CHAIRMAN ROGERS: I will call the Commission to order, please.
The first witnesses this morning will be Mr. Mulloy and Mr. Hardy. Will they please come forward.
(Witnesses sworn.)
CHAIRMAN ROGERS: Welcome, gentlemen. Will you begin by identifying yourselves and giving a little background of the experience that you have had with NASA and your present assignment? I assume that you have some information you want to start with this morning.
Which order do you want to go in?
MR. HARDY: I believe Mr. Mulloy will go first.
CHAIRMAN ROGERS: Thank you. Proceed.
MR. MULLOY: Mr. Chairman and members of the Commission: [Ref. 2/14-2]
I am Larry Mulloy. I am currently the manager of the space shuttle solid rocket booster program at the Marshall Space Flight Center. I joined NASA in 1960. 1 worked as a loads and dynamics analyst, and then in the Apollo program I worked in the structural subsystem area of the second stage of the Apollo program.
Subsequent to that, I was on a leave of
absence for a year for some postgraduate work, doing doctoral studies in public administration; and subsequent to that I was assigned as the chief engineer of the external tank project at the inception of the space shuttle program. I held that position until approximately 1979, and then I was the chief engineer for NASA on the inertial upper stake in conjunction with the Air Force until 1982.
In November of 1982, I was assigned as the project manager for the solid rocket booster program. I have a B.S. in engineering from Louisiana State University, a master's in administration from the University of Oklahoma, and, as I previously stated, some postgraduate work in administration at the University of California.
CHAIRMAN ROGERS: Mr. Hardy.
MR. HARDY: Mr. Chairman, members of the Commission: [Ref. 2/26-1]
My name is George Hardy, and I am currently the deputy director of science and engineering at the Marshall Space Flight Center.
I joined Marshall in 1960. I served for a number of years as project engineer on the Saturn 1B booster. I later served as an assistant program manager on that program.
From about 1967 to 1974, I was in charge of program engineering and integration on the Skylab program. In 1974 1 became project manager of the solid rocket booster and served in that [827] position until 1982. Subsequent to that, I served in the position as associate director for engineering in the science and engineering directorate.
I graduated from Georgia Institute of Technology. After approximately six years service in the Navy, I was employed by the Army Rocket and Missile Center.
CHAIRMAN ROGERS: Thank you.
May I ask the still cameras now to take your pictures, and then during the testimony I would ask you to refrain from making shots. It is distracting to the witnesses to have so many shutters clicking each time. And so if you want a period now of taking stills, go ahead, and then I would ask you not to do it during the testimony.
(Pause.)
CHAIRMAN ROGERS: It's not that we object to you taking pictures. We want this to be an open hearing. But with all of the clutter and all of the shutters clicking at one time, it's awfully distracting and unfair to the witnesses.
Okay. Mr. Mulloy, will you proceed?
MR. MULLOY: Yes. Mr. Chairman and members of the Commission, yesterday in the testimony that was given before this Commission, and before that I think in more dramatic statements that have been attributed to Thiokol personnel by the media, a picture has been painted of the events of January 27th that I think at best may be misleading.
Mr. Chairman, with your permission, I would like to state the facts of the events of January 27th, beginning with the 8:45 telecon. I believe there has been a great deal of testimony as to the events leading up to the 8:45 telecon and, with your permission, I would like to begin at that point.
CHAIRMAN ROGERS: Yes, you may, Mr. Mulloy. We want you to feel free to present any evidence that you would like to and as long as you would like to. We will hear anything you want to say.
MR. MULLOY: Thank you, sir.
I previously testified to the flight readiness review process leading up to the launch minus one day review at Kennedy Space Center on January 26th, '86. I have stated how this continuing concern for joint O-ring erosion had been treated in flight readiness review process and all of the events leading up to the decision
on the 51-L launch.
I would like to now begin with the 8:45 telecon. After being notified of that and arriving at the resident office at the Kennedy Space Center and halving the data that had been telefaxed in from the Utah plant
CHAIRMAN ROGERS: Was that the first time you considered the weather aspects of it?
MR. MULLOY: Oh, no, sir. We-after we stood down from the launch on the 27th at 1:00, I and Mr. Reinartz, Mr. Reinartz polled all elements of the shuttle system for which he is responsible, the SRB, the external tank, and the space shuttle main engines. And I had a discussion on my SRB loop with the SRB people dealing with the question of a 24-hour turnaround to attempt to launch again at 9:38 on the 28th and the effect that the predicted cold temperatures for the night of the 27th might have on that.
The input was received back both to Mr. Reinartz and myself that we were looking at the Launch Commit Criteria relative to temperatures. It was felt there was a need to look at the recovery battery temperatures that are in the forward skirt of the SRB and the fuel service module temperatures that are in the fuel service modules for the thrust vector control
system in the aft skirt of the solid rocket booster.
The input received back by me was that they did not feel that would be of any concern. They were going to continue to look at it, and if any concern arose they would let me know.
I went to the 2:00 Mission Management Team and reported that there were no constraints to the solid rocket booster for a 24-hour turnaround, that we had taken a look at the recovery battery temperatures and the fuel service module. We did not feel at this time that there would be any Launch Commit Criteria for the low temperature limits that were established for those systems, but that we were continuing to assess that; should anything change in that regard, I would so report that.
CHAIRMAN ROGERS: You referred to the Launch Commit Criteria. What were they as far as you knew in terms of weather conditions? Any?
MR. MULLOY: In terms of weather conditions, yes, sir, I'm aware that there is a Launch Commit Criteria for the system for weather. There are a number of factors in that Launch Commit Criteria. One of them is the ambient temperature, which is established at 31 degrees.
Another is the sea state and winds in the SRB
recovery area. Another is the cross-winds at the return to landing site runway at Kennedy Space Center. Another is the trans-Atlantic landing site weather, and another is severe weather, which is related to lightning and thunderstorms in the area.
CHAIRMAN ROGERS: And when you say there were no constraints in the 2:00 meeting, does that mean that as far as you could see there were no problems in those areas?
MR. MULLOY: No, sir, I did not evaluate those areas of the Launch Commit Criteria. What I was looking at was the specific Launch Commit Criteria items that are on the solid rocket booster and the effect that the low temperatures would have on that.
I would expect Mr. Aldrich would normally make the judgments on, and his people at Johnson Space Center, would make the judgments on crosswinds and trans-Atlantic weather and the general ambient environment for launch.
CHAIRMAN ROGERS: Just so the Commission has a little better idea, at least I have a better idea, of what you would discuss at the 2 o'clock meeting, would you say, well, we don't know what the weather's going to be like tomorrow, we will have to look at it as we go along, or would you say, we're not sure what the
seas are going to be and whether we can recover?
What type of discussion was it? I have a little problem following when you say no constraints, and it is the language that I don't quite follow.
MR. MULLOY: Yes, sir. The discussion centered around the conditions that the launch pad would be exposed to during the night, particular attention to freezing of the water system on the pad, freezing of the water in the sound suppression devices that are filled with water at the base of the pad, concern for the formation of ice on the pad, which could cause potential damage to the shuttle vehicle, with primary concern for the orbiter tiles in that case, and I believe for the insulation on the external tank.
Some other discussion, I believe, about the predicted weather for the landing sites, trans-Atlantic landing sites, and the predicted weather for the local weather for KSC.
None of those discussions or the considerations of those discussions posed any constraint to the solid rocket booster.
[829] CHAIRMAN ROGERS: "Constraint" meaning that at that point you thought it would be okay to launch the next day, but you couldn't be sure because those things might change?
MR. MULLOY: Yes, sir. Based upon the weather conditions that were being looked at at the time and based upon the concerns that were being addressed at that time, I saw - and with the commitment that we were going to continue to look at the weather through the night and then assess that in real time in the morning, which is actually what was done, and the launch was delayed because of the ice on the pad and getting some ice out of the sound suppression blankets.
CHAIRMAN ROGERS: Okay, will you proceed? So at the 2:00 meeting you felt that, although there were problems that might exist the next day, that you felt that those problems probably could be overcome and you could be able to launch?
MR. MULLOY: Yes, sir, I was confident that the only thing that would violate Launch Commit Criteria on the solid rocket booster at that time were a potential violation of the recovery battery low temperature and the fuel service module low temperature.
And as further analysis was done in the afternoon, the initial assessment of that was upheld and we did predict no violation of those Launch Commit Criteria.
CHAIRMAN ROGERS: And at that point the
O-rings and the seams and so forth were not discussed?
MR. MULLOY: No, sir, they were not.
I subsequently learned that my- and it was testified to yesterday, I believe, by some of the Thiokol people. I subsequently learned that my solid rocket motor element manager, who was at the Huntsville operations support center supporting the launch, did communicate to Mr. Boyd Brinton, who is the project chief engineer for the solid rocket motor for Morton-Thiokol, that the query had come, did we have any constraints for a turnaround.
That had been relayed to Mr. Brinton, who then called, I believe, Mr. Ebeling, it was testified to, at Thiokol in Utah, to begin to look into that. And that led into the events.
CHAIRMAN ROGERS: And what was the man's name you referred to? You said your man?
MR. MULLOY: Mr. Larry Wear. He is my solid rocket motor element manager. I have a solid rocket motor element manager and I have a booster assembly element manager for the other aspects of the solid rocket booster other than the motor.
CHAIRMAN ROGERS: Okay, proceed. I'm sorry to interrupt you.
MR. MULLOY: Okay, sir. When we got the
charts containing the Thiokol engineering data and the conclusion that Thiokol was drawing from those data arrived at KSC and Marshall- began arriving at about 8:45, when the conference began.
We went ahead and began the conference, but the, conclusion and recommendation charts that Mr. Lund subsequently testified to yesterday did not come in until somewhat later. I don't know exactly when they were there, but when we started into the telecon and began discussing the data we did not have those conclusions and recommendations.
We were simply looking at the engineering data and reviewing those engineering data. The concern, of course, that was being expressed was for the low ambient temperatures that were predicted for the night and the effect those low ambient temperatures would have on the propellant mean bulk temperature and on the joint particularly.
[830] If I could have chart SRB-6, please, on the screen, I would like to clarify. When we talk about temperatures
(Viewgraph.) [Ref. 2/26-2]
-we have a number of them. These specific temperatures don't represent any particular condition on STS 51-L. What we are showing there is the ambient
temperature at pad B is at ground level, and it is about 50 feet away from the pad. For example, that temperature, as an example, might be 36 degrees at ground level.
Then there is a local ambient temperature- and we will provide hard copies of this, sir, for you later. The local ambient temperature is referred to as in the vicinity of the solid rocket booster, that local ambient temperature will be in a tank condition. It will be below the general ambient because of the effects of the cryogens in the external tank and the heat short that exists through the to the attachments SRB and the wind blowing the cold air around the SRB.
That, for example, might be 30 degrees, while you have a ground ambient of 36 degrees.
CHAIRMAN ROGERS: "Ambient" means outside?
MR. MULLOY: Yes, sir.
CHAIRMAN ROGERS: Outside temperatures?
MR. MULLOY: Yes, sir. The ambient temperature at a point here in this room will be slightly different than the ambient temperature at a point back there by those lights.
But the ambient temperature, it doesn't have to be outside. It could be the ambient temperature of the body of this room or a body of air in this room.
Then the local ambient is affected by the proximity of heat sinks that are around the solid rocket booster and the wind blowing around that. At that same time, you might have a joint temperature or a temperature right at the field joint that is lower than the local ambient, and that will occur because the local ambient and the ambient temperature has been lower possibly three or four hours earlier, possibly say 18 or 20 degrees. And due to the lag, the local ambient and the ambient may be coming up, but the steel parts are still cold, and so you may have a joint temperature of 27 degrees.
And then when we speak of the propellant mean bulk temperature, that is the average temperature of all the particles of the propellant in the motor taken- it is an average of from the outside, inside. There is a slight gradient through that. That may be 57 degrees, because that is a large heat sink, and if it was 60 or 70 degrees three or four days before, or say 70 degrees, the temperature can get very low and that propellant mean bulk temperature doesn't track that.
And so I just submit that for some clarification. The concern that we were talking about was for the effect of the overnight low on the propellant mean bulk temperature and the effect that it
would have on the joint and the seals and the performance of those joints and seals.
The Thiokol engineers were stating that they believed the effect of that lower temperature on the O-rings would be to slow the time for the primary O-ring to seal, resulting in greater hot gas past the primary seal and possibly erosion of the secondary seal. The data that they showed included the previous coldest launch, which was STS 51-C, which they stated at least qualitatively had the worst blow-by of any previously observed.
[831] Considerable discussion between Marshall and Thiokol on the significance of those data then ensued. There was at that time- we still didn't have conclusion and recommendation charts. All we were trying to do was understand what the data were telling us.
The major focus of that discussion was the effect low temperatures could have on blow-by of the primary O-ring seal.
Now, if you bring up chart SRB-3, I think at this point it might be helpful to graphically show again the configuration of the joint.
(Viewgraph.) [Ref. 2/26-2 3 of 3]
When we were assessing- and if you could
scale that down and focus on the left side first, if you would, please, and get the title in.
Okay. We will go from the upper left corner, down the column, and then back up to the right. In the initial condition, the joint is assembled and it has squeeze on the O-rings. What we have been talking to is the O-ring is actually compressed into that joint.
In the specific conditions of STS 51-L, that compression far exceeded the minimum compression required. The compression on the particular joint that has been of interest to us has been 38-thousandths to 40-thousandths, where the minimum requirement is 20-thousandths.
In that initial condition, you have redundant seals, the primary on your left and the secondary on your right.
If you would move down in the left column now.
MR. HOTZ: Mr. Mulloy, may I interrupt you for just a moment. Now, what is the time element there in making that leak check?
MR. MULLOY: That leak check, sir
MR. HOTZ: What day and what calendar day was it made?
MR. MULLOY: I believe it has been reported
that it was about 28 days before the attempted launch. It was about the 1st. But when it is made is when the joint is assembled.
MR. HOTZ: Before it goes out to the pad?
MR. MULLOY: Oh, yes, air. As we assemble each SRM joint, before we put the next SRM segment on we leak check the previous one. In the event that you don't pass the leak check, you have to de-mate and do it over again. So we don't run up the whole stack and then leak check all the joints.
We build it up from the bottom and check each joint as it is assembled.
MR. HOTZ: So it would have been at least 28 days before the launch?
MR. MULLOY: Yes, sir.
DR. COVERT: Mr. Mulloy, may I ask a question, please? You said that there was plenty of squeeze in the O-ring. What temperature would you say that that squeeze referred to?
MR. MULLOY: Okay, sir. In that initial condition, that referred to an ambient condition of 75 degrees. The consideration that was given during the course of the discussion is how much would that squeeze be reduced as the temperature was reduced to 20 degrees?
That was calculated and it was 3-thousandths of an inch. That occurs for two reason: the diametrical shrinking, as well as the stretching of the O-ring as it is chilled.
DR. COVERT: Your 38- to 40-thousandths then would go 35 to 37?
MR. MULLOY: Yes, sir, that is correct.
[832] DR. COVERT: At 20 degrees.
MR. MULLOY: At 20 degrees, I believe is the temperature that was calculated at.
DR. COVERT: Thank you, sir.
MR. MULLOY: Okay. Then when we do the leak check, the O-rings are then displaced as shown in the second diagram down in the left column. It pushes that primary O-ring back toward the motor pressure side. It pushes the secondary O-ring back against the surface against which it will subsequently seal, if called upon to do so, by any pressure from motor operation impinging on it.
If you will go to the third one in the left column, please. Then, after you take the pressure off- this pressurization is 200 psi initially, to be sure that the O-ring is pushed up against that gap, and then that pressure is reduced. That is with an open source, just turning, opening the valve and letting it flow as
much as it will, because you will get some blow-by initially in moving that in the pressure check. Then that is reduced to 50 psi and held, and the spec ion that is one psi allowable leakage in 15 minutes. That is with a closed source. It has to hold the pressure between the regulator, the valve on the pressure source, and flow by the seal.
Now, when that pressure is taken off there is some relaxation. Those O-rings don't stay smashed up against that gap, as they were shown when you had the 200 psi.
If you will go to the center column in the top, please.
Now, during motor operation there are two things that can occur. The first is where the primary seal is actuated. Initially in the initial pressurization, as was testified to yesterday, from zero to about 170 milliseconds, which equates to about 200 psi, there is no significant joint rotation.
We have test data, and I believe the engineers stated yesterday, there is a knee in there and it is not linear. It is not linear with pressure. You don't get one-third of the rotation at 200 psi. You get less than one-third, and then it tends to ramp up due to the stiffness of that joint.
So when the motor is pressurized at about 30 psi, which is 50 to 60 milliseconds, that primary O-ring is translated across from the forward face of the groove to the face that it wants to seal against. We have shown in tests that an O-ring will seal or seat and begin to extrude into the gap at 30 to 50 psi.
Go to the center on that center column, please.
Now, what happens at about 200 psi, again joint rotation is not a significant factor here. You may got 2- to 3-thousandths of joint rotation at a in maximum in this kind of a condition. The pressure is impinging there and beginning to extrude the primary seal into the gap.
Go to the bottom of that center column, please.
Now we get the joint rotation. Tests have shown that a good O-ring with a durometer of 90 even- and our spec on the O-ring is 75. This is the sponge. and brick analogy that was used by one of the engineers yesterday. I think that is a little dramatic in describing the change in that O-ring stiffness in going from 75 to 90.
But it has been shown that the O-ring will extrude into that gap and seal.
Now, if you will go to the top on the right, please. Another condition that can happen, the reason we have redundant seals, here at the moment of motor ignition the system is redundant. If for any reason the primary seal does not seat-it is damaged, it has a twist in it, it has a void [833] in it or whatever- the primary seal does not seat, the pressure actuation is now taking place on the secondary seal. That is where the redundancy is, in zero to 170 milliseconds.
Go to the center, please.
Now, that continues, and what happens to the secondary seal is exactly what happens to the primary seal. The primary seal has failed to function, the redundant seal is performing its function at 200 psi.
DR. WALKER: Mr. Mulloy, can I ask a question about that? Would you in your discussion also include your understanding of the waiver and what that meant in regards to how you could consider whether or not the secondary seal was really going to operate?
MR. MULLOY: Yes, air, I had planned to do that later, but I will just answer that now. My understanding of the waiver is the design goal on the shuttle was to have redundant systems. That design goal is not met in all systems. There are some 829 Crit 1s waivers on the shuttle system. There are 213 Crit 1
waivers on the SRB.
This particular waiver is one of IS on the solid rocket motor. Now, my understanding of that waiver, it is required because we have defined a condition under which the secondary seal may not form a seal, and I emphasize "may not."
MR. SUTTER: Could I ask a question, please? Are all of these waivers of equal importance, or of all of these waivers which do you think is the most important?
MR. MULLOY: We are assessing that now, because we're going back and looking at all of the Crit 1s. At the time that the Crit 1s were established, they were all considered to be loss of life and loss of vehicle should that system fall.
I think the question you're asking me is, what is the probability of failure and what is the experience with the system that would say, well, this one is more likely to fail than the next one and the next one, and put a priority order on those. I am not at this point prepared to say that, of the 18 critical systems on the SRM, that an igniter, for instance, is more or less critical than a seal.
But we are assessing that, and the way you have to do that is look at our experience with that.
DR. WALKER: But you did have a task team working on this particular problem?
MR. MULLOY: Yes, air.
DR. WALKER: Did you have task teams on any of the other problems?
MR. MULLOY: Yes, air. Yes, air, we did. As a matter of fact, on the nozzle we had, as has been related, on STS-8 we found that we were getting some very unusual nozzle erosion. We applied a task team to that to solve the problem, and that is a Crit 1 item. Burn-through of the insulation on the liner of the nozzle is loss of mission and crew.
And yes, we had a task team working on that. And really, on the SRM, those are the two that had very equal importance, really, because the criticality- in answering your question, air, those two, they would be a real foot race as to which one we would have considered more critical, depending upon the particular time that you looked at your experience with that.
If you'd asked me that question a year and a half ago, I would have definitely said the nozzle.
CHAIRMAN ROGERS: It sees to me, though, that based upon the testimony yesterday, and what I think you're leading up to here, is that the argument is being made that this should have been Criticality 1R. You're
arguing there was a redundancy in the item and the item itself says there isn't a redundancy, that you have to operate on the basis of Criticality 1; if there is a single failure, it is a loss of life and loss of crew.
MR. MULLOY: Yes, sir, but if you read that total document, which perhaps you have, what it says is under worst case conditions it can be Criticality 1.
CHAIRMAN ROGERS: Wasn't this a pretty bad case, with the weather and all of the alarms that you had, and the recommendations from the engineers at Thiokol? Wasn't this what seemed like a pretty dangerous situation?
MR. MULLOY: It did not seem that way to me then, sir.
Now, if I may continue and answer the question about what the CIL applies to, it says under certain conditions you may have a single point failure. It very carefully says "under certain conditions."
Mr. McDonald testified yesterday- and I cannot assert to the factualness of what he stated, but what he said was, in reality we have never had that worst case condition where we actually flew Crit 1, except on one motor, which was one joint on STS-4. Now, we're looking at that.
I think that certainly is closer to the case
than we have had Crit 1 on everything except one motor, and the reason it is is because you look at the squeeze that you actually have, given the dimensions that you actually have, and you look at the worst case rotation that can occur under that condition, and that worst case rotation does not result in a secondary seal unseating such that if the primary seal fails the secondary seal will work. Therefore, it is redundant.
DR. RIDE: Does that calculation take into account the out-of-roundness of the segments, the calculation on the squeeze?
MR. HARDY: Yes, it does. If I could make
DR. RIDE: I would just like to ask whether when you did this calculation for 51-L, which it looks like you did on the 27th, to find out how much squeeze you had on the O-rings, whether you actually did take into account the out-of-roundness on the segments, calculating the squeeze?
MR. HARDY: Yes. Those calculations, Dr. Ride, were made prior to the 27th meeting, but the out-of-roundness is taken into account. The rounding of the three cylinders, if I could describe it that way, you've get inner leg and the outer leg of the clevis, and then the tang itself.
The rounding of those cylinders, which occurs
at relatively low pressures, is also taken into account.
I would like to mention one thing, if I could read from one place in the critical items list regarding this waiver, I think it clearly describes my interpretation of the waiver, and I don't choose to get into a discussion with somebody else's interpretation. But there is a note that says leakage of the primary O-ring seal is classified as a single failure point due to the possibility of lose of sealing at the secondary O-ring because of joint rotation after motor pressurization. [Ref. 2/26-3]
And I am personally aware of the facts that drove the submission of this waiver, and it was clearly associated with the fact that after motor pressurization, after it's been through the ignition transient, you can have a stackup of tolerances on the metal parts and the O-ring which indeed would not- under which case you would indeed not have a redundant seal.
[835] CHAIRMAN ROGERS: Let's stick with that language, because it seems to me that goes right to the heart of it. Read it again. And as I read it, it means that if the primary seal fails that the mission will fail. Am I wrong?
MR. HARDY: That is not my interpretation.
CHAIRMAN ROGERS: Well, let's read it. "Loss of mission" - this is actual loss. "Failure effects summary. Actual loss. Loss of mission, vehicle and crew due to metal erosion, burn-through, and probable case burst, resulting in fire and deflagration." Now "Note, leakage of the primary" -and this is the part that I want to refer to.
"Leakage of the primary O-ring seal is classified as a single failure point "-" as a single failure point "-" due to possibility of loss of sealing at the secondary O-ring because of joint rotation after motor pressurization."
Now, that suggests to me that the critical items list says that if the primary O-ring seal fails, that you have got a good probability that the mission will be a catastrophe. Am I wrong about that?
MR. HARDY: You are not wrong, if I might put my clarification into that, if the primary O-ring fails after motor pressurization, after joint rotation.
CHAIRMAN ROGERS: I guess what I'm saying is, isn't that a possibility of exactly what happened in this launch?
MR. HARDY: I don't believe so.
CHAIRMAN ROGERS: Why?
MR. HARDY: Well, I will elaborate on that a
little bit later here. But in the considerations, at least in the considerations of the subjects at hand, relative to the discussion on the 27th, the discussion on the 27th had to do with the possibility of the cold temperature delaying the complete actuation of the primary seal, thereby extending the duration of blow-by.
Now, when we talk about blow-by of the primary seal, blow-by has to go somewhere, and where it goes to is the secondary seal. If blow-by occurs as soon as the pressure gets to the primary seal, early in the ignition, and that seal doesn't sustain that pressure, it goes immediately to the secondary seal, prior to the time that the joint is rotated.
CHAIRMAN ROGERS: This says "possibility of the loss of the sealing of the secondary O-ring."
MR. MULLOY: After the joint has rotated, sir. The condition that is on the screen now is before joint rotation.
DR. WALKER: But I think a critical and a literal interpretation of that waiver has to be that the primary seal is a single point failure. Now, the wording goes on to explain why this is so, but the wording does not make an exception. It merely explains why the single point failure mode refers to the primary
seal.
But a strict interpretation of that wording to my mind is that the primary O-ring is a single point failure.
MR. HARDY: I wouldn't deny that. I am relating to what many of us knew about the performance of that joint, its rotation, when we lost-when we could lose, because of the stackup of [836] tolerances, when in the ignition transient prior to full motor pressurization or after full motor pressurization when we could lose that secondary seal.
Our interpretation or my interpretation of the waiver was not to remove the secondary seal from the hardware.
DR. RIDE: It seems to me that really crucial to all of this is the timing function and how quickly you think that the primary will seal, whether it's in that first 160 milliseconds or whether it's not. And if it is not, then you run the risk of getting into the period where joint rotation is more likely.
I guess what I wonder about is the data that you've got to show how the timing function changes at low temperature, because it is certainly going to be a function of the temperature,
just because the O-ring is different and it is behaving differently. It is
deformed in some way.
And it is not clear to me that you've got the data to say that, to discriminate at the level of
milliseconds, which is what you are really doing, and to apply engineering judgment based upon really not very much data, and applying that engineering judgment to a Criticality 1 case.
MR. HARDY: Well, I will comment on part of that and maybe Larry would like to comment, too. I would like to clarify and emphasize, if it is not clear, that this seal performance of the primary and secondary seal in the early part of the ignition phase, it is not a step one, step two.
Step one and step two occur simultaneously, meaning that if I get blow-by the primary I am pressurizing the secondary. So it is not a situation where I get blow-by the primary and that extends for some period of time and during that period of time the joint rotates, and then I call on the secondary seal.
I can't have blow-by the primary unless I am trying to pressurize the secondary seal. So it is not a situation where for some number of milliseconds I've got blow-by the primary and then later I call on the secondary seal. I am calling on the secondary seal to function the instant I get blow-by the primary seal.
DR. RIDE: I think that Mr. Boisjoly described it very well when he said that it is kind of a race. Although you've got blow-by past the primary and the secondary is presumably holding at that point, the race is between the erosion that is occurring on the primary and its attempt to seal.
So it is whether it seals first or erodes first.
MR. HARDY: Which erodes first, Dr. Ride?
DR. RIDE: The primary.
MR. HARDY: Well, if I have initiated- early in the ignition transient phase, if I have initiated a sealing of the secondary seal, subsequent erosion on the primary seal is not of interest.
DR. RIDE: Well, it is if the primary erodes to the point that when joint rotation occurs then you no longer have the secondary.
MR. HARDY: The secondary seal will seal- if the secondary seals at the pressure that it is supposed to seal, and there have been tests run at 30 degrees that indicate that the seal- that a seal will in fact form an extrusion seal.
If that occurs, then subsequent joint rotation, which occurs on every primary seal that ever
seals, that will not cause you to lose that seal. And
it is because of the extrusion of that O-ring into the extrusion gap.
[837] Again, let me re-emphasize, every time the primary seals on a joint early in the ignition phase, that joint, the primary seal, the rotation of the joint is greater on the primary seal than it is on the secondary seal.
So every flight demonstrates the fact that once you initiate an extrusion seal, subsequent rotation of the joint does not affect that seal.
DR. WALKER: But if you have a situation where the rotation begins to occur even after the seals have been made, is this not where temperature is truly critical and where the tests carried out at Morton-Thiokol measuring the response of the seals as a function of temperature should have been very critically considered, because now at lower temperature the seal is going to have a harder time following the movements of the metal parts?
MR. HARDY: I can assure you that that particular characteristic will be thoroughly examined. It is being thoroughly examined. My assessment on the night of the 24th and in fact today is that if I properly extrude that seal into the sealing gap and have the forcing pressure behind it, that the temperatures of interest
would not have any effect on losing that seal as it goes open.
The key factor which I think many of you have determined, and I agree with you, the key factor is whether or not the initiating pressure on the primary occurs early in the ignition transient. And that was my knowledge at the time, the 24th and I believe that to be- or the 27th- and I believe that to be the knowledge of everybody participating in that meeting, because there was no discussion to the contrary that I'm aware of
GENERAL KUTYNA: Mr. Hardy, Ben Powers, one of your engineers, did have an opposite view on that. How did you rationalize his concern?
MR. HARDY: If I may, I'm a little out of sequence here. If I may, when I get into my statement I will address that.
VICE CHAIRMAN ARMSTRONG: I would like to ask a question specifically with regard to the joints on 51-L. Based upon your analysis of the measurements that you have on those joints, would you expect that after full flight pressurization of the motor you would have a secondary seal?
Or, to put it in another way, do you think on these joints you had a Criticality 1 or a Criticality
IR?
MR. MULLOY: Given the temperature?
VICE CHAIRMAN ARMSTRONG: Given everything you know about it at this point in time.
MR. MULLOY: And the known resiliency. It would be my judgment that, with the resiliency data that was presented on the 27th, that that would be a condition where the secondary seal may not function.
MR. HARDY: After joint rotation.
MR. MULLOY: After joint rotation.
VICE CHAIRMAN ARMSTRONG: So, to just repeat that, in this case we might have a single seal failure, namely the primary seal failure after motor pressurization, that could cause a problem of the kind we are investigating.
MR. MULLOY: Yes, sir. That is the condition that, is recognized in the CIL. If I may go to the chart on the bottom, I would like to explain that further, sir.
[838] CHAIRMAN ROGERS: It seems to me that that question and answer become extremely important. Let's be sure that the record is clear on that. I thought Mr. Armstrong's question went right to the heart of the matter, and I'm not sure that I understood the answer.
Is it possible to read that back'?
THE REPORTER: "Specifically with regard to the joints on 51-L, based upon your analysis of the measurements that you have on those joints, would you expect that after full flight pressurization of the motor you would have a secondary seal? Or, to put it another way, do you think on these joints you had a Criticality 1 or a Criticality IR?"'
CHAIRMAN ROGERS: Could we get an answer just to that one? Was that Criticality 1 or Criticality 1R?
MR. MULLOY: Yes, sir. It was our judgment that we were redundant at ignition. As Dr. Ride has pointed out, there was a timing function. We did not conclude on that night that the primary seal would not function and seal. That was inconclusive.
If under the conditions described, if the primary seed did function and seal, then we have joint rotation, then the primary seal subsequently fails, I believe the question was that, under the conditions of temperature, would you anticipate that you had a worst case condition wherein the secondary seal would not be in a position to energize.
I said that may be the case. That may be the case. It has not been shown- what we had was resiliency data that says that the metal under rotation lifts off the seal. It has not been shown that that seal would not function under that condition.
MR. HOTZ: Mr. Mulloy, in the interest of
clarity, could you just simply state, was it 1 or 1R?
MR. MULLOY: It was 1R, sir.
MR. HOTZ: Thank you.
MR. SUTTER: Could I ask a question, please. I get a little confused. It was my understanding yesterday when the question was asked to transmit data to Kennedy, I asked what was going to be done with the data, was it going to be analyzed so that Kennedy could make a decision? And the answer came back: Well, no decision had been made at that point, and so it was just for information.
But yesterday the impression I got is that the engineers at Thiokol reached a conclusion and, whether it was right or wrong, their conclusion was wait for a warmer temperature. Then the management of Thiokol, as I remember it, reversed that condition to say, go ahead and fly, forget the temperature.
This presentation seems to be another analysis maybe justifying why the decision to fly was all right. Now, if somebody was in charge of this launch- now I see three parties, the Thiokol engineers saying one thing, the Thiokol management saying another thing, and perhaps this discussion saying another thing.
Who does the launch manager listen to?
MR. MULLOY: Well, sir, the launch manager
listens to Mr. Aldrich, who provides the readiness for launch to the launch director during the launch count. If you go back to the events that you were relating, sir, in the afternoon I was not aware of the engineering conclusions until we were an hour into this telecon, which started at 8:45.
[839] We were looking at data. Your question was was it transmitted to Kennedy so that Kennedy could make the decision? No, sir. The data were actually transmitted to the Marshall Space Flight Center. Part of the Marshall Space Flight Center happened to be at KSC.
Another part- a part of Thiokol happened to be at KSC. Another good part of the Marshall Space Flight Center was still in Huntsville. That telecon that occurred in the evening at 8:45 was a Marshall Space Flight Center solid rocket booster discussion.
MR. SUTTER: Well, somewhere along the line, perhaps after all of the testimony is given, I would like to ask that question again. If the Thiokol people say don't fly, does that stick? Can it be overruled? Who is the final judge that makes a recommendation to whoever has to say launch?
I'm confused and I would like to get it clarified some time.
MR. HARDY: Mr. Chairman, I think I understand the question and it is certainly a legitimate interest to have. If I might suggest that Mr. Mulloy and myself be permitted to proceed with our statements, I believe that some of the players and where they fit would be a little clearer to you.
CHAIRMAN ROGERS: I think that is correct. Mr. Mulloy, we will come back to some of these questions later on, and particularly Mr. Armstrong's question, because I really hope we can get an answer yes or no.
But in any event, go ahead with your presentation, and we will try to listen carefully.
MR. MULLOY: Okay. I guess where we digressed, I'm to the last diagram here. The condition, the other condition that can exist, where the redundant seal does function, the primary seal has failed and the redundant seal does function, when you start with a redundant system, is depicted on that picture there. The primary seal is compromised, the redundant seal has been pressurized into the gap, and seals. That is another condition that is a "Crit 1" condition.
Should that condition occur- and I will go on now and continue the discussion. As I said, the focus of that discussion at 8:45- and I would reiterate, that was a discussion that was carried on
under my direction, if you will; I am the SRB project manager and all elements on that discussion were in support of me. As has been stated, Mr. Reinartz, who is the shuttle program manager at Marshall, was also there.
But about halfway through, after we had looked at all of the data, the conclusion and recommendation charts that Mr. Lund had prepared came in and the logic for his recommendation, which did not specifically address don't launch 51-L, what it said was that, within our experience base we should not operate any solid rocket motor at any temperature colder than we have previously operated one, which was 51-C.
CHAIRMAN ROGERS: Didn't you take that to be a negative recommendation?
MR. MULLOY: Yes, sir. That was an engineering conclusion, which I found this conclusion without basis and I challenged its logic. Now, that has been interpreted by some people as applying pressure. I certainly don't consider it to be applying pressure.
Any time that one of my contractors or, for that matter, some of Mr. Hardy's people who come to me with a recommendation and a conclusion that is based on engineering data, I probe the basis for their conclusion to assure that it is sound and that it is logical.
I found this recommendation not to launch an SRM at a temperature below 53 degrees as to be-it came as somewhat of a surprise to me, and the reason it did, after 51-C, which is when the observation was made about the blow-by, which has been testified to, we dealt with the observations on 51-C very carefully in going into the next launch readiness review.
The conclusions that came out of that was that there may be, there may, be some effect of temperature that is causing this additional blow-by, but the conclusions as presented to by flight readiness review by Morton Thiokol- and I certainly had no dissent at that time-was that 51-E, which was going to be launched in a much warmer temperature, may have exactly the same type of erosion and blow-by, that we might expect that; that the tests and analysis that had been done showing that did show that we were tolerant to that.
And the conclusion was that 51-E was acceptable to launch with full expectation that we might see again exactly what we saw in 51-C. We tested that logic and rationale in great detail. I signed an action item in my solid rocket booster flight readiness review board, which I chaired, to provide additional data relative to that particular recommendation on 51-E. [Ref. 2/26-4]
Those specific actions were: give me a graphic comparison of the 51-C case joint O-ring erosion dimension with previously observed eroded O-rings; provide description and disposition of all PRs- that is a problem report-on case field joints for both STS-51-C and 51-E; include the metal part problem reports, O-ring, putty, leak tests, all data relative to 51-C and 51-E, since in the initial presentation that was not provided.
Correlate the putty lot that was used on 51-C with the case joints. Did we see any correlation between the lot of putty and erosion in one case joint and not having it in another? Identify any problems with this putty layup.
And number five was, what was the effect of low ambient temperature on the joint?
Number six was, what is joint geometry and O-ring squeeze on both the primary and secondary O-rings for 51-C and 51-E, and to analyze the soot to determine the source.
That action item was answered. The conclusion relative to temperature was that that temperature effect would still give us adequate squeeze and joint operation.
Now, that was the basis that I was coming from,
which led me to conclude that this was a rather surprising recommendation. There were other factors that were involved in that.
CHAIRMAN ROGERS: Can we have a copy of that, Mr. Mulloy?
MR. MULLOY: Yes.
And this was a rather surprising conclusion, based upon data that didn't seem to hang together, and so I challenged that. And I assure you, sir, that there was no reversal of the tradition of NASA which says prove to me why you can't fly versus prove to me why you can.
As I say, to me that is- it doesn't make any difference. If somebody is giving me a recommendation and a conclusion that is based upon engineering data, I am going to understand the basis for that recommendation and conclusion to assure that it is logical. I think that has been interpreted, when one challenges someone who says, I don't have anything too qualitative, but I'm worried, that that is pressure, and I don't see it that way.
Now, I asked Mr. Kilminster then, who is the vice president of space booster projects, for his recommendation for 51-L. He stated that, based upon the engineering recommendation, he could not recommend
launch.
Now, I fully understood what Mr. Kilminster was saying at that time. He did not say the engineering data says that you can't launch. He says: I've got an engineering recommendation here and based upon that I certainly cannot recommend launch.
I construed that as making a point that he really had not had an opportunity to think through all of the points that were made during that two-hour discussion, because there were a lot of additional considerations that that data generated during that two-hour discussion, with some 30 engineers involved in that discussion, raising questions, questioning data, questioning the conclusions that are drawn from those data.
And sir, that is not at all unusual in any of our processes. It is not at all unusual.
Now, then I gave- at that point, I gave my assessment of where we had been, including that consideration for 51-E which was in my mind, which I don't believe I stated at that time. But where I was coming from was we had been flying since STS-2 with a known condition in the joints that was duly considered and accepted by Thiokol, it was accepted by me, and it was accepted by all levels of NASA management through
the flight readiness review process, through special presentations that we had put together and provided up here to the headquarters people. The rationale for accepting that condition had been previously documented.
I would like to now read what I said on that night. You have the notes, because I jotted these things down. This is what was described as a rather logical conclusion by Mr. Russell of Thiokol yesterday.
I stated that, after that beginning, this is a condition that we have had since STS-2, that has been accepted; that blow-by of the O-rings cannot be correlated to the temperature by these data. STS-61 had blow-by at 75 degrees. Soot blow-by of the primary O-rings has occurred on more than one occasion, independent of temperature.
This is in the nature of challenges: Think about this, think about your data.
Primary erosion occurs due to concentrated hot gas passed through the putty. I just wrote that down to say we know why we get erosion. We have done tests, we have done analyses, we understand the limits that the erosion can be, and we understand by tests how much we can withstand.
The colder temperature may result in greater
primary O-ring erosion and some heat effect on the secondary because of increased hardness of O-ring, resulting in slower seating. Early static tests, however, hydrotests- and I have subsequently found that that is 150 of those, and I will show that on a chart- with a 90 durometer O-ring- now, when we're talking about the hardness of O-rings, this is the brick and sponge.
The 75 durometer O-ring is a little softer than a 90 durometer. The durometer is a measure of the hardness of the O-ring. As the temperature approaches about 30 degrees, the durometer is about 90.
It was stated in the Thiokol data that was presented that we had successfully shown that an O-ring with a durometer of 90 would extrude into the gap and seal. It wasn't too hard to extrude into the gap. Further, I have subsequently found out that the diameter of that O-ring was .275 inches. So it is reduced in diameter also, which gives a pretty good simulation of a cold O-ring. That wasn't stated on the night of the 27th.
[842] The other positive point is that the squeeze at 20 degrees is positive, it is greater than 20 thousandths. We saw a 3 mil reduction in the overall squeeze and we were starting out with a squeeze of some
36 to- or 38 to 40 mils.
The secondary seal is in a position to seat. It is in a position to seat and seal by the 200 psi and 50 psi pressurization at leak check, The primary may not seal due to reduced resiliency and increased durometer, may not seal, the worst case condition, if the worst thing happens.
However, during the period of flow past the primary the secondary will be seated and seal before significant joint rotation occurs, which is less than 170 milliseconds.
My conclusion was that that condition has been recognized at all levels of NASA management and is applicable to 51-L.
Mr. Reinartz at that point, after I had made that statement, which was in the intent of look at all of the data that we have, look at our flight experience, look at our test data, look at our analysis, don't just look at this isolated body of data that we have on 12 charts in reaching your conclusion, Mr. Reinartz then asked Mr. Hardy for his comments. George will state what he said, but what I understood him to say was that he basically agreed with that summary, but he certainly would not recommend launch against Thiokol's recommendation. And this is
the gentleman that I rely on for engineering recommendation to launch, and I certainly could not decide to launch in the absence of his recommendation to launch.
Mr. Kilminster then requested an off-net caucus. It has been suggested, implied, or stated that we directed Thiokol to go reconsider these data. That is not true. Thiokol asked for a caucus so that they could consider the discussions that had ensued and the comments that Mr. Hardy and I and others had made.
That caucus, as has been stated, was going to start. At that point, and Mr. McDonald interjected into the teleconference. At that point, he made the first comment that he had made during this entire teleconference.
Mr. McDonald testified for quite a while yesterday about his thoughts on this, but he did not say any of them until this point. At that point, he stated that he thought what George Hardy said was a very important consideration, and that consideration was, and he asked Mr. Kilminster to be sure and consider the comment made by George Hardy during the course of the discussions, that the concerns expressed were for primary O-ring blow-by and that the secondary O-ring was in a position to seal during the time of blow-by and would do so before significant joint rotation had occurred.
They then went into their caucus, having asked for five minutes
DR. WALKER: Could I just ask a question?
MR. MULLOY: Yes, sir.
DR. WALKER: That comment by Mr. McDonald, how did you interpret that, as a comment in favor of proceeding to launch?
MR. MULLOY: Yes, sir, I certainly did,
because- that is, I was sitting- Mr. McDonald was sitting here and it clearly was a supportive comment. I would not say he was recommending launch. What he was saying was that what we were asking them to do was a very important consideration, and as I remember he said, I think that's very important.
And I took it as a supportive comment to the rationale. He certainly didn't say, I think this will support a decision to launch.
DR. WALKER: Could you also, as you proceed with your narrative, tell us about any conversations you had with Mr. McDonald during the 30 or 35-minute caucus?
MR. MULLOY: Yes, sir. If I may, I can't recall the things that have been attributed to me as to whether they occurred during the caucus or whether they occurred subsequent to Thiokol coming off the caucus and making their recommendation,
I don't know that that is germane, but I simply can't recall whether some of these discussions occurred during the 30 minutes we were on mute or subsequent to the decision coming down.
MR. HOTZ: Mr. Mulloy, in that regard, could you, perhaps recall just one of those comments? It figures quite prominently in the discussion that you
were quoted as saying, do you expect us to wait 'til April to launch?
MR. MULLOY: Yes, sir.
MR. HOTZ: Is that an accurate statement or not?
MR. MULLOY: It is certainly a statement that is out of context, and the way I read the quote, sir- and I have seen it many times, too many times- the quote I read was: My God, Thiokol, when do you want me to launch, next April?
Mr. McDonald testified to another quote that says: You guys are generating new Launch Commit Criteria.
Now, both of those I think kind of go together, and that is what I was saying. I don't know whether that occurred during the caucus or subsequent to. I just simply can't remember that.
MR. HOTZ: Well, never mind the timing.
MR. MULLOY: Well, yes, sir. I'm going to answer your question now. I think those quotes derive from a single thought that may have been expressed by me using some of those words.
I have not yet encountered anyone other than those at KSC who heard those words, so I don't believe they were transmitted over the net. The total context, I
think, in which those words may have been used is, there are currently no Launch Commit Criteria for joint temperature. What you are proposing to do is to generate a new Launch Commit Criteria on the eve of launch, after we have successfully flown with the existing Launch Commit Criteria 24 previous times. With this LCC, i.e., do not launch with a temperature greater than 53 degrees, we may not be able to launch until next April. We need to consider this carefully before we jump to any conclusions.
It is all in the context, again, with challenging your interpretation of the data, what does it mean and is it logical, is it truly logical that we really have a system that has to be 53 degrees to fly?
DR. WALKER: I understand how you have clarified that, but I think you have raised an important question, which I hope that you and Mr. Hardy will address, and that is, why was there no Launch Commit Criteria which addressed the O-ring specifically?
[844] We have asked that question of Thiokol and I don't think we have gotten an answer, so I hope perhaps we can get an understanding of that and your thinking and the reason why, after you set up a task team to address this question, you did not also bring your paperwork sort of in line with this concern.
MR. MULLOY: Yes, sir, I will try, and I think between George and I, possibly we can address that to your satisfaction.
CHAIRMAN ROGERS: I want to also raise a point. You mentioned in your statement that there was somebody from Thiokol that asked for a five-minute recess and you said that the other- I think you used the word- lie or not true. I don't believe anybody testified to the contrary.
I think the testimony yesterday was that they were not certain about who made that suggestion. I wouldn't want the record to state that you said that was a lie, because I don't believe it is in the testimony.
MR. MULLOY: I hope I didn't say that, sir. I hope I said "implied."
CHAIRMAN ROGERS: Maybe I misunderstood it. In any event, I thought the testimony was unclear about that, and I'm not sure it's all that relevant who asked for it. It's pretty clear that you and Mr. Hardy were very unhappy about the recommendation of the engineers.
As we understand it, the recommendation of the engineers was don't launch, and you expressed your displeasure. And somewhere along the line, they decided to have what seems like a five-minute recess, which
seemed very odd to me the first time I heard it. Why five minutes on a matter of such major importance? Why would anybody say, let's have a five-minute recess? I would have thought they would have had a five-hour recess on a matter of such major importance.
But in any event, I want the record to be clear. I don't believe there is any contradiction of testimony on that point.
MR. MULLOY: I hope that I have not said that I was upset by a recommendation not to launch. What I was challenging were conclusions that we're drawn. The recommendation not to launch or to launch at that time wouldn't upset me one way or the other.
CHAIRMAN ROGERS: But that was the whole purpose of the discussion, whether you would launch or not.
MR. MULLOY: Yes, sir, the end result would be that. But the purpose of the discussion was to understand the data and the logic of conclusions being drawn from those data, and that is the way I was working.
GENERAL KUTYNA: Mr. Mulloy, if in fact the criteria were 53 degrees, it would have an impact not only on this launch, but on the shuttle program. Can you describe the impacts that it would have had on the shuttle program as far as launches at Kennedy, at
Vandenberg?
It is a fairly important decision to say you can't launch below 53 degrees, isn't it?
MR. MULLOY: Yes, sir, I agree with that. I cannot describe the impacts, but, as I say, based upon our previous experience and our actions in flying subsequent vehicles after 51-C, I found that to be a surprising conclusion.
I did not assess what the long-term impact would be. I wasn't in a position to do that at that time.
[845] If I may continue-
MR. SUTTER: I would like to ask a question. Forgetting all of the testimony, what if it came out that there was a deficiency, that in the interest of meeting the launch criteria implied, which is don't launch until safe, if it came out 53 degrees you wouldn't launch, would you?
MR. MULLOY: I'm not sure I understand the question, sir.
MR. SUTTER: Well, this seal has had a history of being in trouble. There was a task force set up. There were memos written, there were test programs planned. The seal, to me, was very, very tender, and it was known to be very, very tender. At least some people
thought the situation was tender enough that, no matter what the conditions were for this launch, they said, you know, we will wait until the temperature is warmer.
So the launch criteria as written down would be violated, but under circumstances like that it would be. So I don't understand why we hang around the 53-degree thing. I think that seal was tender at 80 degrees maybe, depending upon how it was put together and the tolerances and what-not.
MR. MULLOY: I agree with you, sir.
MR. SUTTER: But then, instead of saying you have to wait until next April to launch, the thing that you do is you go and there were three different levels of improvements that were discussed. The thing to do then was to put those improvements in the program, not infer that these engineers are saying, we're throwing a ringer at you that says don't launch until next April.
I think that is putting those engineers into a little bit of a hot seat. And if they're trying to do their job and say, hey, we ought to do something about this, there ought to have been more attention paid.
MR. MULLOY: Yes, sir. I think we have testified there was a great deal of attention paid to that. Both Thiokol and we have testified there had been a great deal of attention paid to that, from the
Associate Administrator of Manned Space Flight down to the engineers at Thiokol, over the previous year.
And I agree with your conclusion, sir.
VICE CHAIRMAN ARMSTRONG: Could I ask you to speak a bit more to Dr. Walker's question, which in my view asked why wasn't there a Launch Commit Criteria on seal temperature? Why hadn't something bubbled up through the system that would indicate a more well-defined constraint on launch?
MR. MULLOY: I think that I have to go back over the year where all of the attention had been paid to the seal and the research that we have done and what considerations were being worked in the seal task force at that time.
And I have done some research on that and, starting with, again, starting with the next flight after 51-C and looking at the discussions, the tasks, the program that had been laid out by the Thiokol seal team in conjunction with our people, there just wasn't any great concern expressed about temperature during that time.
VICE CHAIRMAN ARMSTRONG: How about any other factors that might influence the seal constraints that were not currently in the LCCs? Was there anything else?
MR. MULLOY: Mr. Armstrong, I don't think anyone addressing the seal problem were conscious that they were working a Launch Commit Criteria problem. I think what they were working was trying to improve the margin in that joint and to reduce the incidence of blow-by and erosion.
I doubt that the engineers working that were thinking in terms of Launch Commit Criteria at all. They were trying to look at- they were doing testing, they were doing analysis, they were doing tests on putty, putty layup patterns. They were doing tests on alternatives to putty, they were doing tests on larger size O-rings, putting spacers in the joint to preclude the O-ring, the primary O-ring and the nozzle joints, from having to translate so far.
And I don't believe there was any focus at all on, we have to develop a Launch Commit Criteria for a joint.
DR. WALKER: Mr. Mulloy, yesterday there was a letter which was made public, which was written by Mr. Boisjoly to his superiors, which predicted that unless the seal problem was addressed a catastrophe was possible. And it's my impression that Mr. Boisjoly is the most knowledgeable engineer at Thiokol in regard to the seals.
Now, was any warning or flavor of that very serious letter transmitted to anyone at NASA, to your knowledge?
MR. MULLOY: No, sir, not that letter. And I guess I wouldn't have expected it to be. That is a correspondence that occurs between an engineer and perhaps his section chief, and I wouldn't expect that type of correspondence to go up the line.
GENERAL KUTYNA: Larry, I have a problem with that. You had a briefing in July that talks about resiliency, you've got a briefing in August at NASA headquarters that talks about resiliency of those seals as a number one concern.
Now, how can you say that wasn't transmitted to NASA?
MR. MULLOY: The memo.
GENERAL KUTYNA: I know the memo. But his concern is what Dr. Walker was asking.
DR. WALKER: Or the flavor of that.
MR. MULLOY: Yes, sir. I have looked back at that briefing. That is one of the things on the title sheet.
GENERAL KUTYNA: It's on the conclusion sheet: "Conclusions: primary concerns, resiliency." [Ref. 2/26-5]
MR. MULLOY: Yes, sir. And what I have looked
at in that report is for the substance behind that, and I can't find it.
MR. ACHESON: But wouldn't temperature automatically be critical to any elastomer which had a critical function?
MR. MULLOY: Yes, sir.
DR. RIDE: Do you think that there should be a Launch Commit Criteria on the seals or on the joint, as far as temperature goes?
MR. MULLOY: I would prefer to reserve judgment on that until we determine whether there should be or not.
DR. RIDE: I guess that is my point. There wasn't one, but it doesn't appear as though you have data to know whether there should be one or not and if there should be one what it should be.
[847] MR. MULLOY: That is a correct statement.
MR. HOTZ: Mr. Mulloy, could we go back for just a minute to page 4, to your conclusion, which reads: "The risk recognized at all levels of NASA management is applicable to STS-51-L in regard to the O-rings." [Ref. 2/14-2 5 of 7]
I have a little trouble with that, because in our testimony so far it seems to indicate that the risk on the cold temperatures and the O-rings was not
transmitted to the highest level of NASA. So how do you explain this conclusion?
MR. MULLOY: Yes, sir. I think the conclusion is the logic that George Hardy will go through in some more detail when he gets to his testimony, but the logic is related to the fact that we have redundancy at ignition, that the concern expressed for the cold temperature based upon the data would appear to be for slower seating of the primary seal, thus more blow-by, and in a worst case condition which would not be quantified, in which case the redundant secondary O-ring seal would seat and seal under worst case conditions.
MR. HOTZ: But was all this information transmitted up to Level II or Level I, to NASA management?
MR. MULLOY: All information- this information that was discussed on the night of January 27th was not transmitted beyond Dr. Lucas at the Marshall Space Flight Center.
MR. HOTZ: Thank you.
DR. WALKER: Mr. Mulloy, let me just clarify your response to one question. In regard to the comments made to Thiokol management by their engineers regarding the concern with the seals, do you think
Thiokol management discharged its responsibility to NASA in terms of conveying the proper level of concern to you and your colleagues at Marshall?
Should they have raised a larger red flag or did they act properly in giving you the briefings they gave you and alerting you to this problem?
MR. MULLOY: I think we had the attention of Thiokol management relative to putting a dedicated effort on improving the margin in the joint and reducing the incidence of erosion and blow-by. They responded to that by setting up the dedicated team in conjunction with NASA to work those problems.
They did transmit to us all the data through weekly telecons and through periodic meetings that was being generated by that task team in joint meetings, and the total content of the task team concerns is known to NASA.
I simply am saying, to my knowledge, that the effect of temperature never came across as the overwhelming and most important concern on that joint. What came across was the necessity to get a primary O-ring that would not have blow-by such that we wouldn't have erosion of the primary O-ring.
MR. ACHESON: As I understand your testimony, Mr. Mulloy, your argument, if I may call it that, on the
telecon with the Thiokol people was prompted not by your concern about the launch date, but by a feeling on your part that the data you were looking at to support their recommendation was not what you might call a thorough engineering job.
That is the sense I get from your testimony.
[848] MR. MULLOY: Yes, sir. It didn't hang together. It didn't hang together with all of our other experience and our knowledge, of which Thiokol engineers have tremendous knowledge about the operation of this joint.
MR. ACHESON: Did you have any feeling or apprehension that a delay of the launch date for reasons related to the propulsion system would reflect on you or the Marshall organization?
MR. MULLOY: No, sir. My decision to proceed with the launch as recommended by the Thiokol official responsible for making such recommendations was based solely on the engineering data presented by Thiokol engineering and the Marshall engineering evaluation of those data.
I can assure you, because I am absolutely certain, that no extraneous consideration, such as schedule, came into that decision process.
MR. ACHESON: Thank you.
CHAIRMAN ROGERS: Do you want to proceed with your presentation?
MR. MULLOY: Okay, sir. At the completion of the caucus, of course, Mr. Kilminster came back on the loop and stated they had assessed all the data and considered the discussions that had ensued for the past couple of hours and the discussions that occurred during their caucus.
CHAIRMAN ROGERS: Was it a couple of hours?
MR. MULLOY: Yes, sir. We started at 8:45 and I believe it was probably 11:00 o'clock before he came back on the loop. It was a long discussion. And I must emphasize that I had no knowledge of what interchange occurred during the caucus at Thiokol, because all sites were on mute. We were on mute at KSC. No communications occurred between myself and Mr. Hardy at Huntsville, nor did any communication occur between KSC and Thiokol during that caucus.
After Mr. Kilminster made that recommendation, Mr. Reinartz then asked if there were any further comments, and to my recollection there were none. There were no further comments made.
I then asked Mr. Kilminster to send me a copy of has flight readiness rationale and recommendation. The conference was then terminated at approximately
11:15.
I have no knowledge of, as has been testified, of Mr. McDonald being asked to sign that documentation. That would have been unusual, because Mr. Kilminster signs all flight readiness documentation.
Now, after the teleconference was completed, Mr. McDonald informed Mr. Reinartz and me that if the Thiokol engineering concern for the effect of cold was not sufficient cause to recommend not launching, there were two other considerations- launch pad ice and recovery area weather.
I stated that launch pad ice had been considered by the Mission Management Team
CHAIRMAN ROGERS: Excuse me. Could you identify that discussion, where that took place?
MR. MULLOY: That was after the teleconference was completed, after Mr. Kilminster made his recommendation, after Mr. Reinartz asked, are there any other comments. There were no other comments on the telecon from anyone.
CHAIRMAN ROGERS: And that ended; then there was another discussion?
MR. MULLOY: Yes, sir. Immediately after the teleconference was completed.
CHAIRMAN ROGERS: Who took part in that?
MR. MULLOY: Mr. McDonald stated to Mr. Reinartz and me that if the Thiokol engineering concern for the effect of cold was not sufficient cause to recommend not launching, there were two other considerations-launch pad ice and recovery area weather.
I stated that launch pad ice had been considered by the Mission Management Team before deciding to proceed and that a further periodic monitoring of that condition was planned. I further stated that I had been made aware of the recovery area weather previously and planned to place a call to Mr. Aldrich and advise him that the weather in the recovery area exceeded the Launch Commit Criteria.
So I stated earlier, when you asked what were the Launch Commit Criteria; one of them was that the recovery area weather has limitations on it. The report we had, that Mr. McDonald confirmed, was that we were outside of those limits.
Now, I must point out that that is not a hard Launch Commit Criteria. That is an advisory call, and the LCC so states that. It does require that we discuss the condition.
So at about 11:30 p.m., Mr. Cecil Houston established a teleconference with Mr. Aldrich and Mr.
Sestile at KSC. I informed Mr. Aldrich that the weather in the recovery area could preclude immediate recovery of the SRB, since the ships were in a survival mode and they were moving back toward Cape Kennedy at about three knots, and the estimate provided to us by Mr. Sestile was that they would be probably 40 miles from the SRS impact area at the time of launch, at 9:38; and then, continuing at three knots, it was going to be some period of time before they could get back and locate the boosters.
The concern I had for that was not loss of the total booster, but loss of the main parachutes for the booster, which are separated at water impact, and loss of the frustum of the boosters, which has the drogue parachute on it, which comes down separately, because with the 50-knot winds we had out there and with the kind of sea states: we had, by the time the recovery ships got back out there, there was little probability of being able to recover those.
I informed Mr. Aldrich of that, and he decided to proceed with the launch after that information. I did not discuss with Mr. Aldrich the conversations that we had just completed with Morton Thiokol.
CHAIRMAN ROGERS: Could you explain why?
MR. MULLOY: Yes, sir. At that time, and I
still consider today, that was a Level III issue, Level III being an SRB element or an external tank element or space shuttle main engine element or, an orbiter. There was no violation of Launch Commit Criteria. There was no waiver required, in my judgment, at that time and still today.
And we work many problems at the orbiter and the SRB and the external tank level that never get communicated to Mr. Aldrich or Mr. Moore. It was clearly a Level III issue that had been resolved.
DR. WALKER: Mr. Mulloy, could I just return for a moment to your conversations with Mr. McDonald. I believe yesterday he stated that he had a discussion with you about the meaning of the temperature on the Launch Commit Criteria of 40 to 90 degrees, whether it applied just to the solid bulk temperature or whether it applied to every element of the shuttle system.
Do you recall that conversation, and could you perhaps tell us your recollection of it?
[850] MR. MULLOY: Yes, sir. There was some discussion, that occurred, and I believe this may have occurred during the caucus, it may have occurred after. Mr. McDonald stated that we ought to at least get the joint temperature to 40 degrees. He indicated that at 40 degrees he would feel more comfortable with it,
because we had a spec that said that we had to be good from 40 to 90 degrees.
I didn't find that logic or that argument to be very logical at all, because based upon the data the engineers were recommending don't launch below 53 degrees.
CHAIRMAN ROGERS: Why is that not logical if he said, why don't you at least require a 40-degree temperature? And you say you didn't think it was logical. It seems very logical to me.
MR. MULLOY: Not on an engineering basis, sir. If one was concerned about the engineering data that said that at a temperature below 53 degrees we have an unsafe condition, there is certainly no logic for accepting that at 40 degrees.
CHAIRMAN ROGERS: Well, it's more logical than 30.
DR. RIDE: What are the solid rocket motors qualified to, what temperature, not the propellant?
MR. MULLOY: Okay. There are two specifications on temperature on the end item specifications to which the solid rocket motors are procured. The first specification states that the motor must be capable of providing a given thrust time trace within limits from zero to 200,000 feet at a temperature
of 40 to 90 degrees.
The second
DR. RIDE: And that is basically on the propellant, is that right?
MR. MULLOY: At a propellant mean bulk temperature of 40 to 90 degrees, for clarification. There is another requirement in the end item specification for the solid rocket motor, that states that it must be capable of meeting the natural environments that are specified in JSC document 07700, volume 10, appendix 10.10.
When you go look at that document, it has a number of environmental data in it. The one that is of interest here is the ambient temperature specifications for the launch site, which is then picked up in the Launch Commit Criteria that we discussed earlier.
In that volume 10.10, it states that it must be capable of operating at an ambient temperature of 31 degrees while being exposed to a five-degree sky.
Now, you have to get into heat transfer then to apply that to what the temperatures would be on the SRM.
DR. RIDE: So what you're saying is there was a spec that NASA imposed saying that the SRM should be qualified to launch at 31 degrees. Now, was that taken
into account in the qual test program for the SRM?
MR. MULLOY: Okay. We came into this discussion not as specific as I can present it to you today, but I have tried to go back and pick up most of the things that we discussed and what we were using in terms of qualification.
May I have the last SRB chart on the screen, please.
(Viewgraph.)
MR. MULLOY: The kinds of things we were discussing during the course of that telecon were what basis did we have for understanding what we would be good for in terms of temperature [851] on the joint. Now, I cannot say that all of these things were discussed, but I know some of them were.
What you will find, you will find a lot of room temperature tests up there at the top of the chart, which is the leak tests which are done on two field joints, the structural test article that was pressure-cycled many times, proof tests that were run to measure the rotation under pressure of the joint, a lightweight cylinder burst test that was done with an intentionally-damaged primary O-ring to assure that the secondary O-ring would seat, and it did.
There were 27 full-scale seal tests with an
O-ring groove damage tolerances, damage in the grooves and damage tolerance on O-rings. And then there were two cold gas tests.
And these data were presented on the night of the 27th. All of that was at ambient temperature. And then we did discuss what is the development qualification motor experience range, and that is shown on the chart. We had experience everywhere from 40 to 85 degrees.
There then were data presented on two cold gas tests at 30 degrees, where the O-ring was pressurized at the motor pressurization rate at 30 degrees, which would indicate that an O-ring would operate before joint rotation at 30 degrees.
DR. RIDE: Was that actually in a joint?
MR. MULLOY: No, it is not. It is a full-scale O-ring, full-scale groove, in a scaled test device, where the pressurize rate on that O-ring is zero to 900 psi in 600 milliseconds at a temperature of 30 degrees.
DR. WALKER: You would say, then, that the O-ring was qualified to a temperature of 30 degrees? Would that be an accurate statement?
MR. MULLOY: The data that we were looking at on the 27th were these two tests that indicated that it would perform at 30 degrees under the motor pressurization rate before the joint rotated.
DR. WALKER: What about, let's consider the putty and the O-ring, because that is really the system that responds to the pressure surge. What temperature was the putty/O-ring system qualified to?
MR. MULLOY: The lowest that I'm aware of- and we're still fleshing this out, because this is kind of what we talked about on the 27th, but the lowest that I'm aware of is the 40-degree test on one of the development motors.
DR. WALKER: And of course, during those tests the putty was modified before the test. The putty was not just laid up and then the seal made. The, putty was then smoothed out or some attempt was made to remove the
volcanoes, I think.
MR. MULLOY: Because the horizontal assembly caused that.
Now, there's one other significant point on this chart that we did discuss, that we didn't have the quantities on on the 27th, and I mentioned this earlier. We have 150 case segment proof tests, with a large number of joints with a simulation of a cold O-ring. That is the 90 durometer with a .275, and that was at about 35 degrees.
So those are the certification data that we kind of discussed, all of which we didn't discuss. The two cold gas tests we did, the segment proof tests we did, the development and qualification [852] motor tests we did, as a basis for understanding what we could expect to happen at colder temperatures on the joints.
DR. WALKER: Could we focus on the putty for just a moment? There has not been a great deal of discussion about its response to the cold temperatures, but it is an elastic substance as well. In fact, I am a little surprised that there was not more discussion in your telecon about the effect of the cold temperatures on the putty.
Was that in anyone's minds, and what data did you have to allow you to extrapolate the behavior of the
putty at these lower temperatures?
MR. MULLOY: Well, I don't recall a discussion of the effect of the cold presented by Thiokol or discussed by anyone- perhaps George does- in the teleconference on the 27th.
DR. WALKER: What about the effects of moisture on the putty? My understanding is that the putty does not respond well to moisture, and I guess it had been raining. Was there any discussion of that?
MR. MULLOY: No, sir.
CHAIRMAN ROGERS: Mr. Mulloy, I want to let you finish, but let me tell you what troubles me very much. I see the charts and I have heard your presentations before, and I recognize your expertise and knowledge in this field.
What is troubling, very seriously troubling, is why, if this is such a convincing matter to you, you are certain of these things, you are sure it's okay, how come then in a matter of such major importance, involving lives of seven astronauts, you apparently we ' re not able to convince any of the engineers at Thiokol who were working on this on a daily basis that you were right?
MR. MULLOY: Sir, I was not aware that they were not convinced. I had no knowledge of what went on
in the 30-minute caucus at Thiokol, and when asked- when Mr. Reinartz asked, are there any other comments, there were none.
CHAIRMAN ROGERS: Now, would your opinion have changed if you had known all of the engineers or substantially all of the engineers at Thiokol took another position and were opposed to the launch?
MR. MULLOY: Sir, I cannot speculate on that my decision would have been given certain other data.
CHAIRMAN ROGERS: Well, why can't you right now, based on the knowledge that you gleaned yesterday from the testimony, why can't you say whether you would have been influenced one way or the other by the fact that all of those engineers seemed to be opposed to the launch?
MR. MULLOY: Well, I would like to answer your question, sir, except that that is so foreign to the way that NASA does business that I would have to think a long time about an answer to that question.
CHAIRMAN ROGERS: I'm not trying to put you on the spot, but we're checking on the particular process. We're checking on the decisionmaking process. Now, in the process we have the manufacturer or the engineers of the manufacturer who were working with this on a regular basis, testifying they were all against the launch.
And we have testimony that management took over and made the decision contrary to the advice of the engineers. Now, the question is, if you had known that would it have made a difference? Was the process a total failure, so that you and Mr. Hardy and others didn't know that at all?
MR. MULLOY: No, sir. I presume if Mr. Boisjoly or Mr. Thompson or Mr. Lund said, look, we have a unanimous opinion here that it is unsafe to launch the 51-L vehicle, that would have influenced, obviously, the decision that I would ultimately make.
CHAIRMAN ROGERS: Leave out the word "unanimously". Suppose it's 80 percent of the engineers. Wouldn't that have raised a major red flag to you, and wouldn't you have said to everybody around that this is a very serious matter? We have been concerned about the O-rings for a long time now, and we have a different weather condition and we've never tried it at these temperatures, and the engineers, a lot of them are very worried.
Wouldn't that have made a difference to you?
MR. MULLOY: Yes, sir. And I think what I would have done- and it is speculation. I think what I would have done in that case, I would have asked Mr. Kilminster how, in the light of that recommendation, he
could recommend launching 51L, and I would have asked Mr. Hardy how he could concur in that.
MR. ACHESON: May I ask Mr. Mulloy a question going back to the point raised earlier about the logic of the belief one may summarize by saying colder is worse. Now, the Thiokol people had been testing since the summer of 1985, and NASA I believe had a member of its Marshall staff participating in that task force exercise, did they not?
MR. MULLOY: That is correct. We had several.
MR. ACHESON: For the record, who was that?
MR. MULLOY: I need some help with that.
MR. HARDY: Mr. Peoples was our senior representative. There were several other people. I don't know all their names right now, but Mr. Peoples was leading that effort from Marshall.
MR. ACHESON: Seemingly, from what we heard yesterday, this test program led the Thiokol people to the widely-shared view that colder is worse. And the logic of that is, of course, you recognize, because you're dealing with elastomer materials.
Now, did that belief or that logic or, if you want to call it, that general principle, play any part in your thinking or in the discussion you had with your
own people?
MR. MULLOY: Prior to the 27th, sir?
MR. ACHESON: No, during your deliberations on the 27th.
MR. MULLOY: Yes, sir. The engineering data presented did contain the effects of resiliency and a qualitative assessment of how that would slow down the primary O-ring, and that was considered. And I think, sir, that pretty well completes the points that I wanted to make.
Mr. Hardy I think can address some of these others.
CHAIRMAN ROGERS: Following up on my question before, I want to point out testimony yesterday. The testimony yesterday was to the effect that at one point in the Thiokol discussion Mr. Lund was told to take off your engineering hat and put on your management hat, because [854] Lund at that point had disapproved the launch decision. So they said, take off your engineering hat and put on your management hat.
And I asked, how do you explain the fact that you seemed to change your mind when you changed your hat? Mr. Lund responded by saying we got our- by blaming NASA's reversal of its launch readiness review policy, we got ourselves in this- and this is a quote
- "we got ourselves into the thought process that we wore trying to find some way to prove to them that it wouldn't work. We were unable to do that. We couldn't prove absolutely that it wouldn't work. That is the kind of boat we got ourselves into that evening."
That is his explanation. He says that NASA put him in that frame of mind and that is why, because he couldn't prove absolutely that it wouldn't work, that he changed his vote. That is his testimony.
Do you accept that testimony?
MR. MULLOY: I heard the testimony, sir. Again, I wasn't privy to the conversation where he was told to change from an engineering hat to a management hat. But, as I stated earlier, I deny that I had any change of philosophy which says prove to me that you can't launch versus prove to me that you can.
I was simply looking at the engineering data that were presented and the conclusion that was drawn from those data, and I found it not to be logical.
MR. SUTTER: Could I ask a question, and it goes back to the last question. When Mr. Acheson was asking you earlier, you made the remark the analysis didn't hold together, and I'm still curious as to which engineering department is the one that calls the shots.
I had the impression yesterday that Thiokol in
this area had to say yes or no, and Mr. Kilminster was asked for a piece of data saying it's all right to launch. But I believe you are saying that their analysis of the data is wrong and you overruled them. And I'm just curious.
Is this the way this program is managed? I'm just asking a question.
MR. MULLOY: Well, let me explain how I manage the program, sir. I rely on the project manager of my prime contractors to arrive at all flight readiness recommendations. I rely on him to manage the resources that he has available to him within his company.
In this case, it is Mr. Joe Kilminster who has the resources of engineering, manufacturing, quality control, and safety. I do not get involved in resolving conflicts between those departments. I rely on Mr. Kilminster to do that, and I take my recommendations
MR. SUTTER: But you said you disagreed with the analysis of the engineers' data.
MR. MULLOY: I said, sir, that it did not seem to hold together.
MR. SUTTER: That's a disagreement.
MR. MULLOY: But I rely on Mr. Kilminster to sort all of that out and make a flight readiness recommendation, and he has been doing that for some 24
flights now.
MR. SUTTER: Even though you knew to some extent that the engineers up there had some pretty grave concerns, you put the burden on Kilminster's back to turn them around?
MR. MULLOY: Not to turn them around. He always has the burden, sir, to make flight readiness recommendations.
[855] I did not detect in the engineering comments- I didn't see this discussion that was going on any different than many other discussions that we have had relative to the validity of data that were being presented as the basis of a conclusion and the logic of the conclusion that was being drawn from those data.
I was not working a problem of I don't want a recommendation not to launch.
MR. SUTTER: But in going back over the history of 1985 and with the concerns over the seal, it seems to me there is a lack of communications and that the real severity of some of the problems has not floated to the surface of the management of NASA properly, and that is what I am trying to get at. And I really am drawing that conclusion.
MR. MULLOY: Sir, I would draw your attention to the August 19th detailed briefing that was given here
in Washington of last year, where everything that was related to the joint, the experience with the joint, the history of it, the testing that was being done, the analysis that was being done, and the rationale for continuing to fly in the face of that evidence.
MR. SUTTER: I think the rationale to continue to fly isn't very good when you know that work is in place to put- well, to put shims in, to extend the lip to keep the deflection from taking place, to talk about putting O-rings in.
It just seems to me that the whole system was not aware of how serious the concern was, and maybe the flight should have been re-evaluated and maybe some changes should have been made to continue flying. It seemed to me that the philosophy was let's keep her flying, let's work on the changes, but I didn't see any heat to get those changes in the system.
MR. MULLOY: Well, air, in July of 1985 I ordered billets to allow the incorporation of a capture feature on the steel cases, to eliminate the joint, rotation.
DR. COVERT: Mr. Mulloy, about that August 19 briefing, I believe you said a little while earlier, and I may not have written the notes accurately, but I think you said: I knew of the MTI
seal concerns; I looked at the cover of the briefing charts and felt there was no substance in the briefing.
Did I get that down accurately?
MR. MULLOY: Yes, sir, on temperature.
DR. COVERT: What would it take to have substance?
MR. MULLOY: I think possibly these things that possibly have come out in testimony yesterday could have been discussed.
DR. COVERT: In your experience as an engineer, do you always have complete 100 percent facts available, or do you from time to time have to make decisions based upon incomplete information?
MR. MULLOY: I- most of the time, I have information sufficient to make the decision. You never have all of the data that you would like to have before, sometimes you have to make decisions.
MR. ACHESON: Can I ask just briefly? I still don't understand it. If from 1984 through the Thiokol testing in 1985 through the presentation here In Washington in August, if during all of that time it was recognized that resiliency was important, perhaps critical, to the performance of the seals, why didn't it follow that temperature was a, critical part of that resiliency problem?
I just don't understand that.
[856] MR. MULLOY: Well, sir, I will try again. I'm just saying that that never did come forth in the level of briefings that I took on the subject.
CHAIRMAN ROGERS: But Mr. Mulloy, there's reference to that all through the memoranda. I reread them yesterday.
MR. MULLOY: Sir, I have not seen those memoranda.
CHAIRMAN ROGERS: I will show them to you. There are a lot of discussions about resiliency and the importance to their operation of the O-ring. And, as Mr. Acheson said, it is so apparent that you are going to launch at Vandenberg and Kennedy, there are times when it is cold. And I can't believe that there weren't lots of discussions about the effect of temperature on the O-rings.
In any event, let me come back, because I'm very concerned about the analysis that we are making or that we have to make about that night when you were having the telecon. Now, you make it sound as if this was sort of a routine discussion about data and you always have a free exchange of information about data and so forth.
The thing that is different, it seems to me,
about this, you had a positive recommendation of no launch. The charts showed that Thiokol recommended against launch. Do you remember any other occasion when the contractor recommended against launch and that you persuaded them that they were wrong and had them change their mind?
MR. MULLOY: No, sir.
CHAIRMAN ROGERS: That is the part that is troublesome. And they said that yesterday, that they thought that you wanted them to change their minds, and that is why they had to rely on management. And they had their contract coming up for renewal, I believe, some time pretty soon this year. So they were under a lot of commercial pressure to give you the answer you wanted.
And they construed what you and Mr. Hardy said to mean that you wanted them to change their minds. They didn't construe it to mean you had a fair discussion about the data. They construed it to mean, just as Mr. Lund said, that's what he thought you wanted.
And I guess what you're saying is that wasn't what you wanted, you just wanted an intellectual discussion about the data.
MR. MULLOY: No, sir. May I address three
things in your comments, I guess?
Number one, I cannot conceive how Thiokol felt any pressure for the renewal of their contract, because they are our sole source for solid rocket motors at this time, and that contract was going to be renewed. There was no alternative, given the mission model, and so that certainly wasn't a pressure factor for them.
CHAIRMAN ROGERS: Well, can I say that in one of the memos I read yesterday, there was a reference to that fact, and that they were concerned that NASA might be looking for another contractor.
GENERAL KUTYNA: Larry, I think what we're talking about is the dual source, and you've got responses from the contractors due on the 14th of March, I think. And there is some leeway as to how much you're going to buy from Thiokol versus the dual source.
Is that true? A minimum of six from the dual source?
MR. MULLOY: In the solicitation of interest that is on the street, yes. But again, I can't conceive of that being pressure to take a risk of safety d flight if they thought it was unsafe.
[857] The second point, I cannot understand why they would be motivated to take a risk that they thought was
a safety of flight risk, because they have absolutely no incentive to do that. Our contract incentive is set up in the opposite direction.
Thiokol has a production incentive contract. They don't have an award fee that they get depending upon how I think they respond to my wishes. They have a $10 million penalty if an SRM causes a Crit 1 failure. That $10 million can escalate into much more money than that, given the loss of fee for the mission success fee that is on a block of vehicles, which is another 12.5 percent over the fee otherwise earned.
They have negative incentives to take a risk, and I cannot conceive of how they would allow or think that NASA could pressure them into making an unsafe decision.
CHAIRMAN ROGERS: Could you explain, then, why the management had to take over the decisionmaking process and exclude the engineers?
MR. MULLOY: Well, sir, I was not aware of that conversation that went on, that said, hey, we're going to make a management decision. I am aware that the people who normally take all of the input, study all of the data and then arrive at a recommendation that they make to me is Mr. Kilminster, who is the program manager.
And not being aware of that, I guess I wasn't surprised that, given the opportunity to think it through, to take advantage of the discussion, the free interchange of discussion in a calm and deliberate manner- I didn't hear a single engineer say it is unsafe to fly 51-L.
What I heard those engineers saying was talking to their data. They were talking to their data and they were talking to their lack of data, and they were giving engineering opinion, which they have stated that they cannot quantify.
And I guess I was not surprised that Thiokol came back after that discussion and came with the here's how I can prove to you we're ready to fly statement.
MR. WALKER: Mr. Mulloy, I know you don't like "what- if" questions, but let's look at the situation a little differently. Let's suppose that the conversations in which the engineers presented their data- and indeed, they have indicated they thought the decision was going to go their way, that is a no launch decision, and so they were really presenting their data, they felt, in a pretty straightforward way- let's suppose that after that presentation Mr. Kilminster had said: Well, the engineers really don't
have solid data to demonstrate that we have a problem; therefore, my recommendation is to launch.
At that point, would you have questioned Mr. Kilminster on that decision, or would you have been happy with that decision and have terminated the conversation and the telecon at that point?
MR. MULLOY: Yes, sir, I believe I would have questioned him on that. Given that you don't have solid data, how can you make that recommendation, because I would insist on that. I would insist on a rationale and a sound basis for flight readiness, as we always have and which we did in this case.
And I would then turn to Mr. Hardy and ask for his assessment, his engineering assessment of the Thiokol recommendation.
[858] MR. WALKER: So what you're saying is that, no matter what the decision and recommendation was, you would have been the devil's advocate?
MR. MULLOY: Oh, yes, sir.
MR. WALKER: And demanded a more thorough discussion?
MR. MULLOY: Sir, I have tried to establish that when I am looking at a conclusion and a recommendation that is based upon engineering data, it is totally within my character to question those data.
It even is within my character to look at those data and offer an alternative conclusion, to test how conclusive they are.
DR. RIDE: Their main problem during all of this, the engineers' main problem, was that they felt they didn't have the data. They felt that their temperature data was inconclusive and they were worried about it, but they didn't have the data to quantify what problems the temperature could cause. And that was one of the bases for their recommendation not to launch in the first place, was that they just simply felt that they didn't have the proof that it was safe.
Did you think you had the proof? Did you think that you had the data base to show that it was safe at these temperatures?
MR. MULLOY: No. All I did was recite the data that we had available to us and ask that we consider that decision in the light of all of those data.
CHAIRMAN ROGERS: Could you go to the telefax and see what in the telefax satisfied you? Because the telefax said the evidence was not conclusive.
MR. MULLOY: Yes, sir. The engineering assessment
CHAIRMAN ROGERS: That is what Dr. Ride is
pointing out. They say it's not conclusive. They don't say we think it's safe. They say the data is not conclusive. And you say the data is conclusive to you.
MR. MULLOY: The engineering assessment is what I relied upon in the telefax, and I don't know whether I have that here.
Here it is: "Engineering assessment is that colder O-rings will have increased effective durometer, harder." We have no argument with that.
CHAIRMAN ROGERS: Cold will make it harder.
MR. MULLOY: "Harder O-rings will take longer to seat." We had no argument with that. "More gas may pass the primary O-ring before the primary seal seats relative to SRM-15." We had no argument with that.
"Demonstrated ceiling threshold is three times greater than the 038 erosion experienced on 15." That is a fact. "If the primary seal does not seat, the secondary seal will seat."
CHAIRMAN ROGERS: That is pretty positive, isn't it?
MR. MULLOY: Yes, sir.
CHAIRMAN ROGERS: And this critical items list doesn't say that, does it?
MR. MULLOY: No, sir, nor should it. The whole concept of redundancy is if the primary system
doesn't function the secondary will.
CHAIRMAN ROGERS: But this critical items list says the possibility is loss of sealing of the secondary O-ring. It says the opposite of what this telefax does.
[859] MR. MULLOY: You see, that is a waiver to the requirement to have a redundant system. What this says is the redundant- that if the primary seal does not seat, the secondary seal will. It says you have redundancy and you have not shown that the primary won't function, but if it doesn't the redundant system will still operate.
That is the way I interpret that.
MR. ACHESON: In other words, you say it is consistent with the basis of the waiver?
MR. MULLOY: Sir?
MR. ACHESON: Is that your testimony? As I understand you, you are saying that the conclusion here in Kilminster's wire is consistent with the basis of the waiver?
MR. MULLOY: No, sir, I am not. I am saying that, the waiver acknowledges a condition where under worst case circumstances you may not have redundancy after full motor pressurization and the joint has rotated. What we are saying here is
MR. SUTTER: Could I ask a question about this worst case?
MR. MULLOY: Yes. It's tolerance buildup.
MR. SUTTER: I know that. But aren't you always dealing with the worst case? Shouldn't you assume every flight you've got everything going against you?
MR. MULLOY: No, sir, because we measure. We measure the clevis and we measure the tang, and we calculate the gap. And, as Mr. Hardy has stated, we take into consideration the rounding and the further rounding with the initial pressure and work in that gap.
And as Mr. McDonald stated yesterday, to his knowledge there is only one case where we have ever had that worst case condition.
MR. SUTTER: One case is too many.
MR. MULLOY: On STS-4.
MR. SUTTER: Well, it's lucky it got home, I guess.
CHAIRMAN ROGERS: Could I just finish on this telefax, because it says "temperature data not conclusive on predicting primary O-ring blow-by." That suggests to me that there was a possibility of primary O-ring blow-by.
Is that right? Do you accept that?
MR. MULLOY: Yes, sir.
CHAIRMAN ROGERS: And then they say that "pressure will get to secondary seal before the metal parts rotate."
MR. MULLOY: Yes, sir.
CHAIRMAN ROGERS: And then they continue to indicate that they are putting some reliance on the secondary seal.
MR. MULLOY: I don't read that that way. That is where we keep, I think, diverging. What they are saying
CHAIRMAN ROGERS: What does it say to you, then?
MR. MULLOY: Well, it says to me that we have redundancy at ignition. We can expect blow-by at any temperature, at any temperature.
MR. WALKER: Mr. Mulloy, let's try an analogy and see if you think it's an apt one. Let's suppose you are a manager of a baseball team and you have an ace relief pitcher, but let's suppose that that person is injured and has a sore arm and so you put him on the disabled list, and then you can't say that, if my starting pitcher gets into trouble in the fifth inning I can bring in my ace reliever, because he is not available to you by the rules.
It seems to me that that is the situation with
this waiver, that you had a redundant seal. According to the waiver the redundant seal was not effective, and the waiver didn't excuse in any way you to use the redundant seal.
Now, I understand that you know in the back of your mind that, well, it is still there, even though as far as the paperwork is concerned it is not still there, and I know in the back of my mind how it's going to function. But in fact, by a strict interpretation of that rule, you can't rely on the secondary seal. Now that is the way I understand it.
MR. MULLOY: That is correct, air, and what I'm trying to get across, and doing a poor job of it, is that the basic, the basic criteria of 1R was in effect at motor ignition. The data were not conclusive that we wouldn't have 1R at motor ignition. The data were not conclusive that the primary O-ring would not extrude into the gap and seat, but given the worry that was being expressed, if that was the case, the redundant O-ring would, which doesn't require a waiver. That is why you have the redundant system.
DR. WALKER: Well, it is that "but" which gives us a problem.
MR. MULLOY: I understand.
MR. HARDY: I believe Mr. Boisjoly testified yesterday that it was some of the work that he did to define the relationship with pressure and joint rotation that was related to or a backup to the submission of this waiver, and it was that work which shows that in the early part of the ignition transient that the joint rotation has not proceeded to the point that you are in fact, or that you do not in fact have redundancy.
Now, I suspect we could go on for some time on the interpretation of that waiver, and what it means, and how it might be applied in this case, but clearly to me, after motor pressurization, after joint rotation is
not the time period that w ' e are talking about. What I am talking about in my assessment of the
data is the initial part of the ignition transient.
DR. RIDE: I guess what concerns me is that we have got a system that is a Criticality 1, and it is defined as a Criticality 1.
MR. HARDY: Correct.
DR. RIDE: The primary O-ring is what is defined as that Criticality 1 item. Now, all Criticality 1 items are reviewed and signed off all the way up the NASA chain, all the way up to Level I, and have to be signed off and understood at a very high level, and it would concern me, I guess, if I thought that on the day before launch or even the week before launch that engineers were allowed to decide, even based on good engineering data, that well, it was okay to consider that a Criticality 1R because we have added up the tolerances and we have done this sort of analysis, and so we think that we have a redundant seal during these 160 milliseconds. They may be right, but that just hasn't reached the visibility that the original waiver had, and that decision hasn't been signed off at the levels that the original decision was signed off at, and it would concern me to think that Criticality 1s could be handled that way by our system.
GENERAL KUTYNA: Larry, let me follow through on that, and I am kind of aware of the launch decision process, and you said you made the decision at your level on this thing.
If this were an airplane, an airliner, and I just has a two-hour argument with Boeing on whether the wing was going to fall off or not, I think I would tell the pilot, at least mention it.
[861] Why didn't we escalate a decision of this importance?
MR. MULLOY: I did, sir.
GENERAL KUTYNA: You did?
MR. MULLOY: Yes, sir.
GENERAL KUTYNA: Tell me what levels above you.
MR. MULLOY: As I stated earlier, Mr. Reinartz, who is my manager, was at the meeting, and on the morning, about 5:00 in the operations support room where we all are I informed Dr. Lucas of the content of the discussion.
GENERAL KUTYNA: But Dr. Lucas is not in the launch decision chain.
MR. MULLOY: No, air. Mr. Reinartz is in the launch decision chain though.
GENERAL KUTYNA: And is he the highest level
in that chain?
MR. MULLOY: No. Normally it would go from me to Mr. Reinartz to Mr. Aldrich to Mr. Moore.
CHAIRMAN ROGERS: Could we go back to Dr. Ride's question because it seems to me that is really the heart of the matter.
Can you try to answer her question?
MR. HARDY: Well, I believe, if I understood, Dr. Ride was pointing out that since the waiver had been processed to the proper levels, the highest levels, that any consideration on the use of the secondary O-ring should not have been given unless it also was processed to some higher level.
CHAIRMAN ROGERS: Exactly.
MR. HARDY: As far as the levels of review and so forth, I really can't comment on that because that is really not within my purview, but I was making my comments primarily as it related to the engineering assessment of the performance of the seal, and particularly as it was related to the matter of interest, and that is the temperature on the night before.
CHAIRMAN ROGERS: The reason that I think her question and your answer is very helpful is because it was clear that that critical items list was based on the fact that there was no redundancy, that you had to rely
upon the primary seal. Then you had this discussion back and forth on the eve of the launch, and then the contractor writes temperature data, weather not conclusive on predicting primary O-ring blow-by, and so that says, in effect, because of the weather that the data is not conclusive. You may have primary O-ring blow-by.
MR. HARDY: Yes, air.
CHAIRMAN ROGERS: And then the Critical Items List says if you have primary O-ring blow-by, it may be a catastrophe. So your contractor himself gives you a signal in this telefax that this may violate the Critical Items List and may be a catastrophe.
MR. HARDY: Well, I think we have a different interpretation of that. I think it is quite obvious we have a different interpretation of that.
Yes, on 51-L one had to be prepared for primary O-ring blow-by. That is also true on every other flight we have had. We have had
CHAIRMAN ROGERS: But this relates to temperature data not conclusive. This is an analysis of the weather condition.
MR. HARDY: I agree with you, air, that the temperature data was not conclusive. In fact, we had had blow-by on primary O-rings with joints at 75
degrees. So it was obviously not conclusive, I agree with that, that it was not conclusive, that the temperature induced O-ring blow-by.
Now, I will discuss later what one can infer in terms of the duration of that blow-by, but it was obviously inconclusive that temperature induced blow-by. We had more blow-by at higher temperatures, relatively higher temperatures, and we had more incident of blow-by at relatively higher temperatures than we had at lower temperatures. There was also no question about the fact that the program had recognized that launch by launch by launch. Every occasion that had occurred in the subsequent flight readiness review- and to my knowledge, this was up to all levels- of the subsequent flight readiness review, the occasion of that blow-by on the previous flight had been evaluated, it had been analyzed. The cause of that blow-by or the phenomenon of that blow-by had been assessed, and it was determined that on each one of those cases, that the understanding of that blow-by and in fact the existence of the secondary O-ring in the early part of the ignition phase to terminate if required, to terminate by sealing the primary O-ring blow-by.
And so, there may well be a misinterpretation or some misapplication, but I don't think there has been
anything sinister or hidden or, for that matter, even unknown about it.
CHAIRMAN ROGERS: I don't think anybody suggested that.
MR. HOTZ: Mr. Hardy, we heard some testimony yesterday that the character of the damage in the low temperature blow-by and soot was of a much different nature and much more severe than any of your higher temperature experiences.
MR. HARDY: That is correct.
MR. HOTZ: How did you evaluate that factor in reaching your conclusions?
MR. HARDY: I evaluated that as some evidence of the fact that temperature did have an effect on the duration of blow-by. I do not believe that temperature in and of itself induces the blow-by, and I think that is kind of obvious because we have occasions for blow-by at all temperatures, but I do believe that that was indicative of the fact that temperature could have an effect on the duration of the blow-by.
MR. HOTZ: Well, is the duration of the blow-by critical to this whole cycle?
MR. HARDY: The duration of the blow-by is critical only to erosion that might be sustained on the primary O-ring. The duration of blow-by has nothing to
do with the ability to seal the secondary O-ring. In fact, it is more likely to seal the secondary 0-ring in the case that the blow-by is extended.
Again, it is very difficult, I think, difficult for me to convey, but- well, let me request that when I get into my statement I address some of those issues.
CHAIRMAN ROGERS: Mr. Armstrong has one question, and then after that we would like to have a short recess.
VICE CHAIRMAN ARMSTRONG: A question regarding the signature approval or recommendations from the contractor in this case. My question is, in cases of this type is that always done? Do you always have some responsible persons sign off on their recommendations?
MR. MULLOY: Yes, sir, that is the normal process in any flight readiness review, L-l, or any issue related to flight readiness, and the files show that at all levels. We require it at every level.
[863] VICE CHAIRMAN ARMSTRONG: So the fact that Mr. Kilminster signed this thing was typical, and it would be the standard procedure?
MR. MULLOY: Yes, sir.
CHAIRMAN ROGERS: Would it be signed by him and not the man on the scene?
MR. MULLOY: That is correct, sir. We require the element project manager to certify flight readiness and not anyone else.
CHAIRMAN ROGERS: Let's have a ten-minute recess.
(A brief recess was taken.)
CHAIRMAN ROGERS: The Commission will please tome to order.
Mr. Mulloy, Dr. Keel has a couple of questions, and then we will go to you, Mr. Hardy, right away.
DR. KEEL: Mr. Mulloy, I think at the end of the previous session you said that it was normal to ask for a written statement, that all flight readiness reviews required written statements. Is that accurate? Was that your statement?
MR. MULLOY: Yes, sir, that is.
DR. KEEL: But this wasn't a flight readiness review, was it?
MR. MULLOY: It was, in a sense, it was a review like an L-1 or dealing with issues related to the flight. It was not a chaired flight readiness review.
DR. KEEL: Aren't all flight readiness reviews Level I and Level II?
MR. MULLOY: No, sir, we have a Level III
readiness review which I chair for the solid rocket booster. I also have a flight readiness review that Mr. Wear chairs for the solid rocket motor before it gets to me, a flight readiness review that is chaired by Mr. le Burt, who is the booster assembly manager before it gets to me, and then the prime contractors, USBI, PPC, and Thiokol have a flight readiness review chaired by a management official above the level of the program manager prior to the time of getting to the element managers.
DR. KEEL: But what about the nominal reference to flight readiness review, the one that occurs two weeks prior to launch. Is that a Level I and Level II?
MR. MULLOY: Yes, air, that's Level I. Then there is one subsequent to that which is the L-2 or L-1 review, which, it also has a signed certification with it.
DR. KEEL: And what level is that?
MR. MULLOY: That is a Level I review that occurs one day prior to the launch.
DR. KEEL: I think there was just a risk of confusion because you referred to this in a statement that it required a written sign-off, since all flight readiness reviews do, and I think nominally the Commissioners think of flight readiness reviews as those
Level I and II meetings that have been briefed to the Commission, and this certainly wasn't a flight readiness review in that context.
MR. MULLOY: No, sir.
I might say that another thing that does require a sign-off by the program manager is any action that results from anything related to a flight, and this would certainly fall in that category where concern was raised and an action is assigned to go develop data and then review those data.
I view it as part of the flight readiness review process.
[864] CHAIRMAN ROGERS: All right, you may proceed, Mr. Hardy, and I apologize for not getting to you sooner.
MR. HARDY: Mr. Chairman, members of the Commission, before I relate to you my participation in and recollections of the teleconference between Morton Thiokol personnel and Marshall Space Flight Center personnel on the evening of January 27, 1986, 1 would like to describe just briefly to you what my role is and the role of other personnel from Science and Engineering Directorate is with respect to flight readiness assessment ' for Shuttle flights.
The role of the Science and Engineering Directorate
at Marshall in this regard is to participate in flight readiness reviews, identify any pertinent issues relative to flight readiness, and review any issues, identified by others, including contractors, and to assess the rationale for flight and supporting data on any issue, and then finally, to provide recommendations to the appropriate readiness review board, if such a board is in session or otherwise to the program management.
With reference to the teleconference that started approximately 8:45 Eastern Standard Time on January 27, 1986, 1 would like to identify the personnel at Huntsville from the Science and Engineering Directorate that were in direct support of me during this teleconference: Dr. Wayne Littles, Associate Director for Engineering; Mr. Jim Smith, the solid rocket booster Chief Engineer; Mr. Robert Schwinghammer, Director of our Materials and Processes Laboratory; Mr. Bill Riehl, an engineer in the Materials and Processes Laboratory, and Mr. Riehl is a nonmetallic materials expert; Mr. John McCarty, Deputy Director of our Structures and Propulsion Laboratory; Mr. Ben Powers, an engineer in the Structures and Propulsion Laboratory specializing in solid propulsion; and Mr. Keith Coates, who is in the Office of the Associate Director for
Engineering.
At the teleconference on the evening of January 27, 1986, Thiokol engineering personnel in Utah reviewed charts that had been datafaxed to Huntsville and KSC participants just prior to the beginning of the conference. Now, I am not going to repeat a lot of what you have already heard, but I will give you some of my views on the whole matter.
The presentations were professional in nature. There were numerous questions and answers. There was a discussion of various data and points raised by individuals at Thiokol or at Marshall or at Kennedy. I think it was a rather full discussion. There were some 14 charts presented, and as has been mentioned earlier, we spent about two, two and a half hours reviewing those. To my knowledge, anyone who desired to make a point, ask a question or expressed a view was in no way restrained from doing so.
As others have mentioned, I have heard this particular teleconference characterized as heated discussion. I acknowledged that there were penetrating questions that were asked, I think, from both, from all people involved. There were various points of view and interpretation of the data that was exchanged. The discussion was not, it my view, uncharacteristic of
discussions on many flight readiness issues on many previous occasions. Thiokol Engineering concluded their presentation with the recommendation that the launch time be determined consistent with flight experience to date, and that is the launch with the O-ring temperatures at or greater than 53 degrees Fahrenheit.
Mr. Kilminster at Thiokol stated that with, to the best of my recollection, that with that engineering assessment, he recommended we not launch on Tuesday morning as scheduled. [865] After some short discussion, Mr. Mulloy at KSC summarized his assessment of the data and his rationale with that data, and I think he has testified to that.
Mr. Reinartz, who was at KSC, asked me for comment, and I stated I was somewhat appalled, and that was referring specifically to some of the data or the interpretation of some of the data that Thiokol had presented with respect to its influence on the joint seal performance relative to the issue under discussion, which specifically was the possibility that the primary seal may take longer to actuate and therefore the blow-by of the primary seal may be longer. I am going to elaborate in that a little further in this statement.
Then I went on to say that I supported the
assessment of data presented essentially as summarized by Mr. Mulloy, but I would not recommend launch over Thiokol's objections.
Somewhere about this time, Mr. Kilminster at Utah stated that he wanted to go off the loop to caucus for about five minutes. I believe at this point Mr. McDonald, the senior Thiokol representative at KSC for this launch suggested to Mr. Kilminster that he consider a point that I think I had made earlier, that the secondary O-ring is in the proper position to seal if blow-by of the primary O-ring occurred.
I clearly interpreted this as a somewhat positive statement of supporting rationale for launch. Personally, I believe any other interpretation of that is a case of convenience of memory. The status of the caucus by Thiokol lasted some 30, 35 minutes. At Huntsville during this Thiokol caucus, we continued to discuss the data presented. We were off the loop, we were on mute. We were around a table in small groups. It was not an organized type discussion. But I did take that opportunity to discuss my assessment and understanding of the data with several of my key advisors, and none of us had any disagreement or differences in our interpretation of what we believed the data was telling us with regard to the primary issue
at hand.
When Thiokol came back on line, Mr. Kilminster reviewed rationale that supported proceeding with the launch and so recommended. I have no knowledge of who participated in the caucus at Thiokol. It is not typical to ask for a vote count when a senior responsible official of the contractor presents the company position. What is typical is to assess the rationale for that position, whichever way it may come down. During the caucus I had written my evaluation of the data presented as I developed it in my mind, and as I reviewed it with some of my senior, key advisors during the caucus, and I will review that with you later in this statement.
Mr. Reinartz asked if anyone on the loop had a different position or disagreed, or something to that effect, with the Thiokol recommendation as presented by Mr. Kilminster. There were no dissenting responses.
The telecon was terminated shortly after, and I have no knowledge of any subsequent events or discussions between personnel at KSC or at Thiokol on this matter.
As I stated earlier, during the Thiokol caucus, I discussed the data and the issues with several of my key advisors, and there was no disagreement among
us. I have also stated earlier that there was no dissenting responses when Mr. Reinartz asked if there were any disagreements following Mr. Kilminster's recommendation to proceed with launch.
[866] I have learned since the 51-L incident that Mr. Ben Powers expressed some concern about the O-ring performance directly to Mr. Smith, the SRB chief engineer, and Mr. McCarty, the Deputy Director of Structures and Propulsion Laboratory. Mr. McCarty is Mr. Powers' supervisor. Mr. McCarty has stated to me that he considered Mt. Powers' comments along with all the other data presented and discussed when he made his input to me.
Now, I believe at this point, if I may, I need to address before I proceed on into my assessment and evaluation of the data, I would like to address two points that have been discussed rather prominently in these hearings. The first one relates to the assertion or inference that pressure was or may have been applied to the contractor during the course of this teleconference. With regard to my participation in the discussion of January 27, 1986, 1 would like to give you a little insight into my mode of operation in these matters, and I believe those that are familiar with me will recognize these quite readily.
In any matter related to flight readiness issues, I am dedicated to a thorough and open discussion of the data and the rationale developed from such data. I have tried to the best of my ability to determine the facts in the data. Unfortunately, facts and engineering data are not always interpreted by all engineers the same way, But regardless of the side that I come down on, it is in the pursuit of the facts of the data.
I am likely to probe and sometimes even challenge either a pro position or a con position, or sometimes even both, on an individual issue that is being put forward or a set of rationale or an interpretation of the data that might be associated with that.
And the objective of this is just simply to test the data, test the degree of understanding of the individual that is presenting the data, test his, not only his engineering knowledge, but his engineering assessment of that data. So that is characteristic of the way that I do, and I think anybody that knows me would realize that that is not interpreted as coming on strong or applying pressure.
But I have thought a lot about this business of applying pressure, and the application of pressure is, of course, to no avail unless there is a response to
that pressure. And if there is to be a response, in my mind, there must be a motivation. And I can't speak for any contractor personnel that was involved, but since the issue was first raised, I have wracked my brain to try to see if there was any conceivable motivation that may have made any contractor representative feel that he was under pressure from anything I said.
And we are not talking about customer relations here. We are talking about flight readiness issues. Mr. McDonald attached it to the thoroughness down to the smallest detail that he was accustomed to in all flight readiness reviews. He also mentioned his conviction that the conservative approach was emphasized.
Thiokol will also remember that on more than one occasion that I have rejected their proposal to fly. One such occasion occurred the latter part -of last year when a segment was damaged, the joint clevis, in fact, on that, the clevis joint on that segment was damaged during handling. Thiokol proposed that we fly that segment, and I nonconcurred. And although it is not in my area of responsibility, I am aware that as Mr. Mulloy has attested, that the contractor is highly incentivized by terms of the contract for a mission success with a rather significant penalty clause, and
further, as I have testified and others have also testified, on the evening of January 27, I clearly stated that I would not recommend launch over the contractor's objection.
And so I have great difficulty in seeing what any motivation for response to "pressure." But I am sure you are going to pursue that even further.
Now, with regard to the second item that has been rather prominent in these hearings, I would like to state that as far as my participation in the discussions at issue, I categorically reject any suggestion that the process was prove to me it isn't ready to fly as opposed to the traditional approach of prove that this craft is ready to fly. I have no responsibility for schedules, I have no responsibility for manifest. I couldn't tell you with any degree of certainty what the next launch cargo was on the next flight. I couldn't tell you with any high degree of certainty even what date it was scheduled to fly.
As I said, I have no responsibility for that, and I have occasion to know that at times, but it is not my primary job.
I would hope that simple logic would suggest that no one in their right mind would knowingly accept increased flight risk for a few hours of schedule. I
can say certainly that not the dedicated men and women with whom I am associated, many of whom have literally put their blood, sweat and tears into the Shuttle program.
And I will only say one other thing on that subject, and that is that I believe to suggest that flight safety was disregarded or not properly regarded in; the discussions on the night of January 27 in my opinion does a great disservice to many dedicated, committed professionals.
Now, if I could, I would like to proceed on with a summary of my assessment of the data presented and the conclusions that I came from this.
CHAIRMAN ROGERS: Could I interrupt because I think you did say something that was disturbing. When you referred to Mr. McDonald, you referred to convenience of memory, which suggested to me that you thought he was making something up for the record or some such.
Was there anything that he said that you thought was not true?
MR. HARDY: No, sir, I did not mean to imply that.
CHAIRMAN ROGERS: Why did you use "convenience of memory?" That is what it sounded like.
MR. HARDY: Well, I will explain that, and that may not be a good, proper term to use. But there have been many of us that were involved in flight readiness issues for 51-L, even more than the issue of temperature on January 27, and I think there have been many of us that have gone back and asked ourselves questions and second guessed ourselves, that have really probed to bring back to the same level of understanding in the consideration of any of these issues that we had on the other side of 51-L.
And that is not easy. It is not easy just within your own heart and mind to try to separate yourself from what you know has happened. I don't mean by that the cause or failure. I am talking about the tragic incident itself. And I am not suggesting that anyone, and in any testimony before this committee or this Commission has knowingly in any way presented untruth. But I have talked to some of my colleagues, and I have found that they found it very difficult to remember precisely not only everything said and everything done, but even more than that, some of the motivations or some of the thoughts that took place at that time.
[868] CHAIRMAN ROGERS: Can I say, speaking for myself, that I respect your views and I believe what you
just said. I also have the same feeling about Mr. McDonald, and I would like to have you withdraw those words, "convenience of memory," because I don't think that is what he did.
MR. HARDY: I would be pleased to do that.
CHAIRMAN ROGERS: Okay, thanks.
MR. HARDY: I would like now to give you a summary of my assessment of the data presented and the conclusions that I drew from that data. I have chosen to discuss the assessment of each type of data and then my conclusions that were drawn from that, and that is a little bit different from the arrangement that is in the material that has been provided you. It is the same material but arranged slightly differently.
I interpreted and assessed the data presented by Thiokol in the context of the accepted performance and operational characteristics of the field joint during the motor ignition transient. The essential features of these characteristics are the primary O-ring moves from the position it has assumed during the leak test to its sealing position as the pressure upstream of the primary O-ring increases from ambient pressure to approximately 25 to 50 pounds per square inch.
Secondly, this pressure is imposed on the primary O-ring during the first few milliseconds of the
ignition transient.
And thirdly, if blow-by or failure of the primary O-ring occurs in this timeframe, that is, in the early part of the ignition transient, the secondary O-ring is in its seating position, and this has been assured by the leak test port.
Now, I might add that I make that statement, Your apparent interpretation of the Critical Items List waiver notwithstanding. No one in the meeting questioned the fact that the secondary seal was capable and in the position to seal during the early part of the ignition transient prior to any significant joint rotation. Thiokol, in fact, presented data to that effect in that meeting, and since Marshall actually originated the waiver, I can also say that that was in fact the interpretation at the time of the submission of that waiver.
Now, Mr. Chairman, I will relate to you my assessment of the data as I understood it, and I assessed it on the 27th. As you appropriately noted at the beginning of the session, the cause or causes of failure have not been determined, and the effects of temperature as well as any other potential cause are being actively and aggressively pursue, and the failure analysis is under way. The issues addressed during the
teleconference was the potential for the predicted temperatures to adversely affect the performance of the seals during the ignition transient; specifically as it might affect the actuation time of the primary O-ring.
Thiokol engineering presented data on the history of primary O-ring erosion and blow-by at the motor field joint. I concluded that there was no direct correlation with this data and temperature. O-ring blow-by was experienced on 61-A with a joint temperature of 75 degrees, and O-ring blow-by was experienced on 51-C with the joint at 50 degrees. There was no O-ring blow-by or erosion on two ground test motors at somewhat lower temperatures.
[869] MR. RUMMEL: Mr. Hardy, if I may interrupt a second, wouldn't the fact that you had blow-by at the higher temperatures only heighten the concern at the lower temperatures, understanding the elastomeric characteristics of the seal?
MR. HARDY: I think the fact that there was blow-by experienced on the higher temperatures as well as the low temperatures heightened the interest in, number one, understanding the cause of the blow-by, and number two, proceeding with activities associated with eliminating the blow-by.
Now, let me make just a couple of other
comments. I believe there are a number of factors involved in the phenomenon of blow-by of the primary O-ring. As I have stated earlier, I do not believe that temperature, high or low, induces primary blow-by. I do believe that temperature can have a potential effect on the duration of that blow-by. Blow-by occurs during the period of time when the primary O-ring is being pressure actuated from one side of the seal to the other side of the seal, and being extrusion-sealed into the seal.
And so, I would accept that evidence would indicate, and I think 51-C is supportive evidence of that fact, I would accept that evidence would indicate that the duration, and I think that is very important, the time during the ignition transient when blow-by is occurring, the length of time that it occurs can be affected by temperature, and later on, as you can see, I took that into consideration in my assessment of the data.
MR. RUMMEL: Just another aspect for clarification.
Wouldn't you say, or would you not say that the greater the duration of the blow-by, the greater the risk?
MR. HARDY: If that blow-by occurs in the early A of the ignition phase, which every indication
of everything we have seen indicates that it has, no, I don't think the duration of blow-by increased the risk. I think the duration of blow-by increases the probability you will have to call on the secondary seal at that time.
MR. RUMMEL: Well, can you help me a little? I would assume that blow-by might be called a first stage to erosion, and that the greater the length of time that the seal is exposed to blow-by, the greater the possibility of erosion, and the longer erosion occurs, if it does, the greater the risk.
Is that incorrect?
MR. HARDY: That is essentially correct.
There are two things that happen to a primary O-ring when you get blow-by, or conceivably three things. One is it terminates itself in a short period of time because the seal continues to pressure actuate, and that is about the end of it. You see some evidence of that blow-by with soot on the back side of the seal, and if the blow-by is sustained for a very long period of time, you might see some evidence of heat effect on the primary O-ring.
However, blow-by, the primary O-ring pressurizes the cavity between the primary O-ring and the secondary O-ring, and as I mentioned earlier, it is
a mistake to think about these things as step one, step two, step three. If step one is blow-by the primary O-ring and step two is pressurizing the secondary O-ring, then step one and step two are the same thing. They occur simultaneous with each other.
[870] Now, in the event you sustain blow-by the primary O-ring for the full period of time and sealed the secondary O-ring for the full period of time that it took you to fill the cavity between the primary O-ring and the secondary O-ring would limit the amount of erosion you get on the primary O-ring, because when you fill the cavity and equalize the pressure, you stop the flow, and there is no more heat transfer.
And that limiting factor has been calculated to be, I have forgotten the exact number, but it is at least twice, at least twice the amount that it would be allowable as demonstrated by tests before you lost the primary O-ring.
There is a limiting factor on erosion, and that is in every case the amount of flow that you can sustain, and the amount of flow you can sustain is the size of the cavity that you are pressurizing versus the source pressure.
DR. RIDE: Is your factor of two safety, is that considering only whether the O-ring is still able
to seal, or does that take into account its structural integrity?
MR. HARDY: Both.
DR. RIDE: So you have done an analysis of the structural integrity of an O-ring that has experienced what you consider to be the maximum, the, number you are quoting as the maximum erosion?
MR. HARDY: Yes.
DR. RIDE: So you wouldn't expect, for example, high winds or other kinds of forces that the O-ring might see in an overly eroded state to cause it to break?
MR. HARDY: I would not before 51-L, and where I stand right now, I would not, but I would reserve total judgment on that until we complete the failure analysis.
MR. SUTTER: Could I ask a question?
Some of the hypothesis depends upon the secondary seal being in place because of the pressure check, is that right?
MR. HARDY: Yes, sir.
MR. SUTTER: The pressure check is done at assembly.
MR. HARDY: Correct.
MR. SUTTER: The lower units could be pressure
checked, and then as you put the others on you in effect are changing the load even in the assembly bay.
MR. HARDY: That is correct.
MR. SUTTER: Then the machine is hauled out on a ramp which puts some vibratory loads on it, I assume. Then it is put in position, which puts another load on it. Then it sits there for 28 days with the temperature going up and down, which in effect puts some work on the seal.
What assurance is there that after those 28 days that that secondary seal really is in position and all of them completely around the circumferences?
It seems to me that is a risky assumption.
And another question is has anybody gone out and made a pressure check, say, the day before the launch to make sure those seals are in place?
MR. HARDY: I am not aware of any pressure checks the day before or a few days before the launch anywhere in the program. I am not aware of that.
But if I could address just a couple of points you make, that is, that is true that when the additional segments and then the entire Shuttle is added on to the field joint of interest or [871] added on above the field joint of interest, that that compressive load, the compressive load at that point, in contrast to the tension load,
that tends to open the clevis when you pressurize the motor, at that point you have got a very high compressive load on it.
Now, it is true that that compressive load also tends to open the gap, if you will, but a very, very small amount compared to that which occurs when you pressurize it.
MR. SUTTER: Well, what about the thing sitting out on the ramp and the temperature dropping, which in effect makes the diameter of the seal get smaller and puts at. tension on it so it again gets smaller? Couldn't it pop out of its sealed position then?
MR. HARDY: Well, the temperature, or the shrinkage of the O-ring, if you will, due to temperature effects is calculated and has been calculated and is considered and was considered in this meeting on the 27th.
MR. SUTTER: But does anybody know that the calculations are accurate?
MR. HARDY: I have not personally checked the calculations, but I believe those calculations are fairly straightforward to calculate the shrinkage of the material, but I have not personally checked those calculations.
MR. RUMMEL: Have you encountered separation of the vulcanized joints in the O-rings, to your knowledge?
MR. HARDY: Excuse me, sir?
MR. RUMMEL: Have you ever encountered any sort of separation during operation of the vulcanized joints in the O-rings?
MR. HARDY: Not to my knowledge. You are talking about the vulcanization of the ends of the O-rings or sections of the O-rings?
MR. RUMMEL: Yes. I understand that five joints are allowed in each O-ring, and I am simply curious as to whether there is any record of premature separation of those joints.
MR. HARDY: I am not aware of any, and I think I would be well aware of them if they occurred anywhere in the field after delivery of the hardware.
CHAIRMAN ROGERS: Not being an engineer, and because I am surrounded by so many capable engineers, I would like to ask a question that is not an engineering question.
At some point, I gather, you have to, you will agree that the colder the weather the greater the risk. Is that accurate?
MR. HARDY: I am not sure that that is an
accurate statement. I would say- and again, I am going to, with your permission, I am going to look at that question from the other side of 51-L.
CHAIRMAN ROGERS: But I mean at the moment you are inclined to say it doesn't make any difference how cold it gets as far as the risk is concerned on the O-rings?
MR. HARDY: At the moment I would say that the consideration of the effect of temperature on the joint is certainly an active failure analysis, and there are some features of the joint, indeed, where temperature can affect it.
CHAIRMAN ROGERS: But that's a key question, it seems to me, because if you in the back of your mind, in the back of Mr. Mulloy's mind you said it really doesn't make any difference how cold it gets as far as the joint is concerned.
MR. HARDY: No, sir, I don't believe I said that.
[872] CHAIRMAN ROGERS: No. I am asking now do you think that at some point the coldness of the weather makes a difference on the risk?
MR. HARDY: Well, I am sure there must be some point because there is some point at which the structural integrity of the O-rings just wouldn't be
maintained.
CHAIRMAN ROGERS: At what point would that be?
MR. HARDY: I think that would be somewhere in the minus 40, minus 50 range.
CHAIRMAN ROGERS: So insofar as you are concerned now, it wouldn't make any difference about the risk in connection with the joints if it was. above 40 below? In other words, I am trying to see what your thought process was.
I think most people, or a lot of people have felt that the worse the weather, the more the risk insofar as these joints are concerned, and I guess you are saying you don't agree with that.
MR. HARDY: Well, I think probably there might be dozens and dozens of things on the vehicle that one could say
CHAIRMAN ROGERS: No, I am talking about the O-rings now and the joints.
MR. HARDY: I could not in my mind quantify any increased risk- let me make sure I say that correctly. I could not in my mind determine that there was any increased risk to safety as a result of the temperature that we were discussing on the night of the 27th.
CHAIRMAN ROGERS: Or any lower temperature?
MR. HARDY: Well, that is extremely hypothetical. We didn't discuss any lower temperature. There is bound to be some lower temperature.
CHAIRMAN ROGERS: Well, it might have gotten colder overnight?
MR. HARDY: No, no lower temperature within the general range of predicted and expected temperature.
CHAIRMAN ROGERS: I think the engineers, though, at Thiokol expressed concern, as you heard yesterday, on the question of the weather, and they felt that the cold weather might have an adverse effect on the joints, and therefore they recommended against launch, as I understood it. And you are saying as far as you were concerned, it really didn't play a role. It wasn't a factor in your consideration.
MR. HARDY: Well, let me say it this way. The key factor, the key area of concern expressed concerning the effect of temperature on the joint, the key area of concern expressed was the potential for increased time, the duration of blow-by on the primary O-ring, and that and its effect on the timing function of the seal of the joint, and addressing that specific key area of concern and the evaluation of the data for that, I came to the
conclusion in my mind that temperatures at the levels that we were talking about was not dominant in the functioning of that joint, and therefore there was no increased flight risk.
Now, in spite of the fact that I came to that conclusion, and in spite of the fact that I conferred with several of my key advisors who expressed no different opinion, I was fully prepared, and so stated, and frankly- well, I was fully prepared and so stated that I would accept the recommendation of Thiokol, or, the opposite of that, I would not go against the recommendation of Thiokol. I think that these discussions occur frequently between NASA engineers and contractor engineers. We find many areas of agreement and frequently areas of disagreement, and I am relating to safety of flight issues, too.
[873] CHAIRMAN ROGERS: Well, I think we all understand that part of it. I think the more difficult part to understand is the fact that you had a no-launch recommendation, and you have already testified that you can't remember any time when you have had a no-launch recommendation and then had a discussion with the contractors and they changed their minds on something of such key importance on the night before the launch. So it does seem that it is not typical. You said in
your comments you thought this was sort of a typical situation. I wouldn't think, based upon the testimony, that it is typical. It is quite unusual.
MR. HARDY: I meant to say that the discussion over the data and trying to understand the data, and determine
CHAIRMAN ROGERS: But it wasn't just a discussion about the data. It was a discussion about the no-launch recommendation. This wasn't just an intellectual exercise. Your statement about being appalled and Mr. Mulloy's about April and so forth all gave the Thiokol people the idea that you strongly disagreed with them on the no-haunch recommendation, and that is why they wanted the recess for five minutes, and that is what they did. But it is not just a discussion among engineers about the theoretical matter; it was a very practical question, were you going to launch the next day or not?
And I think that is the problem that I am having with it.
MR. HARDY: Well, maybe the point that is missing is that on recommendations on any matter, regardless of what position that recommendation takes, it is typical and traditional to ask first of all that we don't just do things with people dropping letters in
to each other; a recommendation is made. The question is asked, or it doesn't have to be asked because they know it is going to be asked, what is your rationale for that. And the next step usually is, well, my rationale is based on this data, and the next question is, well, how do you interpret that data and on what basis do you interpret that data?
DR. WALKER: Mr. Hardy, the data which was discussed by Mr. Thompson yesterday in which they tried to simulate the separation of the metal parts which were holding the O-ring, and Mr. Thompson discussed trying to increase the rate of separation to better simulate the profile which occurred during the launch, was that data presented during the telecon?
MR. HARDY: If you mean the data where tests were run to try to measure the joint separation with pressure
DR. WALKER: And how the O-ring responded to that.
MR. HARDY: Resiliency data was presented.
DR. WALKER: That's the data I'm talking about.
MR. HARDY: Yes, it was.
DR. WALKER: Was that data at all convincing to you in regard to the sensitivity of the performance
of the joint with respect to temperature?
MR. HARDY: In the time period and the function of the seals that we were discussing, in the initial phase, transient phase of the pressurize, no.
DR. WALKER: But this data, of course, applied to the rotation period which came later?
MR. HARDY: That is correct.
[874] DR. WALKER: What about that period? Did you think that possibly even if you had a seal during the ignition phase, that the rotation might have broken that seal and the resiliency of the O-ring been insufficient to remake that seal immediately either for the primary or the secondary O-ring?
MR. HARDY: Dr. Walker, if I understand what you are saying- and let me say first of all that the blow-by of the primary O-ring by definition occurs when pressure gets to the primary 0-ring. There is no phenomenon that I know of that will allow pressure to hang around somewhere in front of that primary O-ring and not do one of two things, and that is either pressure actuate its seal or blow by.
DR. WALKER: But let's suppose that the O-ring has been sealed, whether blow-by occurred or not, and now rotation occurs.
MR. HARDY: Yes.
DR. WALKER: And so the metal parts which are surrounding the O-ring begin to move apart. The O-ring must follow those in order to maintain the seal, and it seems to me that the data presented by Mr. Thompson addressed the ability of the O-ring to respond.
And what I'm asking is did that raise a concern that even though the orbiter seal might have been made during the initial phases of the launch, that that seal might have been broken later on because the O-ring resiliency had been reduced to the point by low temperature that it could no longer respond to the rotation transient?
MR. HARDY: I understand what you are saying, There was no discussion that I am aware of, nor has there been any concern expressed regarding the seals, that once a seal, like a primary seal, once it seals, there has been no concern of any magnitude that I am aware of that it would subsequently fail.
DR. WALKER: I guess I am confused now because I thought that that was one of the concerns that Mr. Boisjoly and Mr. Thompson had.
MR. HARDY: It is my understanding that Mr. Boisjoly's and Mr. Thompson's concern, at least on the evening that we discussed this, was that the cold
temperature could cause the blow-by. Well, first of all, you can get blow-by of the primary 0-ring. You can get it any time at any temperature, and that has been recognized, and as I said, this position has come up in flight readiness reviews time and time again. The cold temperature might sustain that blow-by for a longer period of time. I mean, it may be longer, and as someone had mentioned to you, the longer it is, the more erosion, if you get any erosion, that you will see on the primary O-ring, and that if somehow- and I could never figure out in my mind how this happens, but if somehow that while that blow-by is occurring on the primary O-ring, the secondary seal, presumably it doesn't seal anywhere, but the secondary seal is not pressure actuated by that blow-by, then the joint could rotate, and indeed, both joint rotation and resiliency would then have an adverse effect on the secondary O-ring sealing.
But the difficulty I have with the application of that data, there is no question about the fact that temperature affects the resiliency of the material. But the difficulty I had with the application of that data was in the period of the performance of the seal that we were discussing, and the issue we were discussing about sustained blow-by or a longer period blow-by on the
primary, and in fact it was that that prompted my statement that I was appalled.
[875] DR. WALKER: Of course, emphasize the question of the first few hundred milliseconds when the seal is formed, but the seal, of course, has to maintain itself throughout the period of firing the motor which is some 100 seconds or so.
MR. HARDY: That is correct, and that is correct on. any seal at any temperature, and it has been recognized and documented that that secondary seal, at any temperature, may in fact after motor pressurization, after joint rotation, may not be redundant, and a waiver has been processed to that effect.
So in that particular case one has to recognize the fact that that could happen, whether he is talking about cold O-rings or hot O-rings or whatever.
DR. WALKER: But evidently that was not an issue during this teleconference?
MR. HARDY: No, sir. The issue of whether or not the secondary seal is still good after joint rotation, not to my knowledge. We were talking about the initial ignition phase and the potential for an effect on the timing function between the primary and the secondary O-ring.
DR. WALKER: I don't want to get ahead of your presentation, so if this question is too premature for
you, answer it later, but I hope that you will tell us what you think are the controlling factors which determine whether blow-by will occur or not. Evidently you think temperature is not one of the major factors.
MR. HARDY: Okay.
Well, let me try that now. I think it is, as I mentioned, during the transient period when the O-ring is sliding, and maybe even a certain portion of that O-ring is rolling or- well, you really can't roll it. We are talking 20/1000 to 30/1000 of travel, so you can't roll the O-ring, but tending to roll or twist a little bit, that while that pressurization is going on, then there are some- there is a possibility of gas going by. I think it has to do with the finish on the sealing surfaces themselves, them passing from one finish to the other.
DR. WALKER: That is imperfections in the sealing surfaces?
MR. HARDY: And small, slight imperfections in the O-ring itself. There is quite a difference between the way the O-ring was sealed, as I am sure you are aware, when I am sealing between two surfaces with squeeze or sliding that way as opposed to how it would seal when I extrude it into a gap that is much, much smaller than the O-ring.
So I think when it is across those two sealing surfaces, that it experiences this blow-by.
DR. WALKER: Could the treatment of the joints be a contributing factor, imperfect joints?
MR. HARDY: The amount of squeeze could be a factor.
DR. WALKER: No, I meant the- let me be a little more careful. The joints in the O-ring, the five joints in the O-ring.
MR. HARDY: Oh, yes. Well, I say oh, yes, yes, that could be a factor.
DR. WALKER: Are those inspected, each joint?
MR. HARDY: To my knowledge, they are.
MR. ACHESON: Mr. Mulloy, have you ever seen an O-ring in which the vulcanized ends had come apart in a motor which was recovered from a flight?
MR. MULLOY: No, sir. I have not, and none have been reported to me.
CHAIRMAN ROGERS: Mr. Hardy, going back to the process itself, the decisionmaking process- and I think that is vitally important because we have to make recommendations to the President about the future, and I think all of us feel that there has been a breakdown of sorts in the process- you said that you would not have
approved of a launch if Thiokol had recommended against it.
That is correct, isn't it?
MR. HARDY: Yes, sir.
CHAIRMAN ROGERS: Now, suppose that Mr. Kilminster had said to you I am sending the telefax, and this represents management's decision, and there are three or four of us, but all the engineers are still opposed to the launch, how would you have reacted to that?
MR. HARDY: I would not have accepted it.
CHAIRMAN ROGERS: Thank you.
MR. HOTZ: Mr. Hardy, I would like to pursue the Chairman's line of inquiry here, if I may. You have characterized the tone of these discussions as normal engineering discussions, the type of thing that goes on all the time. Yet one of the Thiokol people at Marshall told us that you had spoken as strongly as he had ever heard you speak in that telecon, and I would like to ask you whether you in fact apologized to any of the Thiokol people the next day for speaking so harshly?
MR. HARDY: No, sir, I have no recollection at all of apologizing for anybody speaking harshly. I don't think I spoke harshly. I certainly did not speak in any way harshly toward any individual. I may have
spoken in a tone that someone my have interpreted as coming on strong. I would suggest if you have continued interest in that that there is a large number of people that you might have access to that could give you a little better insight into my mode of operation and how I conduct myself in meetings of that sort, and then maybe from that you could determine whether I could be properly characterized as coming on strong in that meeting.
MR. HOTZ: We will do that, thank you.
DR. RIDE: Could I just pursue this question of sort of implied pressure or whether Thiokol felt pressure from your comments?
You have said that in engineering discussions you always rightly try and probe the data and make sure that the conclusions follow from the data, and that the data is well presented, and I think in Mr. Mulloy's terms, hangs together.
Normally, contractors are in the position of trying to prove to both of you that they are ready to fly, that their systems are safe to fly, and they are used to having to defend that point of view.
This time they were in the other position. They were so concerned that they in fact recommended not to launch, and I think that you might argue that they were so used to hearing you say are you sure it is safe
that when you both said are you sure it is not safe, that they were so taken aback that they perceived that as pressure. And I guess I am wondering whether it is possible that you didn't realize that you could have been generating this reaction just because of the reversal of their normal position relative to you.
MR. HARDY: Well, of course, first of all, I don't think you intended to imply this, but we didn't ask them are you sure it's not safe? There was no discussion that I'm aware of where that question was asked like that.
Now, as to whether or not someone else could perceive a line of questioning to try to understand the data and in fact probed the data and in fact challenged certain points on the data, but [877] I maintain you are not really going to understand it sometimes unless you challenge it, and then I find that- I have found that in most cases engineers, managers or whatever else who have a true conviction in the data that they are presenting to you, will hang tough and not resent someone probing and penetrating that data.
But as to whether or not someone else could interpret that situation as being pressure or being a reverse normal operation or whatever, I couldn't judge that. I would hope not. I would certainly hope not because I
would like to think that there is a clear understanding of what we are about when we get into discussions like that, and I would like to think that without exception there is a clear understanding that nobody is asking anybody to accept or do anything that has any significant effect on safety of flight, and I have been in this business too long to imagine, I can't imagine who could pressure me in what way to get me to accept some, any significant increase or any increase in safety of flight. I can't imagine who could do that.
DR. RIDE: Well, the indications from the testimony we heard yesterday were that the engineers did, in your terminology, hang tough, that the engineers at Thiokol were still arguing the points that they had been arguing at the beginning.
MR. HARDY: Well, I am not aware of that part of the discussion or the facts that took place.
CHAIRMAN ROGERS: Mr. Armstrong?
VICE CHAIRMAN ARMSTRONG: We heard yesterday what the various points of view and how many people expressed those points at the Utah end. Were you at Marshall?
MR. HARDY: I was at Marshall, yes.
VICE CHAIRMAN ARMSTRONG: Could you characterize for us how many people were involved in the
meeting at Huntsville? And you have already testified that Mr. Powers expressed some support of the contractor view.
Were there others, and could you say there was a split in opinion among the people at Marshall, please?
MR. HARDY: Well, let me say first, I can't give you the exact number of people, but certainly I think you have the list, but I would guess there were probably 20 people, maybe somewhere in that neighborhood, maybe not quite that many.
Okay, was it 14? 1 didn't have the count, 14 or 15 people. There was discussion by a number of people, I don't know who or how many right now, during the course of the meeting, asking questions about the data, or asking questions about this test, how many tests were run, was that one data point or was more than that run, how do you interpret that, or do I understand you interpret that this way and things of that nature.
There were a number of people participating during the course of the conversation. I mentioned the fact that I had learned since 51-L that Mr. Powers had made the comments that he had made, not to me, and not during the teleconference when it was in process, but as stated to me by Mr. McCarty, his supervisor, during a side
meeting. I did not detect any strong dissent.
Well, let me be careful about this because I want to say it right. I did not detect any dissent when Thiokol came back with their final recommendation, and in fact, as I have stated, I didn't [878] talk to everybody in the room. Dr. Lovingood, who was there, is a senior program official. I don't believe he talked to everybody in the room, but had I had- maybe the best way to answer the question is to say that if I had been conscious of- and I am quite confident that this was nonexistent but if I had been conscious of the fact that there were 20 percent or 25 percent or anything like that of opinions that were contrary to the recommendation that was made and the discussion of that data, I would have pursued that with the individuals involved.
VICE CHAIRMAN ARMSTRONG: Going back not to the final decision but at the time of the early recommendation of Thiokol not to launch, were there expressions of support for their position at that point, or can you characterize that in any way?
MR. HARDY: I don't recall that there were any expressions of support or any significant discussion on it.
Well, let me put it this way. If there were
any expressions of support other than mine wherein I said I will not go against the contractor's objections, and I don't know how anybody else interprets that, but if I was on the other end of the loop I would have interpreted that as support, regardless of what had transpired prior to that time, but I don't believe there are any expressions of support or at least that I heard or was conveyed to me.
MR. ACHESON: A brief question, Mr. Hardy, going to a minor, or maybe not so minor conflict in the testimony. Your testimony appears to be that you used the word "appalled" in connection with the data that had been presented during the teleconference. Mr. McDonald's testimony of yesterday and I think his notes say that your words were "I am appalled at your recommendation."
MR. HARDY: Well, I don't recall that I stated I'm appalled at your recommendation. I do recall that when I made that statement, it was in the timeframe that they made the recommendation, but I also clearly know in my mind and I have testified to that fact, on what basis I made that statement, and again reiterate the fact that I would not recommend launch over the contractor's objection. And I have worked with these individuals for some time, and I think that they knew
clearly that I would not-that I meant what I said regarding what I would do.
CHAIRMAN ROGERS: We would like to declare a recess in just a moment, but before we do, I would like to ask one or two questions on the subjection pressure.
Has there been any pressure from any source against, on either of you? In other words, has anybody urged you to get this launch off, or has there been any intercession on the part of anybody asking you to be sure that you worked hard to get the launch off or anything of that kind at all?
MR. MULLOY: No, sir.
MR. HARDY: None whatsoever, as far as I am concerned.
CHAIRMAN ROGERS: No outside interference or attempt to put pressure on you at all?
MR. HARDY: No, sir.
MR. MULLOY: No, sir, quite the contrary.
CHAIRMAN ROGERS: Thank you very much.
We will come back at about five minutes after 2:00.
(Whereupon, at 1:10 o'clock p.m., the Commission recessed, to reconvene at 2:00 o'clock p.m., this same day.)
(2:10 p.m.)
CHAIRMAN ROGERS: Will the Commission come to order, please?
Mr. Hardy, would you proceed, please?
MR. HARDY: Yes, sir.
I believe I was down to the point where I had started providing you with my assessment of the data as presented, and first of all, I reviewed in my mind during the course of the discussion and at the caucus and in some discussion with some of my key advisors the question about blow-by, and I mentioned that O-ring blow-by was experienced on 61-A and 51-C, and also not experienced on motors at somewhat lower temperature.
I also mentioned that I think there were a number of things that probably play into the equation for blow-by, but I did not believe that temperature was an inducement factor.
I thought that temperature could potentially affect the actuation time and therefore the time of blow-by. The experience base and data on the primary O-ring erosion of the case joint was also reviewed in this meeting, and the maximum erosion that had ever been experienced on a primary O-ring was at a joint with a
temperature of approximately 70 degrees. Thiokol had data that showed that subscale hot fire tests had demonstrated the capability of the primary O-ring to sustain erosion of .125 inches and maintain pressure with no leakage, and this was the reference I made to the fact that that is approximately two times the factor that has been calculated as to be the maximum erosion that could occur in the time that is available to equalize the pressure, and that is a factor of approximately three times that experienced on 51-C.
Now, these analyses were made some time ago, and they were reported to us at Marshall in a briefing on August 19, 1986. 1 was not in that briefing, but I did have that data that was presented. So my conclusions relative to blow-by was that blow-by on the primary O-ring may occur on 51-L because it had occurred on joints that were at ranges all the way from 75 to even below 50 degrees, and it also had not occurred on most occasions at temperatures even over a wider span than that.
But obviously, one had to be prepared in his assessment of the data there that blow-by could occur.
I also assessed and in effect agreed with the Thiokol engineers that the duration of that blow-by on the primary O-ring could be longer than the normal that
we have seen, and I think that the evidence for that was the amount of blow-by that was seen on 51-C.
With respect to the primary O-ring erosion, well, let me just say one other thing. As I mentioned earlier this morning, in my mind the duration of primary O-ring blow-by was not a key issue. The key issue was, as we stated several times, the existence of the secondary O-ring at that point in the ignition transient to accept that blow-by and in the event that it was not terminated by the primary O-ring actuating and sealing, it would be terminated by pressurizing the secondary O-ring.
[880] DR. RIDE: Can I ask you a quick question about that?
You say that if you get blow-by past the primary O-ring, that because of the pressure check, the secondary will be in a position to seal, and so you won't get blow-by past the secondary O-ring.
Let me just ask you about the black puff of smoke that we saw.
Do you think that a reasonable interpretation of that is that you got blow-by past both O-rings?
MR. HARDY: I think that is one of possibly two or three interpretations.
DR. RIDE: I guess the reason that I bring that up is that it apparently is conceivable that you could have blow-by past the secondary O-ring, and if you do, then the timing function becomes very important because then you would have the primary O-ring eroding, the erosion wouldn't stop because the secondary had sealed, but the primary could keep eroding possibly to a dangerous point.
MR. HARDY: Well, it was, I think, clearly recognized by everybody involved that the secondary seal has to be prepared to be sealed if you get blow-by the primary O-ring, and it sustains itself. So I don't take issue with what you said there.
But the secondary O-ring, of course, doesn't have to pressure actuate. All of our evidence to date is that the blow-by occurs during the pressure actuation of the primary seal. The primary seal does have to pressure actuate, and the secondary seal doesn't have to pressure actuate, and as the pressure builds up on the secondary seal, it starts- its first function is to extrude into the gap. That is its first function. The primary seal's first function is to pressure actuate and then extrude into the gap.
So the occasion for blow-by on the secondary O-ring, in my opinion, would be extremely nil or maybe
not even possible.
Now, if there was a defective secondary O-ring or something of that nature, then obviously the primary O-ring blow-by could be substained right an past the secondary O-ring, and that would describe a problem.
CHAIRMAN ROGERS: As I understand, your answer is that the puff of smoke had occurred before the first second had elapsed, might be an indication the secondary O-ring had failed?
MR. HARDY: Yes, sir. What I meant to say is that there are conditions whereby the secondary O-ring could fail to hold that pressure when I get blow-by by the primary O-ring. I do not believe one of those conditions is blow-by the secondary O-ring in the same context that we described that with the primary O-ring, but there are conditions whereby the secondary seal would not seal, and in fact, result in a puff of smoke.
There are others, I might hasten to say, there are other possibilities for that same thing.
CHAIRMAN ROGERS: But that is one of them, though?
MR. HARDY: Yes.
MR. HOTZ: Could you describe those other conditions where the secondary O-ring might not seal?
MR. HARDY: A defective O-ring, a defective
O-ring sealing surface, and when I say a defective O-ring, I can think of more than one type of defect.
[881] MR. HOTZ: How about displacement?
MR. HARDY: Well, if the pressure for some reason doesn't get to the primary O-ring and when it does, let me say if the pressure is delayed in getting to the primary O-ring, and I mean delayed in terms of a few hundred milliseconds, and then when it does arrive at the primary 0-ring, the primary O-ring sustains blow-by, under that condition the secondary seal could be in a position where it would not seal. It would depend upon how long in the ignition transient or the reverse of that, how early in the ignition transient that occurred.
But all of our assessment on blow-by to date had indicated that pressure gets to the primary O-ring very early. It pressure actuates or starts pressure actuating at a relatively low pressure. I think it is 25, 35 psi, and when blow-by occurs, that is when it occurs, and at that position, the secondary O-ring would be in a position to seal.
DR. COVERT: Mr. Hardy, with regard to your comment that there is a pressure delay for several hundred milliseconds, it is my understanding that the putty is a plastic material and therefore it cannot
withstand pressure loads of any kind.
What kind of a physical phenomenon would give rise to a delay in the pressurization of that volume between the end of the putty and the primary O-ring ?
MR. HARDY: Well, I think if for whatever reason the putty kept the pressure off the primary O-ring for several hundred milliseconds, and I might just add at this time that the potential for that to occur was not discussed in the meeting of January 27th. Subsequent to that time, in fact, I would say the first or second day of the failure investigation, I raised that issue, or I asked at that time, we were just starting to formulate failure scenarios, and I asked if there was any potential that the putty might delay the pressure actuation of the primary O-ring. I believe it was Mr. Boisjoly who was with me, and several other people at that time, and he said, or words to the effect that within his knowledge of how that joint pressurizes, he doesn't believe there's any delay at all in pressurizing the primary O-ring by virtue of the putty.
DR. COVERT: If the putty were at 29 degrees, would it possibly cease to be a relatively plastic material and be a brittle material that could for a while carry the pressure load?
MR. HARDY: Dr. Covert, I can't answer that in
detail. I can tell you that we are intensively investigating the role of that putty at various temperatures in the pressure sequence. There are several things involved there. One is that the structural capability will, if you will, of the putty itself, there is also the fact that there are fibrous materials in the putty which could provide porous type leak paths, and the other thing is that there are dynamics in the joint immediately when, at very low pressures, tending to separate the putty or at least providing a force to try to separate the putty from the rubber.
DR. COVERT: I think let's not go further with this and wait until some of this other technical data becomes available.
Thank you, Mr. Hardy.
MR. HARDY: The second item of discussion was the primary O-ring erosion, and I believe I have pretty well covered that, the fact being that yes, we had to be prepared for primary O-ring erosion on 51-L, as we had to be prepared for that on any flight. There was no evidence of temperature affecting erosion. Erosion phenomenon occurs in one of two ways. One is that the erosion would occur from a concentrated jet, a concentrated Jet
of hot gas that is imposed by virtue of a hole that is formed in the putty when the putty gets pressurized.
Now, the reason for the hole could be many things, but not the least of which would be the variability in the way it is laid up every time, and not the least of which would be the effects of moisture, because we do know that the putty is sticky and less pliable when it is wet. But that issue had been addressed in great detail in a number of previous flight readiness reviews at all levels. Analysis had been done to show that the limiting factor again was the time it takes to equalize the pressure across that jet, the source pressure, which is the motor pressure, and the pressure just downstream of the jet, in front of the primary O-ring. And these were the numbers I mentioned to you earlier that calculated maximum theoretical erosion that you could experience was around 65/1000. That was confirmed in tests, and then there was a test to show that approximately twice of that was tolerable.
The other way to get erosion on the primary seal is the hot gas that blows by when this phenomenon of blow-by occurs.
Now, I think you understand erosion and blow-by don't occur at the same time. They do occur separately. They sometimes occur at the same time even
though the phenomena that causes them is different. But in this particular case, again, it would be due to sustained blow-by the primary O-ring, at which time the secondary O-ring is in a position to seal.
The other subject that was discussed and material that was presented had to do with O-ring resiliency. The data showed indeed that there was a decreased response rate of the O-rings with decreased temperature, and by that I mean if you compress the O-ring, it takes it longer to come back to its original position with temperature, and I think that is fairly standard data and was of no great surprise.
The data presented, however, coupled with the O-ring erosion and blow-by experience, did not indicate that resiliency was a dominant factor, and I emphasize dominant factor, in the early part of the ignition transient.
Now, certainly resiliency is a factor in that portion of the ignition transient where the joint has started to rotate any significant amount. The data that would plot a curve from those three data points, there was one at 100 degrees Fahrenheit, one at 75 degrees Fahrenheit, and one at 50 degrees Fahrenheit, would show that immediate response of the O-ring from compression set would not occur at temperatures below 70, 75, 80
degrees. It was the application of that- well, let me go on one step further- which again reinforced my belief that in the portion of the ignition transient that we were interested in, that is, that part where we might sustain longer blow-by or extended blow-by of the primary, resiliency was not a dominant factor, and I think that is substantiated in the experience base that we had.
To make the point again, the primary O-ring actuates and seals early in the ignition transient phase, about 25 or 30 psi, and I know no better way to describe this than to say that when that pressure gets to the primary O-ring, it either seals or it doesn't seal. If it seals, I've got nothing else to be concerned about. If it doesn't seal, what I have got to be concerned about is the secondary O-ring. But at the same time I am getting blow-by on the primary O-ring, I am pressure actuating the secondary O-ring.
[883] Data was presented relative to 0-ring hardness and temperature, and while hardness is affected by temperature on the 0-rings, in fact, two data points, one that shows a durometer, or a measure of hardness, at 84 at 50 degrees Fahrenheit and 92 at 30 degrees Fahrenheit, but there are two significant data points with respect to "harder O-rings." One was a test that
had been conducted by Thiokol. The question here is will an O-ring extrude into the gap? Will it seal? Once it gets harder, will it have a higher resistance to sealing in this extrusion gap? And if it does, will that have any effect on the sealing time or any significant effect on the sealing time?
Tests were run at Thiokol that showed that on more than one test, in fact all the tests- I have forgotten exactly how many it was, but the tests showed that at 30 degrees the seal would seal without leakage, and then beyond that there had been a durometer of 90 O-rings were used earlier in the program. They were used early in the test program, and they were used early in the program to do hydroproof tests on segments.
I concluded that the effects of changes in O-ring resiliency and hardness were not dominant factors in the early part of the ignition transient, since any violation of the primary O-ring is expected to occur early in the ignition transient, while the secondary O-ring remains in a squeezed position, seated by the leak test pressure, and ready to seal.
MR. SUTTER: Do you think that 28 days later that that secondary O-ring is still in the sealed position?
MR. HARDY: Yes, absolutely.
MR. SUTTER: Do you have any data on that?
MR. HARDY: Well, I don't have the data here with me, but there is data on the stiffness of that joint, the characteristics of the joint under various types of loads, everything from on-pad loads to the loads that it experiences when the SSMEs fire up and
push it over, to the pressure loads.
And without question, the pressure load, of course, is the biggest load that that joint ever sees.
MR. SUTTER: But the thing is sitting there for 28 days, and there are variations in temperature which makes the vehicle work some, and there is nothing to hold it in position, except it has been pushed in position.
But if something tries to pry it out around that great big circumference, it would seem to me there might be a chance that at least parts of it would pop out.
MR. HARDY: Well, of course, it is in a groove, as you know, and it is sitting there under those conditions with about, in this case, 35, 36-thousandths compression.
MR. SUTTER: Except that if it gets colder it might shrink, and that reduces.
MR. HARDY: As it get colder, that 38-thousandths would come down to 35-thousandths.
MR. SUTTER: I have a little bit of trouble. This run-through of data that you're presenting and your analysis of it sounds like everything is copacetic, and yesterday I listened to these other fellows who showed great concerns.
And it is hard for me to understand two different groups of engineering with the same data, one drawing a very great concern, a critical concern, and the other one being fairly relaxed. And that is why I keep asking the question of these two groups, who is the group that is the group that makes a recommendation to the decisionmakers to make the proper decision?
I'm still very confused on that.
MR. HARDY: Let me just clarify that for you a little bit. What- the responsibility of myself and engineers that work in science and engineering is to review, assess, probe, analyze data that is put forth by the contractor engineering.
MR. SUTTER: And you draw a different conclusion than they draw?
MR. HARDY: That is correct.
MR. SUTTER: So then when they advise their management as to go or no go, it really isn't a very strong input, and when their management says go or no go it may be a decision that doesn't have to be paid attention to?
MR. HARDY: Well, as I was going to say, we have interface with that engineering department and our engineers do. We don't make recommendations to their management. Their engineering doesn't make
recommendations to our management. Their engineering makes recommendations to the contractor management and then we make recommendations to our project management.
Now, what the project manager is then assessing is the contractor's input to him and his civil service engineering input. That is what he ends up assessing.
MR. SUTTER: And I can tell you that if I were that guy I would have a hell of a time knowing what to do.
MR. HARDY: Well, I don't know of any case- I don't know of many cases-there may have been some, but I don't know of many cases where he has just overridden or ignored the civil service engineering input that he has had.
MR. SUTTER: Then it gets back to the fact that the engineers at Thiokol, who designed the thing, ran the tests, and did some interpreting of it, are a nonentity. They don't count.
MR. HARDY: Well, of course, to us the contractor is the entity. We don't cut the contractor up into departments.
CHAIRMAN ROGERS: Following up on the question, aren't you and Mr. Mulloy still worlds apart from the views of the engineers at Thiokol?
MR. HARDY: I would say today that, based upon what I heard yesterday, that yes, we have- or I have some significant difference. Mr. Mulloy would have to speak for himself.
CHAIRMAN ROGERS: Okay. Are you about finished?
MR. HARDY: Yes, sir, I think I have finished.
DR. COVERT: Mr. Chairman, may I ask one more question, please?
Mr. Hardy, this assembly was 28 days in a vertical stack and these 0-rings were squeezed 14 or 15 percent all these 28 days.
MR. HARDY: That's my understanding.
DR. COVERT: Is the characteristic of this elastomeric material such that it is going to tend to come to equilibrium with the fact that it has been- I don't know, what's the right word- squoze that long? So that could this contribute to a lack of resilience and the ability to slow up the spring-back?
[885] MR. HARDY: I believe that these compressions, one could have a higher, an extremely high compression where that could be more of a problem. But at these compressions, we have had vehicles sitting on the pad for-I can remember, well, we have had them stacked,
we have had the motors stacked for in excess of a year and have subsequently satisfactorily tested them.
DR. COVERT: Thank you.
MR. RUMMEL: If I could ask a question for clarification, from either Mr. Hardy or Mr. Mulloy or both, with respect to the capture ring development. As I understand it, it was said this morning that that was sent to production, or at least billets were ordered last July.
Now, that is a fairly major change, since it affects the forging and machining, et cetera, et cetera, in the normal course of production. My first question is, when was that decision made to order it to production?
I note in passing that it has already been incorporated in the filament-wound case, and of course the obvious purpose of it is to keep the joint from separating. Was it when you first. discovered separation, and when was the capture ring ordered for the steel case?
MR. MULLOY: Yes, sir, the filament-wound case design was done about three years ago. That was subsequent to the time that the measurements had been taken on the structural test article, on the steel case, that did show that, contrary to Thiokol's calculations, that when the pressure load was put on the case the
joint opened instead of closed.
The original calculation showed that it would close. When we got the filament-wound case designed, it is about 1.6 inch thick composite, which puts a bigger eccentricity into that joint, if you will. So when that is pressurized and it's less flexible, it causes even more bending, and so it was determined that it was an unacceptable rotation on the filament-wound case.
Now, in this activity that began in looking at near-term, mid-term and long-term solutions that some of the Thiokol personnel described yesterday, one of the "long-term" improvements was to incorporate that same latch or capture feature on that inboard leg of the clevis on the steel case.
Even before the August 19th meeting here at headquarters, the discussions had evolved to the point where my element project manager, Mr. Wear, deemed it prudent to go ahead and order the forgings with an additional three inches on the ID such that when we designed and did the stress analysis and got the design complete, we would be in a position to machine that capture feature in for steel cases.
Now, you only need that on the field joints, because there is no problem with the factory joints because they have the insulation over that.
We're in a position to start getting those segments in, after we go through the design review on those, in the fall of this year.
MR. RUMMEL: It seems to me a substantial difference or a large interval in time, if I understand this correctly, between the availability of the capture joint in the steel case and the availability in the fabricated wound case.
MR. MULLOY: Oh, yes, sir. It was incorporated initially in the design in the wound case, which is just- it is just a ring that goes onto the composite. And it just wasn't decided until July [886] of 1985 that we wanted to protect the option for being able to put that on as a long-term improvement.
And it is about a year and a half lead time from the time you get a forging until you get a part.
MR. RUMMEL: Well, I guess the problem I'm having is it seems apparent to me, as we were hearing the discussion yesterday and today, that considerable concern has existed with respect to maintaining the seal in the O-rings for a very extended period of time. And I am puzzled as to why, if that's so, that is compatible with what may seem to be a delay in the decision to incorporate the capture ring in the steel case.
Do you care to comment on that?
MR. MULLOY: Yes, sir. There was a great deal of testing, as we have testified, starting in mid-1984, going through 1985, with a dedicated effort at trying to isolate the variables, if you will, that tend to increase erosion and primary O-ring blow-by.
There were a lot of concepts evaluated. The capture feature was one of those. There was the intense effort was on the near-term solution, because there is such a long lead time on that, and it just was not concluded- and I'm not offering any excuses for that, but it just was not concluded until July, when everything kind of came together that said, what we need to do is put a .292 diameter O-ring in the field joint, put a spacer in the primary O-ring on the nozzle joint, and incorporate a capture feature as soon as possible.
And Thiokol made that recommendation at the August 19th briefing here at headquarters, and we had already moved out in advance of that.
MR. RUMMEL: Could that have represented an effort to use up production on hand without the capture ring, for example, prior to moving into the capture ring situation?
MR. MULLOY: No, sir. As I say, we would mix these, the casting segments. There are two segments with each one. So the only one that we need the capture
feature on is the tang of the field joint. So we would be mixing in the current inventory with this, with the new case segments with the tang incorporated.
And we would continue throughout the program to use the existing inventory of those segments. We don't have to set those aside. We were able to use them without the capture feature.
CHAIRMAN ROGERS: Thank you very much. We will be able to pursue this later on, I'm sure. Thank you very much, Mr. Mulloy. Thank you, Mr. Hardy.
Now, Mr. Lovingood and Mr. Reinartz.
(Witnesses sworn.)
[Please note that some of the titles to the references listed below
do not appear in the original text. Titles are included to identify
and clarify the linked references- Chris Gamble, html editor]
[887] [Ref. 2/26-1 1 of
15] Statement to the Presidential
Commission on the Space Shuttle Challenger Accident: G.B. Hardy,
February 25, 1986. [Ref. 2/26-1 2 of
15] Statement to the Presidential
Commission on the Space Shuttle Challenger Accident: G.B. Hardy,
February 25, 1986. (continued).
[888] [Ref. 2/26-1 3 of 15] Statement to the Presidential Commission on the Space Shuttle Challenger Accident: G.B. Hardy, February 25, 1986. (continued). [Ref. 2/26-1 4 of 15] Statement to the Presidential Commission on the Space Shuttle Challenger Accident: G.B. Hardy, February 25, 1986. (continued).
[889] [Ref. 2/26-1 5 of 15] Statement to the Presidential Commission on the Space Shuttle Challenger Accident: G.B. Hardy, February 25, 1986. (continued). [Ref. 2/26-1 6 of 15] Statement to the Presidential Commission on the Space Shuttle Challenger Accident: G.B. Hardy, February 25, 1986. (continued).
[890] [Ref. 2/26-1 7 of 15] Statement to the Presidential Commission on the Space Shuttle Challenger Accident: G.B. Hardy, February 25, 1986. (continued). [Ref. 2/26-1 8 of 15] Statement to the Presidential Commission on the Space Shuttle Challenger Accident: G.B. Hardy, February 25, 1986. (continued).
[891] [Ref. 2/26-1 9 of 15] Statement to the Presidential Commission on the Space Shuttle Challenger Accident: G.B. Hardy, February 25, 1986. (continued). [Ref. 2/26-1 10 of 15] Statement to the Presidential Commission on the Space Shuttle Challenger Accident: G.B. Hardy, February 25, 1986. (continued).
[892] [Ref. 2/26-1 11 of 15] Statement to the Presidential Commission on the Space Shuttle Challenger Accident: G.B. Hardy, February 25, 1986. (continued). [Ref. 2/26-1 12 of 15] Statement to the Presidential Commission on the Space Shuttle Challenger Accident: G.B. Hardy, February 25, 1986. (continued).
[893] [Ref. 2/26-1 13 of 15] Statement to the Presidential Commission on the Space Shuttle Challenger Accident: G.B. Hardy, February 25, 1986. (continued). [Ref. 2/26-1 14 of 15] Statement to the Presidential Commission on the Space Shuttle Challenger Accident: G.B. Hardy, February 25, 1986. (continued).
[894] [Ref. 2/26-1 15 of 15] Statement to the Presidential Commission on the Space Shuttle Challenger Accident: G.B. Hardy, February 25, 1986. (continued).
[895] [Ref. 2/26-2 1 of 3] History of O-Ring Damage in Field Joints.
[896] [Ref. 2/26-2 2 of 3] History of O-Ring Damage in Field Joints (Cont).
[897] [Ref. 2/26-2 3 of 3] Field Joint in Rocket Motor.
[898] [Ref. 2/26-3 1 of 2] SRB Critical Items List [Dated: December17, 1982- Failure mode & causes: Leakage at case assembly joints due to redundant O-Ring seal failures or primary seal and leak check port O-ring failure.].
[899] [Ref. 2/26-3 2 of 2] SRB Critical Items List [Dated: December17, 1982- Failure mode & causes: Leakage at case assembly joints due to redundant O-Ring seal failures or primary seal and leak check port O-ring failure.]- continued
[900] [Ref. 2/26-4 1 of 14] SRB FRR 51-E (STS-22) Action Item Closure Paper.
[901] [Ref. 2/26-4 2 of 14] SRB FRR 51-E (STS-22) Action Item Closure Paper (cont). [Ref. 2/26-4 3 of 14] SRM-13A Nozzle Joint O-Ring.
[902] [Ref. 2/26-4 4 of 14] Technical Issues (Cont)- Comparison of STS-51C and STS-51E. [Ref. 2/26-4 5 of 14] Technical Issues (Cont)- Comparison of STS-51C and STS-51E.
[903] [Ref. 2/26-4 6 of 14] Technical Issues (Cont)- Comparison of STS-51C and STS-51E. [Ref. 2/26-4 7 of 14] STS-51C (SRM-15) STS-20 O-RING EROSION SCENARIO.
[904] [Ref. 2/26-4 8 of 14] STS-51C (SRM-15) STS-20 O-RING EROSION SCENARIO. [Ref. 2/26-4 9 of 14] HPM Predicted Pressure Gradient 70 degree Base Prediction Data.
[905] [Ref. 2/26-4 10 of 14] SRM 16B Center Field Joint Squeeze Analysis With Temperature Differential. [Ref. 2/26-4 11 of 14] Technical Issues (Cont) -Temperature effects.
[906] [Ref. 2/26-4 12 of 14] Technical Issues (Cont)- Field Joint O-Ring Squeeze (%). [Ref. 2/26-4 13 of 14] Technical Issues (Continued) - Analysis of Soot from STS-51C LH Forward Field Joint.
[907] [Ref. 2/26-4 13 of 14] Flight Readiness Assessment for STS-51E.
[908] [Ref. 2/26-5] General Conclusions.
[909] [Ref. 2/26-6] MTI Assessment of Temperature Concern on SRM-25 (51L) Launch. Signed: Joe Kilminster.