHAIRMAN ROGERS: Yes, you may, Mr. Mulloy. We want you to feel free to present any evidence that you would like to and as long as you would like to. We will hear anything you want to say.
MR. MULLOY: Thank you, sir.
I previously testified to the flight readiness review process leading up to the launch minus one day review at Kennedy Space Center on January 26th, '86. I have stated how this continuing concern for joint O-ring erosion had been treated in flight readiness review process and all of the events leading up to the decision
on the 51-L launch.
I would like to now begin with the 8:45 telecon. After being notified of that and arriving at the resident office at the Kennedy Space Center and halving the data that had been telefaxed in from the Utah plant
CHAIRMAN ROGERS: Was that the first time you considered the weather aspects of it?
MR. MULLOY: Oh, no, sir. We-after we stood down from the launch on the 27th at 1:00, I and Mr. Reinartz, Mr. Reinartz polled all elements of the shuttle system for which he is responsible, the SRB, the external tank, and the space shuttle main engines. And I had a discussion on my SRB loop with the SRB people dealing with the question of a 24-hour turnaround to attempt to launch again at 9:38 on the 28th and the effect that the predicted cold temperatures for the night of the 27th might have on that.
The input was received back both to Mr. Reinartz and myself that we were looking at the Launch Commit Criteria relative to temperatures. It was felt there was a need to look at the recovery battery temperatures that are in the forward skirt of the SRB and the fuel service module temperatures that are in the fuel service modules for the thrust vector control
system in the aft skirt of the solid rocket booster.
The input received back by me was that they did not feel that would be of any concern. They were going to continue to look at it, and if any concern arose they would let me know.
I went to the 2:00 Mission Management Team and reported that there were no constraints to the solid rocket booster for a 24-hour turnaround, that we had taken a look at the recovery battery temperatures and the fuel service module. We did not feel at this time that there would be any Launch Commit Criteria for the low temperature limits that were established for those systems, but that we were continuing to assess that; should anything change in that regard, I would so report that.
CHAIRMAN ROGERS: You referred to the Launch Commit Criteria. What were they as far as you knew in terms of weather conditions? Any?
MR. MULLOY: In terms of weather conditions, yes, sir, I'm aware that there is a Launch Commit Criteria for the system for weather. There are a number of factors in that Launch Commit Criteria. One of them is the ambient temperature, which is established at 31 degrees.
Another is the sea state and winds in the SRB
recovery area. Another is the cross-winds at the return to landing site runway at Kennedy Space Center. Another is the trans-Atlantic landing site weather, and another is severe weather, which is related to lightning and thunderstorms in the area.
CHAIRMAN ROGERS: And when you say there were no constraints in the 2:00 meeting, does that mean that as far as you could see there were no problems in those areas?
MR. MULLOY: No, sir, I did not evaluate those areas of the Launch Commit Criteria. What I was looking at was the specific Launch Commit Criteria items that are on the solid rocket booster and the effect that the low temperatures would have on that.
I would expect Mr. Aldrich would normally make the judgments on, and his people at Johnson Space Center, would make the judgments on crosswinds and trans-Atlantic weather and the general ambient environment for launch.
CHAIRMAN ROGERS: Just so the Commission has a little better idea, at least I have a better idea, of what you would discuss at the 2 o'clock meeting, would you say, well, we don't know what the weather's going to be like tomorrow, we will have to look at it as we go along, or would you say, we're not sure what the
seas are going to be and whether we can recover?
What type of discussion was it? I have a little problem following when you say no constraints, and it is the language that I don't quite follow.
MR. MULLOY: Yes, sir. The discussion centered around the conditions that the launch pad would be exposed to during the night, particular attention to freezing of the water system on the pad, freezing of the water in the sound suppression devices that are filled with water at the base of the pad, concern for the formation of ice on the pad, which could cause potential damage to the shuttle vehicle, with primary concern for the orbiter tiles in that case, and I believe for the insulation on the external tank.
Some other discussion, I believe, about the predicted weather for the landing sites, trans-Atlantic landing sites, and the predicted weather for the local weather for KSC.
None of those discussions or the considerations of those discussions posed any constraint to the solid rocket booster.
[829] CHAIRMAN ROGERS: "Constraint" meaning that at that point you thought it would be okay to launch the next day, but you couldn't be sure because those things might change?
MR. MULLOY: Yes, sir. Based upon the weather conditions that were being looked at at the time and based upon the concerns that were being addressed at that time, I saw - and with the commitment that we were going to continue to look at the weather through the night and then assess that in real time in the morning, which is actually what was done, and the launch was delayed because of the ice on the pad and getting some ice out of the sound suppression blankets.
CHAIRMAN ROGERS: Okay, will you proceed? So at the 2:00 meeting you felt that, although there were problems that might exist the next day, that you felt that those problems probably could be overcome and you could be able to launch?
MR. MULLOY: Yes, sir, I was confident that the only thing that would violate Launch Commit Criteria on the solid rocket booster at that time were a potential violation of the recovery battery low temperature and the fuel service module low temperature.
And as further analysis was done in the afternoon, the initial assessment of that was upheld and we did predict no violation of those Launch Commit Criteria.
CHAIRMAN ROGERS: And at that point the
O-rings and the seams and so forth were not discussed?
MR. MULLOY: No, sir, they were not.
I subsequently learned that my- and it was testified to yesterday, I believe, by some of the Thiokol people. I subsequently learned that my solid rocket motor element manager, who was at the Huntsville operations support center supporting the launch, did communicate to Mr. Boyd Brinton, who is the project chief engineer for the solid rocket motor for Morton-Thiokol, that the query had come, did we have any constraints for a turnaround.
That had been relayed to Mr. Brinton, who then called, I believe, Mr. Ebeling, it was testified to, at Thiokol in Utah, to begin to look into that. And that led into the events.
CHAIRMAN ROGERS: And what was the man's name you referred to? You said your man?
MR. MULLOY: Mr. Larry Wear. He is my solid rocket motor element manager. I have a solid rocket motor element manager and I have a booster assembly element manager for the other aspects of the solid rocket booster other than the motor.
CHAIRMAN ROGERS: Okay, proceed. I'm sorry to interrupt you.
MR. MULLOY: Okay, sir. When we got the
charts containing the Thiokol engineering data and the conclusion that Thiokol was drawing from those data arrived at KSC and Marshall- began arriving at about 8:45, when the conference began.
We went ahead and began the conference, but the, conclusion and recommendation charts that Mr. Lund subsequently testified to yesterday did not come in until somewhat later. I don't know exactly when they were there, but when we started into the telecon and began discussing the data we did not have those conclusions and recommendations.
We were simply looking at the engineering data and reviewing those engineering data. The concern, of course, that was being expressed was for the low ambient temperatures that were predicted for the night and the effect those low ambient temperatures would have on the propellant mean bulk temperature and on the joint particularly.
[830] If I could have chart SRB-6, please, on the screen, I would like to clarify. When we talk about temperatures
(Viewgraph.) [Ref. 2/26-2]
-we have a number of them. These specific temperatures don't represent any particular condition on STS 51-L. What we are showing there is the ambient
temperature at pad B is at ground level, and it is about 50 feet away from the pad. For example, that temperature, as an example, might be 36 degrees at ground level.
Then there is a local ambient temperature- and we will provide hard copies of this, sir, for you later. The local ambient temperature is referred to as in the vicinity of the solid rocket booster, that local ambient temperature will be in a tank condition. It will be below the general ambient because of the effects of the cryogens in the external tank and the heat short that exists through the to the attachments SRB and the wind blowing the cold air around the SRB.
That, for example, might be 30 degrees, while you have a ground ambient of 36 degrees.
CHAIRMAN ROGERS: "Ambient" means outside?
MR. MULLOY: Yes, sir.
CHAIRMAN ROGERS: Outside temperatures?
MR. MULLOY: Yes, sir. The ambient temperature at a point here in this room will be slightly different than the ambient temperature at a point back there by those lights.
But the ambient temperature, it doesn't have to be outside. It could be the ambient temperature of the body of this room or a body of air in this room.
Then the local ambient is affected by the proximity of heat sinks that are around the solid rocket booster and the wind blowing around that. At that same time, you might have a joint temperature or a temperature right at the field joint that is lower than the local ambient, and that will occur because the local ambient and the ambient temperature has been lower possibly three or four hours earlier, possibly say 18 or 20 degrees. And due to the lag, the local ambient and the ambient may be coming up, but the steel parts are still cold, and so you may have a joint temperature of 27 degrees.
And then when we speak of the propellant mean bulk temperature, that is the average temperature of all the particles of the propellant in the motor taken- it is an average of from the outside, inside. There is a slight gradient through that. That may be 57 degrees, because that is a large heat sink, and if it was 60 or 70 degrees three or four days before, or say 70 degrees, the temperature can get very low and that propellant mean bulk temperature doesn't track that.
And so I just submit that for some clarification. The concern that we were talking about was for the effect of the overnight low on the propellant mean bulk temperature and the effect that it
would have on the joint and the seals and the performance of those joints and seals.
The Thiokol engineers were stating that they believed the effect of that lower temperature on the O-rings would be to slow the time for the primary O-ring to seal, resulting in greater hot gas past the primary seal and possibly erosion of the secondary seal. The data that they showed included the previous coldest launch, which was STS 51-C, which they stated at least qualitatively had the worst blow-by of any previously observed.
[831] Considerable discussion between Marshall and Thiokol on the significance of those data then ensued. There was at that time- we still didn't have conclusion and recommendation charts. All we were trying to do was understand what the data were telling us.
The major focus of that discussion was the effect low temperatures could have on blow-by of the primary O-ring seal.
Now, if you bring up chart SRB-3, I think at this point it might be helpful to graphically show again the configuration of the joint.
(Viewgraph.) [Ref. 2/26-2 3 of 3]
When we were assessing- and if you could
scale that down and focus on the left side first, if you would, please, and get the title in.
Okay. We will go from the upper left corner, down the column, and then back up to the right. In the initial condition, the joint is assembled and it has squeeze on the O-rings. What we have been talking to is the O-ring is actually compressed into that joint.
In the specific conditions of STS 51-L, that compression far exceeded the minimum compression required. The compression on the particular joint that has been of interest to us has been 38-thousandths to 40-thousandths, where the minimum requirement is 20-thousandths.
In that initial condition, you have redundant seals, the primary on your left and the secondary on your right.
If you would move down in the left column now.
MR. HOTZ: Mr. Mulloy, may I interrupt you for just a moment. Now, what is the time element there in making that leak check?
MR. MULLOY: That leak check, sir
MR. HOTZ: What day and what calendar day was it made?
MR. MULLOY: I believe it has been reported
that it was about 28 days before the attempted launch. It was about the 1st. But when it is made is when the joint is assembled.
MR. HOTZ: Before it goes out to the pad?
MR. MULLOY: Oh, yes, air. As we assemble each SRM joint, before we put the next SRM segment on we leak check the previous one. In the event that you don't pass the leak check, you have to de-mate and do it over again. So we don't run up the whole stack and then leak check all the joints.
We build it up from the bottom and check each joint as it is assembled.
MR. HOTZ: So it would have been at least 28 days before the launch?
MR. MULLOY: Yes, sir.
DR. COVERT: Mr. Mulloy, may I ask a question, please? You said that there was plenty of squeeze in the O-ring. What temperature would you say that that squeeze referred to?
MR. MULLOY: Okay, sir. In that initial condition, that referred to an ambient condition of 75 degrees. The consideration that was given during the course of the discussion is how much would that squeeze be reduced as the temperature was reduced to 20 degrees?
That was calculated and it was 3-thousandths of an inch. That occurs for two reason: the diametrical shrinking, as well as the stretching of the O-ring as it is chilled.
DR. COVERT: Your 38- to 40-thousandths then would go 35 to 37?
MR. MULLOY: Yes, sir, that is correct.
[832] DR. COVERT: At 20 degrees.
MR. MULLOY: At 20 degrees, I believe is the temperature that was calculated at.
DR. COVERT: Thank you, sir.
MR. MULLOY: Okay. Then when we do the leak check, the O-rings are then displaced as shown in the second diagram down in the left column. It pushes that primary O-ring back toward the motor pressure side. It pushes the secondary O-ring back against the surface against which it will subsequently seal, if called upon to do so, by any pressure from motor operation impinging on it.
If you will go to the third one in the left column, please. Then, after you take the pressure off- this pressurization is 200 psi initially, to be sure that the O-ring is pushed up against that gap, and then that pressure is reduced. That is with an open source, just turning, opening the valve and letting it flow as
much as it will, because you will get some blow-by initially in moving that in the pressure check. Then that is reduced to 50 psi and held, and the spec ion that is one psi allowable leakage in 15 minutes. That is with a closed source. It has to hold the pressure between the regulator, the valve on the pressure source, and flow by the seal.
Now, when that pressure is taken off there is some relaxation. Those O-rings don't stay smashed up against that gap, as they were shown when you had the 200 psi.
If you will go to the center column in the top, please.
Now, during motor operation there are two things that can occur. The first is where the primary seal is actuated. Initially in the initial pressurization, as was testified to yesterday, from zero to about 170 milliseconds, which equates to about 200 psi, there is no significant joint rotation.
We have test data, and I believe the engineers stated yesterday, there is a knee in there and it is not linear. It is not linear with pressure. You don't get one-third of the rotation at 200 psi. You get less than one-third, and then it tends to ramp up due to the stiffness of that joint.
So when the motor is pressurized at about 30 psi, which is 50 to 60 milliseconds, that primary O-ring is translated across from the forward face of the groove to the face that it wants to seal against. We have shown in tests that an O-ring will seal or seat and begin to extrude into the gap at 30 to 50 psi.
Go to the center on that center column, please.
Now, what happens at about 200 psi, again joint rotation is not a significant factor here. You may got 2- to 3-thousandths of joint rotation at a in maximum in this kind of a condition. The pressure is impinging there and beginning to extrude the primary seal into the gap.
Go to the bottom of that center column, please.
Now we get the joint rotation. Tests have shown that a good O-ring with a durometer of 90 even- and our spec on the O-ring is 75. This is the sponge. and brick analogy that was used by one of the engineers yesterday. I think that is a little dramatic in describing the change in that O-ring stiffness in going from 75 to 90.
But it has been shown that the O-ring will extrude into that gap and seal.
Now, if you will go to the top on the right, please. Another condition that can happen, the reason we have redundant seals, here at the moment of motor ignition the system is redundant. If for any reason the primary seal does not seat-it is damaged, it has a twist in it, it has a void [833] in it or whatever- the primary seal does not seat, the pressure actuation is now taking place on the secondary seal. That is where the redundancy is, in zero to 170 milliseconds.
Go to the center, please.
Now, that continues, and what happens to the secondary seal is exactly what happens to the primary seal. The primary seal has failed to function, the redundant seal is performing its function at 200 psi.
DR. WALKER: Mr. Mulloy, can I ask a question about that? Would you in your discussion also include your understanding of the waiver and what that meant in regards to how you could consider whether or not the secondary seal was really going to operate?
MR. MULLOY: Yes, air, I had planned to do that later, but I will just answer that now. My understanding of the waiver is the design goal on the shuttle was to have redundant systems. That design goal is not met in all systems. There are some 829 Crit 1s waivers on the shuttle system. There are 213 Crit 1
waivers on the SRB.
This particular waiver is one of IS on the solid rocket motor. Now, my understanding of that waiver, it is required because we have defined a condition under which the secondary seal may not form a seal, and I emphasize "may not."
MR. SUTTER: Could I ask a question, please? Are all of these waivers of equal importance, or of all of these waivers which do you think is the most important?
MR. MULLOY: We are assessing that now, because we're going back and looking at all of the Crit 1s. At the time that the Crit 1s were established, they were all considered to be loss of life and loss of vehicle should that system fall.
I think the question you're asking me is, what is the probability of failure and what is the experience with the system that would say, well, this one is more likely to fail than the next one and the next one, and put a priority order on those. I am not at this point prepared to say that, of the 18 critical systems on the SRM, that an igniter, for instance, is more or less critical than a seal.
But we are assessing that, and the way you have to do that is look at our experience with that.
DR. WALKER: But you did have a task team working on this particular problem?
MR. MULLOY: Yes, air.
DR. WALKER: Did you have task teams on any of the other problems?
MR. MULLOY: Yes, air. Yes, air, we did. As a matter of fact, on the nozzle we had, as has been related, on STS-8 we found that we were getting some very unusual nozzle erosion. We applied a task team to that to solve the problem, and that is a Crit 1 item. Burn-through of the insulation on the liner of the nozzle is loss of mission and crew.
And yes, we had a task team working on that. And really, on the SRM, those are the two that had very equal importance, really, because the criticality- in answering your question, air, those two, they would be a real foot race as to which one we would have considered more critical, depending upon the particular time that you looked at your experience with that.
If you'd asked me that question a year and a half ago, I would have definitely said the nozzle.
CHAIRMAN ROGERS: It sees to me, though, that based upon the testimony yesterday, and what I think you're leading up to here, is that the argument is being made that this should have been Criticality 1R. You're
arguing there was a redundancy in the item and the item itself says there isn't a redundancy, that you have to operate on the basis of Criticality 1; if there is a single failure, it is a loss of life and loss of crew.
MR. MULLOY: Yes, sir, but if you read that total document, which perhaps you have, what it says is under worst case conditions it can be Criticality 1.
CHAIRMAN ROGERS: Wasn't this a pretty bad case, with the weather and all of the alarms that you had, and the recommendations from the engineers at Thiokol? Wasn't this what seemed like a pretty dangerous situation?
MR. MULLOY: It did not seem that way to me then, sir.
Now, if I may continue and answer the question about what the CIL applies to, it says under certain conditions you may have a single point failure. It very carefully says "under certain conditions."
Mr. McDonald testified yesterday- and I cannot assert to the factualness of what he stated, but what he said was, in reality we have never had that worst case condition where we actually flew Crit 1, except on one motor, which was one joint on STS-4. Now, we're looking at that.
I think that certainly is closer to the case
than we have had Crit 1 on everything except one motor, and the reason it is is because you look at the squeeze that you actually have, given the dimensions that you actually have, and you look at the worst case rotation that can occur under that condition, and that worst case rotation does not result in a secondary seal unseating such that if the primary seal fails the secondary seal will work. Therefore, it is redundant.
DR. RIDE: Does that calculation take into account the out-of-roundness of the segments, the calculation on the squeeze?
MR. HARDY: Yes, it does. If I could make
DR. RIDE: I would just like to ask whether when you did this calculation for 51-L, which it looks like you did on the 27th, to find out how much squeeze you had on the O-rings, whether you actually did take into account the out-of-roundness on the segments, calculating the squeeze?
MR. HARDY: Yes. Those calculations, Dr. Ride, were made prior to the 27th meeting, but the out-of-roundness is taken into account. The rounding of the three cylinders, if I could describe it that way, you've get inner leg and the outer leg of the clevis, and then the tang itself.
The rounding of those cylinders, which occurs
at relatively low pressures, is also taken into account.
I would like to mention one thing, if I could read from one place in the critical items list regarding this waiver, I think it clearly describes my interpretation of the waiver, and I don't choose to get into a discussion with somebody else's interpretation. But there is a note that says leakage of the primary O-ring seal is classified as a single failure point due to the possibility of lose of sealing at the secondary O-ring because of joint rotation after motor pressurization. [Ref. 2/26-3]
And I am personally aware of the facts that drove the submission of this waiver, and it was clearly associated with the fact that after motor pressurization, after it's been through the ignition transient, you can have a stackup of tolerances on the metal parts and the O-ring which indeed would not- under which case you would indeed not have a redundant seal.
[835] CHAIRMAN ROGERS: Let's stick with that language, because it seems to me that goes right to the heart of it. Read it again. And as I read it, it means that if the primary seal fails that the mission will fail. Am I wrong?
MR. HARDY: That is not my interpretation.
CHAIRMAN ROGERS: Well, let's read it. "Loss of mission" - this is actual loss. "Failure effects summary. Actual loss. Loss of mission, vehicle and crew due to metal erosion, burn-through, and probable case burst, resulting in fire and deflagration." Now "Note, leakage of the primary" -and this is the part that I want to refer to.
"Leakage of the primary O-ring seal is classified as a single failure point "-" as a single failure point "-" due to possibility of loss of sealing at the secondary O-ring because of joint rotation after motor pressurization."
Now, that suggests to me that the critical items list says that if the primary O-ring seal fails, that you have got a good probability that the mission will be a catastrophe. Am I wrong about that?
MR. HARDY: You are not wrong, if I might put my clarification into that, if the primary O-ring fails after motor pressurization, after joint rotation.
CHAIRMAN ROGERS: I guess what I'm saying is, isn't that a possibility of exactly what happened in this launch?
MR. HARDY: I don't believe so.
CHAIRMAN ROGERS: Why?
MR. HARDY: Well, I will elaborate on that a
little bit later here. But in the considerations, at least in the considerations of the subjects at hand, relative to the discussion on the 27th, the discussion on the 27th had to do with the possibility of the cold temperature delaying the complete actuation of the primary seal, thereby extending the duration of blow-by.
Now, when we talk about blow-by of the primary seal, blow-by has to go somewhere, and where it goes to is the secondary seal. If blow-by occurs as soon as the pressure gets to the primary seal, early in the ignition, and that seal doesn't sustain that pressure, it goes immediately to the secondary seal, prior to the time that the joint is rotated.
CHAIRMAN ROGERS: This says "possibility of the loss of the sealing of the secondary O-ring."
MR. MULLOY: After the joint has rotated, sir. The condition that is on the screen now is before joint rotation.
DR. WALKER: But I think a critical and a literal interpretation of that waiver has to be that the primary seal is a single point failure. Now, the wording goes on to explain why this is so, but the wording does not make an exception. It merely explains why the single point failure mode refers to the primary
seal.
But a strict interpretation of that wording to my mind is that the primary O-ring is a single point failure.
MR. HARDY: I wouldn't deny that. I am relating to what many of us knew about the performance of that joint, its rotation, when we lost-when we could lose, because of the stackup of [836] tolerances, when in the ignition transient prior to full motor pressurization or after full motor pressurization when we could lose that secondary seal.
Our interpretation or my interpretation of the waiver was not to remove the secondary seal from the hardware.
DR. RIDE: It seems to me that really crucial to all of this is the timing function and how quickly you think that the primary will seal, whether it's in that first 160 milliseconds or whether it's not. And if it is not, then you run the risk of getting into the period where joint rotation is more likely.
I guess what I wonder about is the data that you've got to show how the timing function changes at low temperature, because it is certainly going to be a function of the temperature,
just because the O-ring is different and it is behaving differently. It is
deformed in some way.
And it is not clear to me that you've got the data to say that, to discriminate at the level of
milliseconds, which is what you are really doing, and to apply engineering judgment based upon really not very much data, and applying that engineering judgment to a Criticality 1 case.
MR. HARDY: Well, I will comment on part of that and maybe Larry would like to comment, too. I would like to clarify and emphasize, if it is not clear, that this seal performance of the primary and secondary seal in the early part of the ignition phase, it is not a step one, step two.
Step one and step two occur simultaneously, meaning that if I get blow-by the primary I am pressurizing the secondary. So it is not a situation where I get blow-by the primary and that extends for some period of time and during that period of time the joint rotates, and then I call on the secondary seal.
I can't have blow-by the primary unless I am trying to pressurize the secondary seal. So it is not a situation where for some number of milliseconds I've got blow-by the primary and then later I call on the secondary seal. I am calling on the secondary seal to function the instant I get blow-by the primary seal.
DR. RIDE: I think that Mr. Boisjoly described it very well when he said that it is kind of a race. Although you've got blow-by past the primary and the secondary is presumably holding at that point, the race is between the erosion that is occurring on the primary and its attempt to seal.
So it is whether it seals first or erodes first.
MR. HARDY: Which erodes first, Dr. Ride?
DR. RIDE: The primary.
MR. HARDY: Well, if I have initiated- early in the ignition transient phase, if I have initiated a sealing of the secondary seal, subsequent erosion on the primary seal is not of interest.
DR. RIDE: Well, it is if the primary erodes to the point that when joint rotation occurs then you no longer have the secondary.
MR. HARDY: The secondary seal will seal- if the secondary seals at the pressure that it is supposed to seal, and there have been tests run at 30 degrees that indicate that the seal- that a seal will in fact form an extrusion seal.
If that occurs, then subsequent joint rotation, which occurs on every primary seal that ever
seals, that will not cause you to lose that seal. And
it is because of the extrusion of that O-ring into the extrusion gap.
[837] Again, let me re-emphasize, every time the primary seals on a joint early in the ignition phase, that joint, the primary seal, the rotation of the joint is greater on the primary seal than it is on the secondary seal.
So every flight demonstrates the fact that once you initiate an extrusion seal, subsequent rotation of the joint does not affect that seal.
DR. WALKER: But if you have a situation where the rotation begins to occur even after the seals have been made, is this not where temperature is truly critical and where the tests carried out at Morton-Thiokol measuring the response of the seals as a function of temperature should have been very critically considered, because now at lower temperature the seal is going to have a harder time following the movements of the metal parts?
MR. HARDY: I can assure you that that particular characteristic will be thoroughly examined. It is being thoroughly examined. My assessment on the night of the 24th and in fact today is that if I properly extrude that seal into the sealing gap and have the forcing pressure behind it, that the temperatures of interest
would not have any effect on losing that seal as it goes open.
The key factor which I think many of you have determined, and I agree with you, the key factor is whether or not the initiating pressure on the primary occurs early in the ignition transient. And that was my knowledge at the time, the 24th and I believe that to be- or the 27th- and I believe that to be the knowledge of everybody participating in that meeting, because there was no discussion to the contrary that I'm aware of
GENERAL KUTYNA: Mr. Hardy, Ben Powers, one of your engineers, did have an opposite view on that. How did you rationalize his concern?
MR. HARDY: If I may, I'm a little out of sequence here. If I may, when I get into my statement I will address that.
VICE CHAIRMAN ARMSTRONG: I would like to ask a question specifically with regard to the joints on 51-L. Based upon your analysis of the measurements that you have on those joints, would you expect that after full flight pressurization of the motor you would have a secondary seal?
Or, to put it in another way, do you think on these joints you had a Criticality 1 or a Criticality
IR?
MR. MULLOY: Given the temperature?
VICE CHAIRMAN ARMSTRONG: Given everything you know about it at this point in time.
MR. MULLOY: And the known resiliency. It would be my judgment that, with the resiliency data that was presented on the 27th, that that would be a condition where the secondary seal may not function.
MR. HARDY: After joint rotation.
MR. MULLOY: After joint rotation.
VICE CHAIRMAN ARMSTRONG: So, to just repeat that, in this case we might have a single seal failure, namely the primary seal failure after motor pressurization, that could cause a problem of the kind we are investigating.
MR. MULLOY: Yes, sir. That is the condition that, is recognized in the CIL. If I may go to the chart on the bottom, I would like to explain that further, sir.
[838] CHAIRMAN ROGERS: It seems to me that that question and answer become extremely important. Let's be sure that the record is clear on that. I thought Mr. Armstrong's question went right to the heart of the matter, and I'm not sure that I understood the answer.
Is it possible to read that back'?
THE REPORTER: "Specifically with regard to the joints on 51-L, based upon your analysis of the measurements that you have on those joints, would you expect that after full flight pressurization of the motor you would have a secondary seal? Or, to put it another way, do you think on these joints you had a Criticality 1 or a Criticality IR?"'
CHAIRMAN ROGERS: Could we get an answer just to that one? Was that Criticality 1 or Criticality 1R?
MR. MULLOY: Yes, sir. It was our judgment that we were redundant at ignition. As Dr. Ride has pointed out, there was a timing function. We did not conclude on that night that the primary seal would not function and seal. That was inconclusive.
If under the conditions described, if the primary seed did function and seal, then we have joint rotation, then the primary seal subsequently fails, I believe the question was that, under the conditions of temperature, would you anticipate that you had a worst case condition wherein the secondary seal would not be in a position to energize.
I said that may be the case. That may be the case. It has not been shown- what we had was resiliency data that says that the metal under rotation lifts off the seal. It has not been shown that that seal would not function under that condition.
MR. HOTZ: Mr. Mulloy, in the interest of
clarity, could you just simply state, was it 1 or 1R?
MR. MULLOY: It was 1R, sir.
MR. HOTZ: Thank you.
MR. SUTTER: Could I ask a question, please. I get a little confused. It was my understanding yesterday when the question was asked to transmit data to Kennedy, I asked what was going to be done with the data, was it going to be analyzed so that Kennedy could make a decision? And the answer came back: Well, no decision had been made at that point, and so it was just for information.
But yesterday the impression I got is that the engineers at Thiokol reached a conclusion and, whether it was right or wrong, their conclusion was wait for a warmer temperature. Then the management of Thiokol, as I remember it, reversed that condition to say, go ahead and fly, forget the temperature.
This presentation seems to be another analysis maybe justifying why the decision to fly was all right. Now, if somebody was in charge of this launch- now I see three parties, the Thiokol engineers saying one thing, the Thiokol management saying another thing, and perhaps this discussion saying another thing.
Who does the launch manager listen to?
MR. MULLOY: Well, sir, the launch manager
listens to Mr. Aldrich, who provides the readiness for launch to the launch director during the launch count. If you go back to the events that you were relating, sir, in the afternoon I was not aware of the engineering conclusions until we were an hour into this telecon, which started at 8:45.
[839] We were looking at data. Your question was was it transmitted to Kennedy so that Kennedy could make the decision? No, sir. The data were actually transmitted to the Marshall Space Flight Center. Part of the Marshall Space Flight Center happened to be at KSC.
Another part- a part of Thiokol happened to be at KSC. Another good part of the Marshall Space Flight Center was still in Huntsville. That telecon that occurred in the evening at 8:45 was a Marshall Space Flight Center solid rocket booster discussion.
MR. SUTTER: Well, somewhere along the line, perhaps after all of the testimony is given, I would like to ask that question again. If the Thiokol people say don't fly, does that stick? Can it be overruled? Who is the final judge that makes a recommendation to whoever has to say launch?
I'm confused and I would like to get it clarified some time.
MR. HARDY: Mr. Chairman, I think I understand the question and it is certainly a legitimate interest to have. If I might suggest that Mr. Mulloy and myself be permitted to proceed with our statements, I believe that some of the players and where they fit would be a little clearer to you.
CHAIRMAN ROGERS: I think that is correct. Mr. Mulloy, we will come back to some of these questions later on, and particularly Mr. Armstrong's question, because I really hope we can get an answer yes or no.
But in any event, go ahead with your presentation, and we will try to listen carefully.
MR. MULLOY: Okay. I guess where we digressed, I'm to the last diagram here. The condition, the other condition that can exist, where the redundant seal does function, the primary seal has failed and the redundant seal does function, when you start with a redundant system, is depicted on that picture there. The primary seal is compromised, the redundant seal has been pressurized into the gap, and seals. That is another condition that is a "Crit 1" condition.
Should that condition occur- and I will go on now and continue the discussion. As I said, the focus of that discussion at 8:45- and I would reiterate, that was a discussion that was carried on
under my direction, if you will; I am the SRB project manager and all elements on that discussion were in support of me. As has been stated, Mr. Reinartz, who is the shuttle program manager at Marshall, was also there.
But about halfway through, after we had looked at all of the data, the conclusion and recommendation charts that Mr. Lund had prepared came in and the logic for his recommendation, which did not specifically address don't launch 51-L, what it said was that, within our experience base we should not operate any solid rocket motor at any temperature colder than we have previously operated one, which was 51-C.
CHAIRMAN ROGERS: Didn't you take that to be a negative recommendation?
MR. MULLOY: Yes, sir. That was an engineering conclusion, which I found this conclusion without basis and I challenged its logic. Now, that has been interpreted by some people as applying pressure. I certainly don't consider it to be applying pressure.
Any time that one of my contractors or, for that matter, some of Mr. Hardy's people who come to me with a recommendation and a conclusion that is based on engineering data, I probe the basis for their conclusion to assure that it is sound and that it is logical.
I found this recommendation not to launch an SRM at a temperature below 53 degrees as to be-it came as somewhat of a surprise to me, and the reason it did, after 51-C, which is when the observation was made about the blow-by, which has been testified to, we dealt with the observations on 51-C very carefully in going into the next launch readiness review.
The conclusions that came out of that was that there may be, there may, be some effect of temperature that is causing this additional blow-by, but the conclusions as presented to by flight readiness review by Morton Thiokol- and I certainly had no dissent at that time-was that 51-E, which was going to be launched in a much warmer temperature, may have exactly the same type of erosion and blow-by, that we might expect that; that the tests and analysis that had been done showing that did show that we were tolerant to that.
And the conclusion was that 51-E was acceptable to launch with full expectation that we might see again exactly what we saw in 51-C. We tested that logic and rationale in great detail. I signed an action item in my solid rocket booster flight readiness review board, which I chaired, to provide additional data relative to that particular recommendation on 51-E. [Ref. 2/26-4]
Those specific actions were: give me a graphic comparison of the 51-C case joint O-ring erosion dimension with previously observed eroded O-rings; provide description and disposition of all PRs- that is a problem report-on case field joints for both STS-51-C and 51-E; include the metal part problem reports, O-ring, putty, leak tests, all data relative to 51-C and 51-E, since in the initial presentation that was not provided.
Correlate the putty lot that was used on 51-C with the case joints. Did we see any correlation between the lot of putty and erosion in one case joint and not having it in another? Identify any problems with this putty layup.
And number five was, what was the effect of low ambient temperature on the joint?
Number six was, what is joint geometry and O-ring squeeze on both the primary and secondary O-rings for 51-C and 51-E, and to analyze the soot to determine the source.
That action item was answered. The conclusion relative to temperature was that that temperature effect would still give us adequate squeeze and joint operation.
Now, that was the basis that I was coming from,
which led me to conclude that this was a rather surprising recommendation. There were other factors that were involved in that.
CHAIRMAN ROGERS: Can we have a copy of that, Mr. Mulloy?
MR. MULLOY: Yes.
And this was a rather surprising conclusion, based upon data that didn't seem to hang together, and so I challenged that. And I assure you, sir, that there was no reversal of the tradition of NASA which says prove to me why you can't fly versus prove to me why you can.
As I say, to me that is- it doesn't make any difference. If somebody is giving me a recommendation and a conclusion that is based upon engineering data, I am going to understand the basis for that recommendation and conclusion to assure that it is logical. I think that has been interpreted, when one challenges someone who says, I don't have anything too qualitative, but I'm worried, that that is pressure, and I don't see it that way.
Now, I asked Mr. Kilminster then, who is the vice president of space booster projects, for his recommendation for 51-L. He stated that, based upon the engineering recommendation, he could not recommend
launch.
Now, I fully understood what Mr. Kilminster was saying at that time. He did not say the engineering data says that you can't launch. He says: I've got an engineering recommendation here and based upon that I certainly cannot recommend launch.
I construed that as making a point that he really had not had an opportunity to think through all of the points that were made during that two-hour discussion, because there were a lot of additional considerations that that data generated during that two-hour discussion, with some 30 engineers involved in that discussion, raising questions, questioning data, questioning the conclusions that are drawn from those data.
And sir, that is not at all unusual in any of our processes. It is not at all unusual.
Now, then I gave- at that point, I gave my assessment of where we had been, including that consideration for 51-E which was in my mind, which I don't believe I stated at that time. But where I was coming from was we had been flying since STS-2 with a known condition in the joints that was duly considered and accepted by Thiokol, it was accepted by me, and it was accepted by all levels of NASA management through
the flight readiness review process, through special presentations that we had put together and provided up here to the headquarters people. The rationale for accepting that condition had been previously documented.
I would like to now read what I said on that night. You have the notes, because I jotted these things down. This is what was described as a rather logical conclusion by Mr. Russell of Thiokol yesterday.
I stated that, after that beginning, this is a condition that we have had since STS-2, that has been accepted; that blow-by of the O-rings cannot be correlated to the temperature by these data. STS-61 had blow-by at 75 degrees. Soot blow-by of the primary O-rings has occurred on more than one occasion, independent of temperature.
This is in the nature of challenges: Think about this, think about your data.
Primary erosion occurs due to concentrated hot gas passed through the putty. I just wrote that down to say we know why we get erosion. We have done tests, we have done analyses, we understand the limits that the erosion can be, and we understand by tests how much we can withstand.
The colder temperature may result in greater
primary O-ring erosion and some heat effect on the secondary because of increased hardness of O-ring, resulting in slower seating. Early static tests, however, hydrotests- and I have subsequently found that that is 150 of those, and I will show that on a chart- with a 90 durometer O-ring- now, when we're talking about the hardness of O-rings, this is the brick and sponge.
The 75 durometer O-ring is a little softer than a 90 durometer. The durometer is a measure of the hardness of the O-ring. As the temperature approaches about 30 degrees, the durometer is about 90.
It was stated in the Thiokol data that was presented that we had successfully shown that an O-ring with a durometer of 90 would extrude into the gap and seal. It wasn't too hard to extrude into the gap. Further, I have subsequently found out that the diameter of that O-ring was .275 inches. So it is reduced in diameter also, which gives a pretty good simulation of a cold O-ring. That wasn't stated on the night of the 27th.
[842] The other positive point is that the squeeze at 20 degrees is positive, it is greater than 20 thousandths. We saw a 3 mil reduction in the overall squeeze and we were starting out with a squeeze of some
36 to- or 38 to 40 mils.
The secondary seal is in a position to seat. It is in a position to seat and seal by the 200 psi and 50 psi pressurization at leak check, The primary may not seal due to reduced resiliency and increased durometer, may not seal, the worst case condition, if the worst thing happens.
However, during the period of flow past the primary the secondary will be seated and seal before significant joint rotation occurs, which is less than 170 milliseconds.
My conclusion was that that condition has been recognized at all levels of NASA management and is applicable to 51-L.
Mr. Reinartz at that point, after I had made that statement, which was in the intent of look at all of the data that we have, look at our flight experience, look at our test data, look at our analysis, don't just look at this isolated body of data that we have on 12 charts in reaching your conclusion, Mr. Reinartz then asked Mr. Hardy for his comments. George will state what he said, but what I understood him to say was that he basically agreed with that summary, but he certainly would not recommend launch against Thiokol's recommendation. And this is
the gentleman that I rely on for engineering recommendation to launch, and I certainly could not decide to launch in the absence of his recommendation to launch.
Mr. Kilminster then requested an off-net caucus. It has been suggested, implied, or stated that we directed Thiokol to go reconsider these data. That is not true. Thiokol asked for a caucus so that they could consider the discussions that had ensued and the comments that Mr. Hardy and I and others had made.
That caucus, as has been stated, was going to start. At that point, and Mr. McDonald interjected into the teleconference. At that point, he made the first comment that he had made during this entire teleconference.
Mr. McDonald testified for quite a while yesterday about his thoughts on this, but he did not say any of them until this point. At that point, he stated that he thought what George Hardy said was a very important consideration, and that consideration was, and he asked Mr. Kilminster to be sure and consider the comment made by George Hardy during the course of the discussions, that the concerns expressed were for primary O-ring blow-by and that the secondary O-ring was in a position to seal during the time of blow-by and would do so before significant joint rotation had occurred.
They then went into their caucus, having asked for five minutes
DR. WALKER: Could I just ask a question?
MR. MULLOY: Yes, sir.
DR. WALKER: That comment by Mr. McDonald, how did you interpret that, as a comment in favor of proceeding to launch?
MR. MULLOY: Yes, sir, I certainly did,
because- that is, I was sitting- Mr. McDonald was sitting here and it clearly was a supportive comment. I would not say he was recommending launch. What he was saying was that what we were asking them to do was a very important consideration, and as I remember he said, I think that's very important.
And I took it as a supportive comment to the rationale. He certainly didn't say, I think this will support a decision to launch.
DR. WALKER: Could you also, as you proceed with your narrative, tell us about any conversations you had with Mr. McDonald during the 30 or 35-minute caucus?
MR. MULLOY: Yes, sir. If I may, I can't recall the things that have been attributed to me as to whether they occurred during the caucus or whether they occurred subsequent to Thiokol coming off the caucus and making their recommendation,
I don't know that that is germane, but I simply can't recall whether some of these discussions occurred during the 30 minutes we were on mute or subsequent to the decision coming down.
MR. HOTZ: Mr. Mulloy, in that regard, could you, perhaps recall just one of those comments? It figures quite prominently in the discussion that you
were quoted as saying, do you expect us to wait 'til April to launch?
MR. MULLOY: Yes, sir.
MR. HOTZ: Is that an accurate statement or not?
MR. MULLOY: It is certainly a statement that is out of context, and the way I read the quote, sir- and I have seen it many times, too many times- the quote I read was: My God, Thiokol, when do you want me to launch, next April?
Mr. McDonald testified to another quote that says: You guys are generating new Launch Commit Criteria.
Now, both of those I think kind of go together, and that is what I was saying. I don't know whether that occurred during the caucus or subsequent to. I just simply can't remember that.
MR. HOTZ: Well, never mind the timing.
MR. MULLOY: Well, yes, sir. I'm going to answer your question now. I think those quotes derive from a single thought that may have been expressed by me using some of those words.
I have not yet encountered anyone other than those at KSC who heard those words, so I don't believe they were transmitted over the net. The total context, I
think, in which those words may have been used is, there are currently no Launch Commit Criteria for joint temperature. What you are proposing to do is to generate a new Launch Commit Criteria on the eve of launch, after we have successfully flown with the existing Launch Commit Criteria 24 previous times. With this LCC, i.e., do not launch with a temperature greater than 53 degrees, we may not be able to launch until next April. We need to consider this carefully before we jump to any conclusions.
It is all in the context, again, with challenging your interpretation of the data, what does it mean and is it logical, is it truly logical that we really have a system that has to be 53 degrees to fly?
DR. WALKER: I understand how you have clarified that, but I think you have raised an important question, which I hope that you and Mr. Hardy will address, and that is, why was there no Launch Commit Criteria which addressed the O-ring specifically?
[844] We have asked that question of Thiokol and I don't think we have gotten an answer, so I hope perhaps we can get an understanding of that and your thinking and the reason why, after you set up a task team to address this question, you did not also bring your paperwork sort of in line with this concern.
MR. MULLOY: Yes, sir, I will try, and I think between George and I, possibly we can address that to your satisfaction.
CHAIRMAN ROGERS: I want to also raise a point. You mentioned in your statement that there was somebody from Thiokol that asked for a five-minute recess and you said that the other- I think you used the word- lie or not true. I don't believe anybody testified to the contrary.
I think the testimony yesterday was that they were not certain about who made that suggestion. I wouldn't want the record to state that you said that was a lie, because I don't believe it is in the testimony.
MR. MULLOY: I hope I didn't say that, sir. I hope I said "implied."
CHAIRMAN ROGERS: Maybe I misunderstood it. In any event, I thought the testimony was unclear about that, and I'm not sure it's all that relevant who asked for it. It's pretty clear that you and Mr. Hardy were very unhappy about the recommendation of the engineers.
As we understand it, the recommendation of the engineers was don't launch, and you expressed your displeasure. And somewhere along the line, they decided to have what seems like a five-minute recess, which
seemed very odd to me the first time I heard it. Why five minutes on a matter of such major importance? Why would anybody say, let's have a five-minute recess? I would have thought they would have had a five-hour recess on a matter of such major importance.
But in any event, I want the record to be clear. I don't believe there is any contradiction of testimony on that point.
MR. MULLOY: I hope that I have not said that I was upset by a recommendation not to launch. What I was challenging were conclusions that we're drawn. The recommendation not to launch or to launch at that time wouldn't upset me one way or the other.
CHAIRMAN ROGERS: But that was the whole purpose of the discussion, whether you would launch or not.
MR. MULLOY: Yes, sir, the end result would be that. But the purpose of the discussion was to understand the data and the logic of conclusions being drawn from those data, and that is the way I was working.
GENERAL KUTYNA: Mr. Mulloy, if in fact the criteria were 53 degrees, it would have an impact not only on this launch, but on the shuttle program. Can you describe the impacts that it would have had on the shuttle program as far as launches at Kennedy, at
Vandenberg?
It is a fairly important decision to say you can't launch below 53 degrees, isn't it?
MR. MULLOY: Yes, sir, I agree with that. I cannot describe the impacts, but, as I say, based upon our previous experience and our actions in flying subsequent vehicles after 51-C, I found that to be a surprising conclusion.
I did not assess what the long-term impact would be. I wasn't in a position to do that at that time.
[845] If I may continue-
MR. SUTTER: I would like to ask a question. Forgetting all of the testimony, what if it came out that there was a deficiency, that in the interest of meeting the launch criteria implied, which is don't launch until safe, if it came out 53 degrees you wouldn't launch, would you?
MR. MULLOY: I'm not sure I understand the question, sir.
MR. SUTTER: Well, this seal has had a history of being in trouble. There was a task force set up. There were memos written, there were test programs planned. The seal, to me, was very, very tender, and it was known to be very, very tender. At least some people
thought the situation was tender enough that, no matter what the conditions were for this launch, they said, you know, we will wait until the temperature is warmer.
So the launch criteria as written down would be violated, but under circumstances like that it would be. So I don't understand why we hang around the 53-degree thing. I think that seal was tender at 80 degrees maybe, depending upon how it was put together and the tolerances and what-not.
MR. MULLOY: I agree with you, sir.
MR. SUTTER: But then, instead of saying you have to wait until next April to launch, the thing that you do is you go and there were three different levels of improvements that were discussed. The thing to do then was to put those improvements in the program, not infer that these engineers are saying, we're throwing a ringer at you that says don't launch until next April.
I think that is putting those engineers into a little bit of a hot seat. And if they're trying to do their job and say, hey, we ought to do something about this, there ought to have been more attention paid.
MR. MULLOY: Yes, sir. I think we have testified there was a great deal of attention paid to that. Both Thiokol and we have testified there had been a great deal of attention paid to that, from the
Associate Administrator of Manned Space Flight down to the engineers at Thiokol, over the previous year.
And I agree with your conclusion, sir.
VICE CHAIRMAN ARMSTRONG: Could I ask you to speak a bit more to Dr. Walker's question, which in my view asked why wasn't there a Launch Commit Criteria on seal temperature? Why hadn't something bubbled up through the system that would indicate a more well-defined constraint on launch?
MR. MULLOY: I think that I have to go back over the year where all of the attention had been paid to the seal and the research that we have done and what considerations were being worked in the seal task force at that time.
And I have done some research on that and, starting with, again, starting with the next flight after 51-C and looking at the discussions, the tasks, the program that had been laid out by the Thiokol seal team in conjunction with our people, there just wasn't any great concern expressed about temperature during that time.
VICE CHAIRMAN ARMSTRONG: How about any other factors that might influence the seal constraints that were not currently in the LCCs? Was there anything else?
MR. MULLOY: Mr. Armstrong, I don't think anyone addressing the seal problem were conscious that they were working a Launch Commit Criteria problem. I think what they were working was trying to improve the margin in that joint and to reduce the incidence of blow-by and erosion.
I doubt that the engineers working that were thinking in terms of Launch Commit Criteria at all. They were trying to look at- they were doing testing, they were doing analysis, they were doing tests on putty, putty layup patterns. They were doing tests on alternatives to putty, they were doing tests on larger size O-rings, putting spacers in the joint to preclude the O-ring, the primary O-ring and the nozzle joints, from having to translate so far.
And I don't believe there was any focus at all on, we have to develop a Launch Commit Criteria for a joint.
DR. WALKER: Mr. Mulloy, yesterday there was a letter which was made public, which was written by Mr. Boisjoly to his superiors, which predicted that unless the seal problem was addressed a catastrophe was possible. And it's my impression that Mr. Boisjoly is the most knowledgeable engineer at Thiokol in regard to the seals.
Now, was any warning or flavor of that very serious letter transmitted to anyone at NASA, to your knowledge?
MR. MULLOY: No, sir, not that letter. And I guess I wouldn't have expected it to be. That is a correspondence that occurs between an engineer and perhaps his section chief, and I wouldn't expect that type of correspondence to go up the line.
GENERAL KUTYNA: Larry, I have a problem with that. You had a briefing in July that talks about resiliency, you've got a briefing in August at NASA headquarters that talks about resiliency of those seals as a number one concern.
Now, how can you say that wasn't transmitted to NASA?
MR. MULLOY: The memo.
GENERAL KUTYNA: I know the memo. But his concern is what Dr. Walker was asking.
DR. WALKER: Or the flavor of that.
MR. MULLOY: Yes, sir. I have looked back at that briefing. That is one of the things on the title sheet.
GENERAL KUTYNA: It's on the conclusion sheet: "Conclusions: primary concerns, resiliency." [Ref. 2/26-5]
MR. MULLOY: Yes, sir. And what I have looked
at in that report is for the substance behind that, and I can't find it.
MR. ACHESON: But wouldn't temperature automatically be critical to any elastomer which had a critical function?
MR. MULLOY: Yes, sir.
DR. RIDE: Do you think that there should be a Launch Commit Criteria on the seals or on the joint, as far as temperature goes?
MR. MULLOY: I would prefer to reserve judgment on that until we determine whether there should be or not.
DR. RIDE: I guess that is my point. There wasn't one, but it doesn't appear as though you have data to know whether there should be one or not and if there should be one what it should be.
[847] MR. MULLOY: That is a correct statement.
MR. HOTZ: Mr. Mulloy, could we go back for just a minute to page 4, to your conclusion, which reads: "The risk recognized at all levels of NASA management is applicable to STS-51-L in regard to the O-rings." [Ref. 2/14-2 5 of 7]
I have a little trouble with that, because in our testimony so far it seems to indicate that the risk on the cold temperatures and the O-rings was not
transmitted to the highest level of NASA. So how do you explain this conclusion?
MR. MULLOY: Yes, sir. I think the conclusion is the logic that George Hardy will go through in some more detail when he gets to his testimony, but the logic is related to the fact that we have redundancy at ignition, that the concern expressed for the cold temperature based upon the data would appear to be for slower seating of the primary seal, thus more blow-by, and in a worst case condition which would not be quantified, in which case the redundant secondary O-ring seal would seat and seal under worst case conditions.
MR. HOTZ: But was all this information transmitted up to Level II or Level I, to NASA management?
MR. MULLOY: All information- this information that was discussed on the night of January 27th was not transmitted beyond Dr. Lucas at the Marshall Space Flight Center.
MR. HOTZ: Thank you.
DR. WALKER: Mr. Mulloy, let me just clarify your response to one question. In regard to the comments made to Thiokol management by their engineers regarding the concern with the seals, do you think
Thiokol management discharged its responsibility to NASA in terms of conveying the proper level of concern to you and your colleagues at Marshall?
Should they have raised a larger red flag or did they act properly in giving you the briefings they gave you and alerting you to this problem?
MR. MULLOY: I think we had the attention of Thiokol management relative to putting a dedicated effort on improving the margin in the joint and reducing the incidence of erosion and blow-by. They responded to that by setting up the dedicated team in conjunction with NASA to work those problems.
They did transmit to us all the data through weekly telecons and through periodic meetings that was being generated by that task team in joint meetings, and the total content of the task team concerns is known to NASA.
I simply am saying, to my knowledge, that the effect of temperature never came across as the overwhelming and most important concern on that joint. What came across was the necessity to get a primary O-ring that would not have blow-by such that we wouldn't have erosion of the primary O-ring.
MR. ACHESON: As I understand your testimony, Mr. Mulloy, your argument, if I may call it that, on the
telecon with the Thiokol people was prompted not by your concern about the launch date, but by a feeling on your part that the data you were looking at to support their recommendation was not what you might call a thorough engineering job.
That is the sense I get from your testimony.
[848] MR. MULLOY: Yes, sir. It didn't hang together. It didn't hang together with all of our other experience and our knowledge, of which Thiokol engineers have tremendous knowledge about the operation of this joint.
MR. ACHESON: Did you have any feeling or apprehension that a delay of the launch date for reasons related to the propulsion system would reflect on you or the Marshall organization?
MR. MULLOY: No, sir. My decision to proceed with the launch as recommended by the Thiokol official responsible for making such recommendations was based solely on the engineering data presented by Thiokol engineering and the Marshall engineering evaluation of those data.
I can assure you, because I am absolutely certain, that no extraneous consideration, such as schedule, came into that decision process.
MR. ACHESON: Thank you.
CHAIRMAN ROGERS: Do you want to proceed with your presentation?
MR. MULLOY: Okay, sir. At the completion of the caucus, of course, Mr. Kilminster came back on the loop and stated they had assessed all the data and considered the discussions that had ensued for the past couple of hours and the discussions that occurred during their caucus.
CHAIRMAN ROGERS: Was it a couple of hours?
MR. MULLOY: Yes, sir. We started at 8:45 and I believe it was probably 11:00 o'clock before he came back on the loop. It was a long discussion. And I must emphasize that I had no knowledge of what interchange occurred during the caucus at Thiokol, because all sites were on mute. We were on mute at KSC. No communications occurred between myself and Mr. Hardy at Huntsville, nor did any communication occur between KSC and Thiokol during that caucus.
After Mr. Kilminster made that recommendation, Mr. Reinartz then asked if there were any further comments, and to my recollection there were none. There were no further comments made.
I then asked Mr. Kilminster to send me a copy of has flight readiness rationale and recommendation. The conference was then terminated at approximately
11:15.
I have no knowledge of, as has been testified, of Mr. McDonald being asked to sign that documentation. That would have been unusual, because Mr. Kilminster signs all flight readiness documentation.
Now, after the teleconference was completed, Mr. McDonald informed Mr. Reinartz and me that if the Thiokol engineering concern for the effect of cold was not sufficient cause to recommend not launching, there were two other considerations- launch pad ice and recovery area weather.
I stated that launch pad ice had been considered by the Mission Management Team
CHAIRMAN ROGERS: Excuse me. Could you identify that discussion, where that took place?
MR. MULLOY: That was after the teleconference was completed, after Mr. Kilminster made his recommendation, after Mr. Reinartz asked, are there any other comments. There were no other comments on the telecon from anyone.
CHAIRMAN ROGERS: And that ended; then there was another discussion?
MR. MULLOY: Yes, sir. Immediately after the teleconference was completed.
CHAIRMAN ROGERS: Who took part in that?
MR. MULLOY: Mr. McDonald stated to Mr. Reinartz and me that if the Thiokol engineering concern for the effect of cold was not sufficient cause to recommend not launching, there were two other considerations-launch pad ice and recovery area weather.
I stated that launch pad ice had been considered by the Mission Management Team before deciding to proceed and that a further periodic monitoring of that condition was planned. I further stated that I had been made aware of the recovery area weather previously and planned to place a call to Mr. Aldrich and advise him that the weather in the recovery area exceeded the Launch Commit Criteria.
So I stated earlier, when you asked what were the Launch Commit Criteria; one of them was that the recovery area weather has limitations on it. The report we had, that Mr. McDonald confirmed, was that we were outside of those limits.
Now, I must point out that that is not a hard Launch Commit Criteria. That is an advisory call, and the LCC so states that. It does require that we discuss the condition.
So at about 11:30 p.m., Mr. Cecil Houston established a teleconference with Mr. Aldrich and Mr.
Sestile at KSC. I informed Mr. Aldrich that the weather in the recovery area could preclude immediate recovery of the SRB, since the ships were in a survival mode and they were moving back toward Cape Kennedy at about three knots, and the estimate provided to us by Mr. Sestile was that they would be probably 40 miles from the SRS impact area at the time of launch, at 9:38; and then, continuing at three knots, it was going to be some period of time before they could get back and locate the boosters.
The concern I had for that was not loss of the total booster, but loss of the main parachutes for the booster, which are separated at water impact, and loss of the frustum of the boosters, which has the drogue parachute on it, which comes down separately, because with the 50-knot winds we had out there and with the kind of sea states: we had, by the time the recovery ships got back out there, there was little probability of being able to recover those.
I informed Mr. Aldrich of that, and he decided to proceed with the launch after that information. I did not discuss with Mr. Aldrich the conversations that we had just completed with Morton Thiokol.
CHAIRMAN ROGERS: Could you explain why?
MR. MULLOY: Yes, sir. At that time, and I
still consider today, that was a Level III issue, Level III being an SRB element or an external tank element or space shuttle main engine element or, an orbiter. There was no violation of Launch Commit Criteria. There was no waiver required, in my judgment, at that time and still today.
And we work many problems at the orbiter and the SRB and the external tank level that never get communicated to Mr. Aldrich or Mr. Moore. It was clearly a Level III issue that had been resolved.
DR. WALKER: Mr. Mulloy, could I just return for a moment to your conversations with Mr. McDonald. I believe yesterday he stated that he had a discussion with you about the meaning of the temperature on the Launch Commit Criteria of 40 to 90 degrees, whether it applied just to the solid bulk temperature or whether it applied to every element of the shuttle system.
Do you recall that conversation, and could you perhaps tell us your recollection of it?
[850] MR. MULLOY: Yes, sir. There was some discussion, that occurred, and I believe this may have occurred during the caucus, it may have occurred after. Mr. McDonald stated that we ought to at least get the joint temperature to 40 degrees. He indicated that at 40 degrees he would feel more comfortable with it,
because we had a spec that said that we had to be good from 40 to 90 degrees.
I didn't find that logic or that argument to be very logical at all, because based upon the data the engineers were recommending don't launch below 53 degrees.
CHAIRMAN ROGERS: Why is that not logical if he said, why don't you at least require a 40-degree temperature? And you say you didn't think it was logical. It seems very logical to me.
MR. MULLOY: Not on an engineering basis, sir. If one was concerned about the engineering data that said that at a temperature below 53 degrees we have an unsafe condition, there is certainly no logic for accepting that at 40 degrees.
CHAIRMAN ROGERS: Well, it's more logical than 30.
DR. RIDE: What are the solid rocket motors qualified to, what temperature, not the propellant?
MR. MULLOY: Okay. There are two specifications on temperature on the end item specifications to which the solid rocket motors are procured. The first specification states that the motor must be capable of providing a given thrust time trace within limits from zero to 200,000 feet at a temperature
of 40 to 90 degrees.
The second
DR. RIDE: And that is basically on the propellant, is that right?
MR. MULLOY: At a propellant mean bulk temperature of 40 to 90 degrees, for clarification. There is another requirement in the end item specification for the solid rocket motor, that states that it must be capable of meeting the natural environments that are specified in JSC document 07700, volume 10, appendix 10.10.
When you go look at that document, it has a number of environmental data in it. The one that is of interest here is the ambient temperature specifications for the launch site, which is then picked up in the Launch Commit Criteria that we discussed earlier.
In that volume 10.10, it states that it must be capable of operating at an ambient temperature of 31 degrees while being exposed to a five-degree sky.
Now, you have to get into heat transfer then to apply that to what the temperatures would be on the SRM.
DR. RIDE: So what you're saying is there was a spec that NASA imposed saying that the SRM should be qualified to launch at 31 degrees. Now, was that taken
into account in the qual test program for the SRM?
MR. MULLOY: Okay. We came into this discussion not as specific as I can present it to you today, but I have tried to go back and pick up most of the things that we discussed and what we were using in terms of qualification.
May I have the last SRB chart on the screen, please.
(Viewgraph.)
MR. MULLOY: The kinds of things we were discussing during the course of that telecon were what basis did we have for understanding what we would be good for in terms of temperature [851] on the joint. Now, I cannot say that all of these things were discussed, but I know some of them were.
What you will find, you will find a lot of room temperature tests up there at the top of the chart, which is the leak tests which are done on two field joints, the structural test article that was pressure-cycled many times, proof tests that were run to measure the rotation under pressure of the joint, a lightweight cylinder burst test that was done with an intentionally-damaged primary O-ring to assure that the secondary O-ring would seat, and it did.
There were 27 full-scale seal tests with an
O-ring groove damage tolerances, damage in the grooves and damage tolerance on O-rings. And then there were two cold gas tests.
And these data were presented on the night of the 27th. All of that was at ambient temperature. And then we did discuss what is the development qualification motor experience range, and that is shown on the chart. We had experience everywhere from 40 to 85 degrees.
There then were data presented on two cold gas tests at 30 degrees, where the O-ring was pressurized at the motor pressurization rate at 30 degrees, which would indicate that an O-ring would operate before joint rotation at 30 degrees.
DR. RIDE: Was that actually in a joint?
MR. MULLOY: No, it is not. It is a full-scale O-ring, full-scale groove, in a scaled test device, where the pressurize rate on that O-ring is zero to 900 psi in 600 milliseconds at a temperature of 30 degrees.
DR. WALKER: You would say, then, that the O-ring was qualified to a temperature of 30 degrees? Would that be an accurate statement?
MR. MULLOY: The data that we were looking at on the 27th were these two tests that indicated that it would perform at 30 degrees under the motor pressurization rate before the joint rotated.
DR. WALKER: What about, let's consider the putty and the O-ring, because that is really the system that responds to the pressure surge. What temperature was the putty/O-ring system qualified to?
MR. MULLOY: The lowest that I'm aware of- and we're still fleshing this out, because this is kind of what we talked about on the 27th, but the lowest that I'm aware of is the 40-degree test on one of the development motors.
DR. WALKER: And of course, during those tests the putty was modified before the test. The putty was not just laid up and then the seal made. The, putty was then smoothed out or some attempt was made to remove the
volcanoes, I think.
MR. MULLOY: Because the horizontal assembly caused that.
Now, there's one other significant point on this chart that we did discuss, that we didn't have the quantities on on the 27th, and I mentioned this earlier. We have 150 case segment proof tests, with a large number of joints with a simulation of a cold O-ring. That is the 90 durometer with a .275, and that was at about 35 degrees.
So those are the certification data that we kind of discussed, all of which we didn't discuss. The two cold gas tests we did, the segment proof tests we did, the development and qualification [852] motor tests we did, as a basis for understanding what we could expect to happen at colder temperatures on the joints.
DR. WALKER: Could we focus on the putty for just a moment? There has not been a great deal of discussion about its response to the cold temperatures, but it is an elastic substance as well. In fact, I am a little surprised that there was not more discussion in your telecon about the effect of the cold temperatures on the putty.
Was that in anyone's minds, and what data did you have to allow you to extrapolate the behavior of the
putty at these lower temperatures?
MR. MULLOY: Well, I don't recall a discussion of the effect of the cold presented by Thiokol or discussed by anyone- perhaps George does- in the teleconference on the 27th.
DR. WALKER: What about the effects of moisture on the putty? My understanding is that the putty does not respond well to moisture, and I guess it had been raining. Was there any discussion of that?
MR. MULLOY: No, sir.
CHAIRMAN ROGERS: Mr. Mulloy, I want to let you finish, but let me tell you what troubles me very much. I see the charts and I have heard your presentations before, and I recognize your expertise and knowledge in this field.
What is troubling, very seriously troubling, is why, if this is such a convincing matter to you, you are certain of these things, you are sure it's okay, how come then in a matter of such major importance, involving lives of seven astronauts, you apparently we ' re not able to convince any of the engineers at Thiokol who were working on this on a daily basis that you were right?
MR. MULLOY: Sir, I was not aware that they were not convinced. I had no knowledge of what went on
in the 30-minute caucus at Thiokol, and when asked- when Mr. Reinartz asked, are there any other comments, there were none.
CHAIRMAN ROGERS: Now, would your opinion have changed if you had known all of the engineers or substantially all of the engineers at Thiokol took another position and were opposed to the launch?
MR. MULLOY: Sir, I cannot speculate on that my decision would have been given certain other data.
CHAIRMAN ROGERS: Well, why can't you right now, based on the knowledge that you gleaned yesterday from the testimony, why can't you say whether you would have been influenced one way or the other by the fact that all of those engineers seemed to be opposed to the launch?
MR. MULLOY: Well, I would like to answer your question, sir, except that that is so foreign to the way that NASA does business that I would have to think a long time about an answer to that question.
CHAIRMAN ROGERS: I'm not trying to put you on the spot, but we're checking on the particular process. We're checking on the decisionmaking process. Now, in the process we have the manufacturer or the engineers of the manufacturer who were working with this on a regular basis, testifying they were all against the launch.
And we have testimony that management took over and made the decision contrary to the advice of the engineers. Now, the question is, if you had known that would it have made a difference? Was the process a total failure, so that you and Mr. Hardy and others didn't know that at all?
MR. MULLOY: No, sir. I presume if Mr. Boisjoly or Mr. Thompson or Mr. Lund said, look, we have a unanimous opinion here that it is unsafe to launch the 51-L vehicle, that would have influenced, obviously, the decision that I would ultimately make.
CHAIRMAN ROGERS: Leave out the word "unanimously". Suppose it's 80 percent of the engineers. Wouldn't that h