This is a lecture 6 of the Systems Engineering curriculum from MIT and edX, Engineering the Space Shuttle.

Links to the lectures:

1. Origins of the Space Shuttle or The Making of a new Program
2. Development of the Space Shuttle
3. Bureaucratic Space War
4. Political History of the Space Shuttle
5. Space Shuttle Orbiter Subsystems
6. Orbiter Structures & Thermal Protection System (TPS)
7. Space Shuttle Main Engines

---

The first human to fly to space Yuri Gagarin during re-entry said something that for a long time was hidden from public: “I am burning, farewell, friends!” I was told that he added a few expletives that are not translatable.

Nobody before Gagarin had any idea how a spaceship will pass through the dense layers of the atmosphere on descent. Gagarin was a military pilot and when he saw raging fire in the porthole, he thought that his spaceship was on fire and he was going to die within seconds.

Gagarin did not know that friction of the heat resistant shield of the spaceship against the atmosphere is an expected operational condition that happens on every flight. He was the first human to see this impressive effect.

During ballistic trajectory descent the cosmonaut experienced eight or nine G forces and when the return capsule entered the atmosphere, he witnessed a terrifying view, the shell of his capsule started to burn and liquid metal trickled along the windows of the porthole.

The spaceship he was in could not land, it was not designed to land, at the elevation of 1500 meters he had to be ejected! One of the reasons why the capsule did not have a mechanism of soft landing was that the engineers and designers feared welding of the hatch under the high temperatures of reentry.

Re-entry from space into the atmosphere is the hardest operation to execute. Analogy is jumping into water from a high cliff, water feels hard like asphalt. It’s the same with air, an object hits a wall of air and quickly heats up. We’ve known that since the first rockets we launched into space. Designing for the re-entry is the most critical part of aerospace engineering. Space Shuttle geometry can be questioned based only on this operational requirement.

Making re-entry of the same vehicle repeatable has never been done before and is impossible without significant refitting of the heat shield on the ground, but the requirement was to have many re-entries with minimal amount of repair and a quick turnaround. The requirement had to be questioned by the program chief engineer! With current systems like Apollo and Soyuz, the heat shield slowly burns off while the capsule gets through the re-entry very quickly, in under 4 minutes. It takes the shuttle more than 12 minutes to re-enter!

As the shuttle comes back in and dissipates its energy through drag and heating, 90% of the heat is radiated away from the vehicle, 10% of it goes into the vehicle. By design, by the time the heat gets to the vehicle, the vehicle is back into an atmosphere where it’s not heating anymore.

Analysis of Columbia accident is below. The accident highlights fragility of the engineering decisions for the shuttle and in particular overreliance on the computer system to control the vehicle during this critical time interval. It was the computer program that failed dooming Columbia. What happened then was very similar to Boeing 737 MAX problems with software incorrectly correcting angle of attack showing that lessons were not known to the Boeing engineers.

Russian aerospace engineers who were not working on the Russian version of the shuttle called Buran were very critical of the Buran project and usefulness of the vehicle. At the end of transcribing these lectures I will write about Buran and maybe about some other systems.

Interesting trivia about shuttle heatshield made of tiles. Shuttle could not be landed when it rained. So, when it rained in Florida, the shuttle had to be landed in places where it was sunny!

Here’s a video how reentry of the shuttle looks.

Here’s the video explaining the heatshield tiles:

And a picture.

When the shuttle was designed and built, space junk was not considered a threat. Below two images highlight environmental dangers that such complex designs must be analyzed for.

---

Columbia Accident

The angle of attack is defined as the position of the ship relative to its line of motion.

The shuttle must descend slightly raising its nose exposing its belly to the streams of air.

Its belly is better protected than other parts of the fuselage just for this moment of entry into dense atmosphere.

If the shuttle descends like an airplane, the fire will engulf the entire ship.

That’s exactly what happened to Columbia.

Plasma got inside the wing which was damaged during the launch. The wing did not withstand abnormal temperatures.

The shuttle onboard computer sensing deviation in the trajectory started to straighten it and lowered the nose.

Below is the dialog by the crew of Columbia.

– Do you see the flow of fire in the window?

– Yes, I see it. I am trying to raise my head to see what’s happening in the upper window.

Astronauts waited to see when molten plasma will be seen in the windows. They did not yet guess that Columbia started to break down.

– There are excellent views outside! I am filming the window right above my head.

These images were captured during the last moments of life of the astronauts. The tape miraculously survived during the accident.

– Can you look at the camera for a second? Look at me!

The shuttle disintegrated into thousands of small pieces. Astronauts did not even have theoretical chances for survival. Emergency escape from the shuttle is only possible at the elevation from 2 to 10 kilometers.

---

The most interesting quotes from the lecture:

Necessity was the mother of invention!

Let me give Aaron a lot of credit. His favorite word, the whole time he was the project manager, was no. And he had above his blackboard: better is the enemy of good. We’ve got something, we know it will work, we knew that damn configuration would work.

One thing that’s important, whenever you do a project or you’re in charge of something, you don’t want to have Yes-people around you. You want to have people that say you’re not doing it right.

The thing that’s most deficient from my perspective in the United States today are good systems engineers. There are very good thermal engineers, good structural engineers, good propulsion engineers. There are very few systems engineers that are good.

As we went into these requirements, and from a government system’s perspective, now the challenge was to give the contractor the requirements that they need but don’t over-specify the requirements.

Although the shuttle was designed for a hundred missions, it was always assumed that those hundred missions would be flown over the course of just a few years.

The idea with avionics was, they would not be good for that length of time, so we will change them out, we’re going to have to upgrade them anyway. It took ten years to change the general-purpose computers because of all the certification.

We got the first set built and we fired everybody because we didn’t have enough money to keep them on the payroll for the rest of that year. We literally laid everybody off at Rockwell in Tulsa.

A lot of people said, especially after Challenger, let’s get rid of this vehicle because it’s antiquated and was designed too long ago. That probably is still one of the most advanced composite structure vehicles flying today.

One thing that’s not part of the curriculum here is political systems engineering. You can have the best engineering design in the world, but if you don’t have the political support in a program like this it doesn’t matter.

---

Images are credit to NASA.

---

Introduction by Jeff Hoffman

After Aaron Cohen’s Introduction to Space Shuttle subsystems we’re now starting a series of lectures going into the details of these systems as told by the people who designed them. We start with the orbiter structures and the thermal protection system, both absolutely critical for the physical survival of the shuttle during launch and re-entry.

However, Tom Moser devoted the first part of his lecture to observations about Systems Engineering which, as I’ve said on numerous occasions, is an important theme of this course. Remember that Aaron Cohen said in an earlier lecture that early in the history of the space program people were actually trying to figure out what systems engineering was all about. In these lectures you have the opportunity to hear different people give their opinions about the most important aspects of systems engineering and I hope that by the end of the course you will form your own ideas about this. Anyway, take advantage of Tom Moser’s introduction to systems engineering.

After the first segment Tom gets into the nitty gritty of how the orbiter structure was designed, tested, and certified. Certification is critical in human space flight. It’s fine to design a system using best principles of engineering, but how do you show that it will really work and keep the crew safe? Certifying space systems is expensive and difficult, so pay attention to how it was done for the systems Tom Moser talks about and for all the other systems that you’re going to hear about in future lectures. With the exception of some special aircraft like the SR-71 Blackbird and the supersonic Concord, when aircraft are analyzed for stress the critical elements are all mechanical. The space shuttle certainly had to endure a lot of mechanical stress during launch and landing and Tom goes into quite some detail about how they calculated the stress and designed the structure to handle it. However, a unique aspect of the stress analysis of the shuttle was the thermal extremes that it experienced in orbit and during re-entry. Tom mentions that thermal stress, contributed about 30% of the total stress on the shuttle and he spends a lot of time explaining how they calculated this and designed for it.

I want to remind you again that the space shuttle was designed in the era before computer-aided design became a standard procedure. I’m continually impressed when I hear how the designers were able to work in the pre-computer era and still were able to create the world’s most complex spacecraft and it actually worked! Tom talks about releasing drawings for the shuttle structure and remarks on how you never want to recall drawings for changes because it costs so much.

Remember, there was no computer graphical design capability when the shuttle was designed so all drawings were done by hand.

We used to joke about why it costs so much to install say just a different kind of electrical switch on the shuttle. Maybe you spent 50 dollars for the new switch, then you have to spend 500 for the salary of the technician who changes the switch, 5,000 dollars goes for all the safety certification of the new switch and to pay the salary of the Safety Engineer who has to watch the technician change the switch and fill out all the paperwork certifying that it was done correctly, but then you have to pay 50,000 dollars to update the drawings.

Well, the world has changed a lot since then, mostly for the better.

The last segment of Tom’s lecture deals with the space shuttle’s thermal protection system.

Actually, he just deals with the silicon tiles that cover most of the shuttle, not the carbon-carbon nose cap or the wing-leading edge that was penetrated by the debris and led to the Columbia disaster.

His presentation is a bit rushed unfortunately because he was running out of time, but I think it should give you an idea of the systems engineering processes that had to be gone through in selecting a thermal protection system that was lightweight and reusable, something that had absolutely never been done before. So, pay attention to what Tom and his colleagues have to say in this and the following lectures. Tom’s lecture is not overly technical. Occasionally he talks about details of stress concentration, but even if you don’t have a technical background and can’t follow all of the engineering details please try to listen to the entire lecture because it will give you a sense of the complexity of the task faced by the designers of the space shuttle and show you the systems engineering techniques that they used.

Let’s now get started looking at the details of what this course is all about: engineering the space shuttle.

Introduction by Jeff Hoffman (2005)

As I mentioned at the last lecture, we’re now moving into the nitty-gritty of the subsystems and we have quite an extraordinary list of speakers who actually worked on the original design of these systems. As Professor Cohen mentioned, not only did they design these systems for the shuttle but, in most cases, they came from having designed essentially the same systems on the Apollo program.

Tom Moser asked me if we had this book by Dennis Jenkins. This really is a rather complete book. A lot of the material that you’ve seen, the early design of the shuttle is in here, discussions of subsystems, and then detailed discussions of the individual flights all the way up through the first 100 shuttle flights. It’s a very nice resource.

Introduction by Aaron Cohen

Tom Moser is going to talk to you today about the structures on the space shuttle. As Jeff mentioned, Tom did the same work on the Apollo program.

I was the manager of the Command and Service Module on Apollo and on the Space Shuttle orbiter, so Tom and I have been working together for many years and I relied very heavily on Tom.

I told a little anecdote the other day, and just let me say it again because the person that helped me with it is Tom Moser.

During one of the shuttle missions we were getting ready to come back. At about 11:00 at night I was getting ready to leave my house to go to the Control Center which I live about ten minutes away. We were getting ready to make the de-orbit burn when I got a call from Rockwell International, their head of the program there.

– Aaron, we just did this test. We took the panel of tiles and dumped it into a bucket of waterproofing agent and all the tiles came off.

– What do you want me to do with that information? They’re getting ready to come back and there’s not much I can do about that. You’re telling me all the tiles are going to come off?

– No, they’re not going to come off because that’s not really what we did on the shuttle.

– Why did you do that test? That’s sort of a dumb test.

I had a decision to make whether I’d call the people in the Control Center like Chris Kraft and tell him we did this test and all the tiles are going to come off. But we’ve got to come back. I decided what I would do is call my good colleague Tom Moser.

– Tom, what should we do?

We talked for a while and talked for a while, and we decided to keep this information to ourselves until after the landing. It turns out it all worked out fine, there were no problems.

But my point to you is that how much I relied on Tom. The other point is, you may find yourself in that type of situation some day on a project maybe not associated with that.

Afterward Tom turned out to be my Deputy Manager in the Orbiter Project Office. Then he went on to become Head of Engineering at the Johnson Space Center and then went on to be Director of the Space Station in Washington, DC and now is a consultant.

So, with no further ado, let me turn it over to Tom.

Orbiter Structures and Thermal Protection System (TPS)

Just a little bit of credit and recognition of some of the people that made this thing happen.

You’re going to hear from a lot of these people. You won’t hear from John Yardley or Max Faget because they are deceased now, but these people up here made this program go.

There is one unique thing about a program as complex as this and that is the technical and the management teams have to work together and get together. Everybody that is listed up there stayed on this program from day one, and that is key. I don’t think there has been a program since then that that has happened and I think that if people judge the Shuttle Program as being successful, that’s a major contribution to that success.

When the studies began in 1968, from concept studies all the way down through operations, from a structural perspective at each one of those design phases the most important were weight, cost, and producibility.

The last phase of the design process is certification: How are you going to certify this thing? How are you going to prove that it’s good for flight? How are you going to prove that the crew is safe? And you have to do it on the ground.

I’m going to break this lecture into two pieces: Orbiter Structure and the Thermal Protection System.

Orbiter Structure

In 1968 through 1972, concept studies were conducted in order to conceive and characterize (qualitatively and quantitatively) the concepts that would serve as a Space Transportation System.

The only requirement in the shuttle program was to have a reusable space transportation system, get something that goes from earth to low earth orbit and back reliably and is reusable.

There wasn’t a requirement on payload size nor on the number of missions.

The variables that we all looked at were yearly budgets, developments costs, and operations cost.

You can spend a lot of money on development and reduce the operations cost or you can spend a little bit of money on development and have very high operational cost. So, there’s a trade-off there. And when you’re dealing with budgets that you really don’t understand exactly what they are, that’s a very important variable.

Payload mass and size is important from a structural and thermal standpoint because it has to do with mass, and it has to do with energy that has to be dissipated during reentry.

The operational orbit is important.

Fully reusable flight system or partially reusable, and that’s a trade on cost and weight.

Turnaround time and cross-range. Cross-range is, after you come back into the atmosphere to be able to deviate your normal ballistic trajectory coming back in. Cross-range was critical to us at this point. NASA didn’t have a requirement for cross-range, but the Air Force thought that they had a requirement, so we had to include that.

Important from a structural standpoint, as we got into the next phase, is the efficiency of the load path, the weight, the payload size, the aerodynamic surface loading, the wing loads, and how does that manifest itself in weight and producibility.

We did that under two years of contracted effort. Then, within the Johnson Space Center (JSC) which was formally the Manned Spacecraft Center, we conceptionally looked at designs in-house snd we looked at 53 different designs.

We got a group of people of about 20 people and went away and locked ourselves up. We had expertise in every area: propulsion, guidance and control, aerodynamics, aero heating. We were almost doing a configuration a week. So, when you look at 53 different configurations over basically a two-year period, we were not only just looking at it, but we were quantifying them, what it meant in terms of all the parameters that I showed: How much did it cost? What was the development cost? What was the operations cost? What was the weight? What was the maximum temperature on the vehicle? Was there a thermal protection system that could accommodate those types of temperatures?

We were looking at the variables. In other words, when we looked at 53 different things, we looked at payloads ranging anywhere from 15,000 to 40,000 pounds. We looked at payloads from 8 feet in diameter to 15 feet in diameter, 30 feet long to 75 feet long. We were looking at all those things.

We didn’t know what the answer was going to be. The driving parameter there was reusability and cost profile. We thought we knew what we could afford to do.

And, as we did that, we changed configuration from a straight wing, which is not good for cross-range, to a delta wing which is better for a cross-range, to a double delta wing which is even more structurally efficient.

Landing weight was important. Just like the plane landing, it had to get landing weight down to where it could control it. That was the same thing we were doing. We were looking at landing weights not only from a controllability but also from a producibility.

We looked at weights from 70,000 to 215,000 pounds, boosters from fully reusable to partially reusable, propulsion systems and various types of things. We even looked at air breathers so that the shuttle didn’t have to come back a dead stick like they do now.

So, we looked at all of those and we not only looked at it, we quantified it to the extent that we could get the first order estimates on what the cost in all those things where.

Below are several MSC configurations.

The MSC-001, also known as the DC-3, was the first serious in-house look MSC engineers took at developing an orbiter. The locks and hydrogen are inside the orbiter. It has a straight wing, so it was fairly lightweight except for having to carry all that tankage. The engines were on the orbiter itself, but the payload was really small. We came up with a very low cross-range, probably 8-foot payload-bay diameter and 40,000-pound payload capacity which was very low, and the cost profile didn’t fit.

We evolved that over a series of studies until we finally got down to about February of 1972 where we said, we’re going to have a larger payload than this.

Other boosters were considered by NASA for the MSC-040C orbiter, such as this single large solid rocket motor attached to the aft end of the external tank.

We came up with a configuration that’s almost like the shuttle that you see today: large payload, the main propulsion systems are outside the orbiter, it’s a fly-back, and part of it was throwaway. We had a booster in line with the external tank rather than in parallel with it like the SRBs are today. That’s almost what we started the detailed design and development with.

Part of the continuing research to find a method of handling the engines, this design again attempted to retract the engines into the orbiter when the ET was jettisoned.

Some of us who like to worry about load pass, simplicity, and low weight of the structure, we said we will put the engines on the external tank shifting all the mass down, reduce the weight of the orbiter which is going to reduce development and operations costs.

For reusability we had to swing the engines from the external tank back up to the orbiter and stow them for entry for which our brother in mechanical engineers beat us pretty hard, they beat us black and blue. That was a concept that we looked at very late in the program and that didn’t go anywhere even though Max Faget and I wanted to do it pretty badly.

Now we are four years into the thing, we’ve done all these systems engineering analysis, so we end up with a final concept.

We want a 2.5 stage launch vehicle because it costs too much to fly back the booster. We just didn’t have the money, so we said we want to have the most important part be fully reusable, so that was the orbiter. Half a stage means that the external tank is like a half a stage. The SRB is a stage, the orbiter is a stage, but the tank is a half a stage.

It was going to be a delta wing. We figured that we had a mission model of 500 total missions, 100 missions per vehicle, and there were five vehicles.

We had an ascent acceleration of 3 g’s. Why was that? The requirement was to keep down the inertia loads, but it was also to let people off the street flying the thing.

We kept the max dynamic pressure down because that was a major driver for control systems and for aerodynamic services. You would love not to have the wings on the Orbiter going uphill. That’s a penalty that you pay, so one of the things to help reduce that is to keep that aerodynamic load down on the wings.

Then for atmospheric flights, we said this thing is going to come back like an airplane, let’s fly it, let’s design it like an airplane: 2.5g normal maneuver load factor and a negative 1g.

A crew of four for one week. That becomes important because that sized the crew module, that sized a lot of the environmental control systems you’ll hear about later and other things in the life support systems. Without a lot of changes, to show you what the flexibility and capability of this vehicle is, the orbiter is now flying seven people for two weeks. It went from 28-man-days to 63-man-days. I don’t think a lot of people understand what that has done. There is a lot more robustness in the orbiter, in the shuttle system that was not designed into it but had some inherent capability and some of it was a little bit of forethought.

Here comes the Air Force stuff: 65,000 pounds up, 40,000 pounds return. 15 x 60 diameter to length. Another important thing is we didn’t know what they’d be but maybe up to five deployable payloads at a time. And that’s going to become a problem as we start peeling this systems engineering onion of getting down into the details.

Cross-range. A little less than 1300 nautical miles cross-range.

TPS material. We didn’t know what the hell it was going to be, but that’s what we started with.

We began the contract for design, development, test and evaluation. NASA does pretty good stuff in-house. But when it gets down to doing the design and manufacturing and cost-control, down to the detailed parts and manifesting everything around, that’s where the contractors come in. NASA doesn’t have that capability in a large program.

This is where we gave a contract to Rockwell International. They had the integration and the orbiter contract. Another company, Martin, had the external tank. Backhaul had the SRBs.

This is what they started with. That was their authority to proceed configuration, even though this is shown as in 1972. But you see there is very little difference in the configuration then and what the configuration is today. There was some minor mods which are not worthy of even talking about right now.

Let me give Aaron a lot of credit. His favorite word, the whole time he was the project manager, was no. And he had above his blackboard: better is the enemy of good. We’ve got something, we know it will work, we knew that damn configuration would work. And Aaron got inundated with people coming back after we started the program.

– Aaron, if you put reaction control jets out on the wing tips and here and up on the vertical stabilizer you get a lot more control authority.

And when you guys start looking at this guidance and control stuff in propulsion, you’re going to come up with that. But, it complicated the entry in the thermal protection system, it complicated getting the fuel to those things, so Aaron said no, no, no.

And the astronauts would come in. They’ll always meet with Aaron at 7:00 in the morning because that’s when they would get their word in. They would have to go do flight training or something like that. And, as they walked out the door, Aaron would say no.

They didn’t hear him, but it was always no and that was critical in this thing. And so, the program came in at $5.1 billion. It started $5.1 billion. It came in at $5.1 billion. It was only because of being able to say no.

But to say ‘no’ you better do a good systems engineering job at the beginning.

And were there some faults and errors? Yeah. I’ll confess and open my kimono here on the few of the things, but all in all it wasn’t too bad.

I will say one other thing about systems engineering. It was interesting to watch four or five different large companies look at the various concepts. I can say this now because none of these companies even exist in the form that they were then.

Grumman had a very large systems engineering organization.

Rockwell had a very small systems engineering organization, almost down to one or two people, but they were extremely good. They were extremely good systems engineers.

NASA went with Rockwell for a number of reasons, but one of the things that probably benefited the program was having a very concentrated set of engineering requirements coming out of a systems engineer which almost turned out to be one guy, Ed Smith. And he was very, very good at that.

The reason I bring that up to you, the thing that’s most deficient from my perspective in the United States today are good systems engineers. There are very good thermal engineers, good structural engineers, good propulsion engineers. There are very few systems engineers that are good. If you make a note of that and become one of those, you’d be highly sought after.

A little bit of this is a repeat. As we went into these requirements, and from a government system’s perspective, now the challenge was to give the contractor the requirements that they need but don’t over-specify the requirements.

We were very careful to say: Here are the top-level requirements, don’t ask us what the internal loads on the wing are because we’re not going to tell you what that is, that is for you to decide. And, if you want to change something within these constraints, you can change it, but the burden is on you to make everything else right.

That is something that I think the orbiter did probably better than the external tank.

The top-level requirement changes as the phase changes. In the very beginning, in 1968, the top-level requirement was a transportation system. We don’t know what it’s going to be. Reusable, and we don’t know how much payload it is going to have to carry. So, that was the top-level requirement. Then it was to look at all of the combinations of things to create a feasible solution. And we think that this is about what it is going to cost.

The granularity of the requirements increases as the program advances.

For the challenges, now I’m going to call it the challenges of beginning this thing, we know what the configuration is, we know what the design life is, et cetera, all that kind of stuff, but we still haven’t decided on what the material of the airframe is going to be. We estimated some stuff, it could be aluminum, or it could be titanium, and it all fits within the right cost and performance envelopes, but let’s optimize that from a systems standpoint a little bit and see what that is.

Some of the challenges in structural design, and I’m going to talk about each one of these things that’s listed on here separately, should the cabin be an integral part of the fuselage or should it be a pressure vessel floating within the fuselage? Trades to be made.

How are we going to account for thermal stress in this? Well, what the hell is thermal stress? In Apollo we didn’t care a whole lot about thermal stress, it really wasn’t an issue, not to the extent that a vehicle like this is very sensitive to thermal stress.

Compartment venting. We’ll talk more about that.

Major structure concept trades to reduce weight.

And then how in the hell do we get the design loads on this thing?

From a structural design criteria, we said, well, let’s start with 1.5. That’s what all airplanes are designed for, so we’ll do that even though some of the boosters were designed for 1.25. Ultimate Factor of Safety is the allowable of the material that you’ve decided to use compared to the maximum expected load that you will ever want to see, three sigma kind of loads. And then whatever the factor is above that, that’s the factor of safety. So, you simply take the maximum loads you can expect to find, multiply it by 1.4 and it better meet what the allowable is. If there’s margin in that allowable then that’s called a design margin. Ideally, you would like to have zero margin. That still gives you a 40% factor of safety.

Yield is classically something that you decided on material. Well, I want to also have a factor safety on yield. And we sat around and asked ourselves: Why the hell do we care about that? The only thing you don’t want it to do is you don’t want it to deform such that it won’t operate – doors won’t open, hinges won’t work, et cetera. We did not impose on the program the yield factor safety. We did it on the orbiter, the external tank did. And they paid a weight for that because if you put a 1.2 factor safety on yield for some materials, that gives you a lower allowable than an ultimate factor safety when you’re really only interested in ultimate strength.

And then we said thermal stress is going to be important, but we don’t want to be so conservative that we let the thermal stress add in such a way that it adds conservatism but at the same time we don’t want to count on it if it’s relieving when we cannot really rely on it to be there so it is decreasing from the stress point of view.

A scatter factor of four on life for a hundred missions. Scatter factor just means a factor of four. If you have 10,000 cycles at 20,000 psi stress, then you have to certify it for 40,000 cycles. Typically, most airplanes you fly around on, they have a design life of about 20,000 flight hours. They are fatigue tested to 80,000 flight hours to make sure that they have that kind of factor on life.

And then we said well, this thing is going to be used a lot, we’ve never looked at that before so we will arbitrarily say we’ll use a 1.2 factor at the end of life or ultimate.

And then materials – these are just classical engineering material allowables that everybody uses today.

– A lot of people have mentioned lately, as we were thinking of the end of the life of the shuttle, that although it was designed for a hundred missions, it was always assumed that those hundred missions would be flown over the course of just a few years. And so, I think it’s true, you are more concerned with the long-term effects of stress than things like weathering or being exposed to salt, air over 20 years. Is that correct?

Well, you hit a very key point. And you’re exactly right. It turns out a hundred missions wasn’t really designing anything. It could have. As a matter of fact, it didn’t. I don’t know of anything a hundred missions design is for a cyclic stress: ‘high cycle – low stress fatigue’, or ‘low cycle – high stress’. It didn’t. But the environment sitting around or the life of the material exposed has. The leading edge turned out to be. There is a degradation in the strength of the leading edge carbon-carbon material because of being exposed to the conditions. There was some corrosion found in the wings during an inspection. Nothing was wrong with the low carrying capability, except it was beginning to corrode.

Avionics were different to structures. The idea was, they would not be good for that length of time, so we will change them out, we’re going to have to upgrade them anyway. It took ten years to change the general-purpose computers because of all certifications.

The Apollo program was 1.2 factor of safety for some conditions because it was a single use item. It was 1.5 on others, for example for pressure it was 1.5 psi. You say, well, why was it different for pressure than it was for others? Because there was some historical data there that NASA had that said that was the right thing to use. On the boosters it was 1.25, but on the command module itself it was 1.5.

One of the challenges that we had was to establish a combined stress criteria. We had to assure that there was a realistic stress that we were putting on the vehicle and we weren’t being overly conservative with it, we were not reducing the stress because of thermal gradients, and then we were incorporating the classical pressure induced stress.

And now, what were the details of that? Here were the details.

We came up with this algorithm that says we will use a factor of 1.4 on all external loads because that’s aerodynamic loads, inertial loads and so forth. We will use a factor of 1.4 on the thermally induced loads. They are thermally induced strains and stress. We’ll use a 1.4 factor on that if it’s additive to the mechanical, but if it’s subtractive we’ll only use one because we probably won’t reach the maximum thermal conditions so you cannot rely on that. On pressure we used 1.4, unless it was pressure alone then we used 1.5. But the whole thing, we would never have less than 1.4 of the total combined load.

And so, you say why in the hell did you do that? Why did you have to go to that kind of detail?

The reason being is because you probably had about 30,000 stress engineers working on the program, and they needed to know how to combine this stuff. If you didn’t, this guy is going to do one thing and this guy is going to do something different. We got it down to that level to save weight in the vehicle and save complexity in the vehicle.

We have our criteria set now.

Let me give one more story on marginal safety.

One of the people that I showed you at the top of the credits list was John Yardley. Aaron and Larry Young and other people would agree with this, John Yardley is probably the best engineer that I ever knew in my entire life. He’s probably one of the best managers I ever knew. John Yardley had the job of being the Program Manager on McDonnell Douglas F4 aircraft and he was an old stress guy. He knew that weight was going to be a critical parameter in the success of that program, and he had to keep the weight out. On that previous slide where I showed you the stress criteria and make sure that you have a zero margin of safety with a factor of 1.4, what he did is he told all the stress engineers because they all worked for him, design to a negative 10%. Which means, if you really do your job right this thing is not going to be able to reach ultimate load, it’s going to break. But he also knew that they were probably conservative because he was one of those guys. And he also had in his hip pocket, if he’s wrong, he would find out because he had the opportunity to do an ultimate load test on the airframe. It turns out, he did the ultimate load test, it passed the ultimate load capability and he saved a bunch of weight in airplane which made it a very successful airplane.

Sometimes from a systems perspective, it’s what you learn in the details or in the trenches as you’re coming up and being able to apply it, the same way that Aaron did a lot of stuff as he was managing the program.

On the airframe, we looked at a lot of different structural materials, we looked at a lot of different TPS materials, and some of the parameters that were coming out in there was not only strength of the material but how much heat sink there was because you were having to rely on that to keep the weight down.

Let me go up one slide and show you something here.

Starting on the left, it was all aluminum airframe, it had an ablator thermal protection system on it. And you said, I thought you said it was going to be fully reusable. Well, we also had a cost constraint, so we put that in there as a reference point and that was the lowest cost. It wasn’t quite the lowest weight, it was pretty low, but it still was violating the objectives and requirements that we had. And we said, that will be our reference point.

Then we looked at different types of aluminum. We looked a beryllium, we looked at titanium, we looked at the thermal protection system on a beryllium substrate, every kind of combination you could think of. The interesting thing was, look where the weights were staying, they were all staying within the 60,000 to 80,000 pounds total weight envelope.

What was happening is we were decreasing the thermal protection system thickness if we were using titanium, which we could operate to 600 degrees, and the TPS weight was going down. Titanium was not as good a heat sink as aluminum, even though we were working it to a higher temperature. And it turned out that the combination of TPS plus structure was pretty much a constant.

I’m oversimplifying it, but that’s basically what it was.

And you can see where the cost was.

The second column on the right of the graph is beryllium titanium. The cost was way out of whack compared to everything else, so we said we’re not going to do that. And there were some other exotic materials over here for hot structures.

We said, let’s now decide what this airframe material is going to be. It’s going to either be aluminum or titanium, and total weight, total cost doesn’t make any difference, they’re about the same. We weren’t smart enough to decide, so we went out to the Kelly Johnson’s skunk works.

Kelly Johnson designed and built more airplanes in a short period of time than anyone else. In the 1950s the SR-71 “Blackbird” was designed, and they had to develop titanium for that airplane because it was a hot structure design. We went out and spent some time with Kelly Johnson, we went through all this stuff with him.

– All right, Mr. Johnson, at the end of the day it’s a mix for us. Would you build it out of aluminum or titanium?

He said, aluminum. And the reason being is because titanium was so difficult to work to produce. The manufacturing was difficult. Today it’s a lot less difficult than it was then.

We made the decision and went with aluminum, so we had to protect that structure to 350 degrees. That was a lot of work and a lot of analysis to make that decision and we talked to Aaron and said that’s what we want to do, and he said go for it.

We got the airframe design, now we’re starting to put together the fuselage. We said, we can put this crew cabin as an integral part of the fuselage or we can make it a separate pressure vessel inside. We went through the trades on this and we came up with some of the discrete advantages.

• It’s a purely simple pressure vessel when you don’t have any inertia loads, except the mass that is inside the crew module itself.
• There is a discrete attachment between the crew module and the forward fuselage which means you could start the design and construction of these two things in parallel.
• Simple interfaces where you’re putting things together and modularity are extremely important. So, this created a very simple interface for us.
• Also, we didn’t have a lot of heat transfer to the crew module. It was easy to control the environment within the crew module. And we designed it out of a material, a 2219 aluminum, which had an inherent advantage of if it gets a crack, the crack doesn’t grow catastrophically under the operating stress before it starts leaking a lot. Well, that’s good because, from a crew safety standpoint, you know that if the seals are working and it’s still leaking, you’ve got a crack in that pressure vessel but it’s not going to be a crack that is going to propagate to be a catastrophic failure.

We chose the floating design.

When I talked a while ago about the crew of seven in two weeks now compared to four for seven days, back in 1972 we said we don’t know what the requirements are going to be, but let’s make this thing as robust as we can without penalizing ourselves weight-wise. So, we went back to Apollo and said, what were all the densities in the Command Module for the Crew Module? We figured out density and volume and made that our baseline.

Well, for another 50 pounds of weight we could increase the carrying capability of the crew module by about 500 pounds. That was a good trade at that time, so we did it. We just said, instead of for 25,000 pounds, we’ll design this thing for 30,000 pounds of payload carrying capability within the crew module.

It turned out to be a good decision. We weren’t smart enough to know operationally we’ll need larger crews for a longer period of time, but that helped us out a lot.

When you look at the structure of the crew cabin, in both of the shuttle disasters, the Challenger and Columbia, we have every indication that the crew cabin actually survived the breakup of the orbiter. It really was an excellent structure, but it was never designed to be a crew escape module. It had some inherent capabilities, probably could survive some things that it couldn’t had it been part of the fuselage, different flight regime, so it had that inherent capability. But it was never designed for it – and I know there was a lot of talk after Challenger that it looked like it would have survived all the way, but it would have never made it all the way. But it would have survived under a lot of conditions.

---

---

Apollo didn’t have a lot of thermal stress issues, but this vehicle skinnied down weight-wise as much as we can to the extent that any two different connecting pieces of structure, where there were different materials or different masses, were going to cause a thermal gradient. Thermal gradient causes thermal stresses. That was not only important to stress but also to all these tiles we were sticking on the outside of this thing.

We said, we have to look at every one of these thermal gradients and we have to understand what that induced stress is. We had an indication it was going to probably contribute about 30% of the total stress in the vehicle, it was going to be from thermal stressors at different flight regimes.

Kelly Johnson helped us deciding on aluminum and titanium. We said, why don’t we just fix this thing? We’ll design around all the thermal stress. We’ll put stress relief in it, like expansion joints along the sidewalk. We’ll do all these kinds of cute things and we’ll simplify the heck out of this.

As a matter of fact, the SR-71, the Black Bird, it had huge thermal stress problems. The wing on an SR-71, normally the skin carries a lot of the wing bending. Not true on an SR-71. It’s corrugated skin so it can expand and contract. All the wing bending is carried in the spar caps, the frames that go out the entire wing, and the caps themselves. They paid a penalty but avoided the thermal stress issue.

We said, we’ll be smart with that, we’ll go talk to the SR-71 guys, and we’ll go talk to the Concorde.

The Concorde was an airplane that had high thermal stress, even though it wasn’t that high a temperature. It was reaching 500 or 600 degrees outside, but it was moving fuel around all over the vehicle and when it moved this high mass of fuel from one part of the vehicle to the other, it was creating big thermal stresses. They knew what to do. They designed-in stress relief at these high points. It bit them. Every time they did it, they had fatigue failures. Every time they did that! They finally gave up and said, they would just accommodate.

We said, we’ll do that. Now then, we decided on that criteria, we’re going to account for thermal stress, but how can we do it? We don’t have a 3D model that we can apply mechanical loads to (I call aero loads/mechanical loads) and temperature distribution. The finite element model didn’t exist. We had a finite element model that had 50,000 degrees of freedom, but we didn’t have a computing capability to combine thermal and mechanical loads on there at the same time to be able to decide how to size the structure.

We said, now we’ve got a problem. What the hell are we going to do about that?

What we did is looked at what were the conditions causing the thermal stress. Going uphill thermal stress is not an issue. It’s all coming back in, in the entry phase. We knew we had initial conditions that were going to primarily be the cause of it. Coming back where the vehicle had been sitting in top sun for a long time, bottom sun for a long time, side sun for a long time, so we looked at those initial conditions as being the worse, and we proved to ourselves that it was the worst. Then what we cleverly did is we went around the vehicle where we had a detailed structural model of a lot of stuff and we created a hundred different thermal models of different types of structure. This is one that was in the wing truss.

We had a wing skin panel, we had a truss member and a lower wing skin panel, and we did a detailed thermal analysis of these hundred models. We then applied that to a structural model simplified, which was giving us the internal loads and stresses that we needed, and then we hand extrapolated that over the entire vehicle. There was no other way to do it.

So, as you look at your computing capability, probably on your damn laptop now, you couldn’t really do it on that, but think about that. But that’s the way we did that. It was a necessity that we had, but we didn’t have the capability, so we invented a way to do it, and it worked.

Another issue that we had. Normally you’d like to just vent everything through one area in the vehicle, but we couldn’t do that because the payload bay had to be very clean, it had to be contamination free and there was hydrogen in the backend of the vehicle, there was a pressure vessel in the front-end and a bulkhead up there.

We have dictated to ourselves that we have to design a venting system. This turned out to be a major part of a lot of internal loads in the vehicle because of venting from one compartment to the other, and, stop and think about it, we had vents all along the fuselage. We had a different pressure coefficient at each one of these vents for various attitudes during ascent, for various attitudes during entry, so we now had a whole myriad of complicated internal pressures that we had to accommodate.

That was pretty straightforward. We complicated our design with the venting system, but we had to do it to meet the requirement.

I don’t know that people are actually aware that there are all these vent doors because it’s not something that you would normally pay attention to in the pictures. In this book that Jeff referenced, it shows where all the vent doors are. And they do open and close at different times during ascent and entry.

When you start off, you’re at one atmosphere. As you rapidly go uphill there’s a delta p across internal bulkheads and internal compartments, internal and outside the vehicle. And, depending on what the flight regime is and where the shockwave is and where the vent door is, it’s changing the whole venting thing. That’s a whole lecture in itself on what we did.

The crew compartment is designed to have a delta pressure of one atmosphere, but inside the payload bay, that’s not designed to be a pressurized environment and so you need to be sure that the air can get out of the payload bay fast enough that you don’t over-pressurize, for instance, the payload bay doors or other parts of the structure. There were some other trades that we had to make.

Let me skip forward so you can better understand this.

The pressure differential across is huge, don’t forget the bulkhead is 15 feet in diameter so you can imagine the total loads you have on that with a couple of psi delta p. It’s big. That was a significant part of driving stresses.

We talked about simple interfaces between the crew module and the forward fuselage with bolted attachments. We had a simple interface between the wing and the mid-fuselage, a simple interface between the mid-fuselage and the aft fuselage, the same thing with the vertical stabilizer and aft fuselage and this orbital maneuvering propulsion system.

That was important from a structural point of view to be able to modularize and analyze these things, but it was also important because four different contractors built all these parts so they had to have an interface that they could not only design and analyze to but that they could physically attach to. Sometimes, when you have just a sketch on a piece of paper, you don’t think about that. And it does cause a little bit of complexity sometimes in a program.

The main structure is carrying 1.5 million pounds of load from the engines. How do we design that? We could have done a space frame or we could have done a truss configuration. We decided to go with the space frame or the truss rather than a plate girder, the term I didn’t use correctly. And with that we saved 1700 pounds of weight in the vehicle.

We used titanium. And this is a compression design. We thought we needed to get a little bit more weight out of this thing. What can we do to increase the compression modulus of titanium? We put boron epoxy, scabbed it on the axial load members of the truss structure, and that’s the way we got a lot of that weight out.

That was a manufacturing problem, I won’t go into now, of how you build this truss structure, but it works fine.

– We heard earlier that there was a CG problem in that the CG was too far forward in the aft but bled in the back for a number a number of missions. I was wondering how that weight that they had to add to the CG compared to the weight that you guys saved.

It’s not a problem. It’s something that has to be addressed on every mission, depending on what the payload is that you’re carrying. If you have a real heavy forward payload, yeah, you have to add some ballast to the aft end of the thing. Now, normally the way they do it is they’ll find some payload that can fit in the aft end to help ballast that. But I think, in some of the early flights, we put some ballast in the back for CG control.

We’ve carried many tons of lead into orbit, so it was ballasting the thing for control purposes.

The same way yesterday in Jet Blue, a lot of people had to move to the back end of the airplane because they wanted that CG for a little bit different landing performance.

Now, see what we’re doing? We started out with the initial trades in the early concept phases.

What’s the wing loading? We didn’t care about what the internal structure trades were. Now we’re getting down to trading all the stuff at a semi-macro level. And I’ll show you in a minute a micro-level that we had to get into, which was pretty interesting.

1307 bulkhead, we saved about 500 pounds there.

An interesting thing about the payload bay doors. We decided that for this vehicle to be safe and to re-enter, those doors had to close. We had a lot of trouble in Gemini with things on orbit not working. Mechanical systems quite often are problems, docking systems are problems, there have been a lot of door problems on orbit in spacecraft.

You design them and you put them in thermal vacuum chambers and they all work, but you get on orbit and sometimes they don’t work. Maybe it’s thermal distortion that we’re not accounting for.

So, we said that is critical. We’ve got to close these payload bay doors. The way we’re going to do that is the payload doors will carry only two types of load. They will carry pressure loads, and they’ll carry torsion loads. Because, if they are closed, we know that it is good for torsion in the vehicle, reacting torsional loads. But we will not let them carry body bending loads or else we cannot make them flexible enough. What we did is all of the body bending in this vehicle is carried along the longeron through the section in the lower skin of the vehicle. This is the modulus of the vehicle, if you will, at a cross-section between the longeron and the lower skin, payload bay doors don’t come into being.

And the way the doors close on orbit is they start zipping along from the bottom up to the top because they are flexible, zipping just a latch at a time, they were sort of ratcheting themselves closed, and then they close along the center line. There has never been a problem with payload bay door closures on orbit.

We could have made the vehicle lighter had we not done that, but we would have also complicated the safety of the vehicle.

Sort of in line, but it’s not the CG thing, we had a payload attachment issue. When we were laying out all this stuff in the early `70s, we didn’t know what the payloads were. We knew what the total mass was. We knew there may be five at a time. We didn’t know what they were.

You can just go in and bolt a payload into the fuselage of the orbiter, and if you just do that randomly or without thinking about it, all of a sudden you start analyzing the orbiter and you start twisting it, what happens? The payload becomes part of the load path. Now, all of a sudden, you have impacted the design of the payload or maybe you have impacted the design of the orbiter depending on what is happening in the payload.

We said, ah-ha! What we’ll do is make it statically determinant. If two things are attached statically determinately, they cannot interact with one another as far as their stiffnesses are concerned. We said that’s what we’re going to do. We’ll put attachments along the longerons to carry the axial loads, some along the keel to carry some of the lateral loads. And voila, we’ve got it. The requirement became that we would design it that way.

Now we understand what the attachment is, how do we determine within the CG constraints for these different masses? We had to assume what they were not knowing exactly the definition of the payloads. We did a Monte Carlo analysis.

Ten million cases of combined payloads! CG locations, numbers of payloads, forward, aft, all that. We did that with a Monte Carlo analysis. We said voila, that’s where we’re going to design the mid fuselage.

Detailed Design Loads

How do we determine detailed design loads? Because now it’s coming down to sizing the vehicle.

The initial part of the flight regime from liftoff through max Q is a critical loading condition that determines design of the orbiter.

The loads on the orbit are pretty benign. Nothing is really happening up there except some temperatures which are going to be important at the deorbit point, because now all of a sudden you start adding more heat into it.

The next critical loading regime is the entry where you’re maneuvering in the atmosphere.

Critical regimes for the airframe loads are only at the liftoff and landing.

Lift-off

To determine liftoff loads we had to look at all the variables associated with the rocket engines. The rocket engines have start sequences. We’ve got three main engines that are not going to start at exactly the same time, they’re not going to come up with the same thrust profile as they start up, the thrust vector misalignment is going to be different, and we also had to look at ignition over pressure, and that was a surprise to us.

Also, part of liftoff we had to look at winds and gusts, vortex shedding, proximity of aerodynamics to the other structures on the gantry in the pad. Then we had to do the pressurization and look at shrinkage of the components or elements at cryo-temperatures.

Here was a cross-section, in a generic sense, of what’s happening during liftoff. There is some combination of winds that you have to account for, the thrust profile from the SSMEs, the SRBs come up to thrust after you get confirmation that the engines are operating at full performance, and there is a lot of vibration and acceleration going on.

Here is something that becomes obvious after a while. When you have a vehicle that is tied down with a base moment and you put 1.5 million pounds of thrust on it, this vehicle is going to bend over in the direction of the tank. There is a lot of strained energy in the solid rocket motors when that happens. If you were to ignite the SRBs when that vehicle is over here, the party is over because it releases all that strained energy and the SRBs couldn’t take it.

When you see the Orbiter prior to liftoff, the SSMEs will come up, you will see the vehicle lean, and then, when it comes back over zero, voila, you kick off the SRBs, but you have to wait until it gets back to that neutral point. A little detail that is pretty important.

Ascent

Ascent is a really complicated part of the design of the vehicle, especially with the aerodynamic surfaces. You would like for these things not to be there during ascent. They don’t buy you anything. You just need them coming back.

Some other complications here are the acoustic effects which cause acoustic fatigue for the vehicle.

Another thing is the plumes of the vehicle are changing the pressure distribution as you’re going up. The pressure distribution along the orbiter, especially the wing, is changing the whole time you’re accelerating, not only through the various Mach regimes but also because of the blockage from the plume expansion.

We said how in the world are going to do that? We cannot analyze all of those things. If we do it deterministically, you won’t get a capability that you need, we thought, operational. One piece of data that we had was synthetic wind profiles for everything that existed at the Cape. That’s a given. We’ll use these synthetic wind profiles as a guideline to all of our winds aloft.

We need to decide what the angle of attack and the side slip is going to be through this vehicle flying through these winds and a control system that’s changing the attitude of the vehicle. That’s a factor that we have to consider and that’s going to be important for the design of the elevon surfaces and all because they’re getting loaded up pretty heavily at that time.

Dispersions in the propulsion system must be added.

And then, after we looked at all that, and you won’t find this in any textbook, we decided to take all these parameters and create something called a squatcheloid.

The term squatcheloid is a JSC/Rockwell coined term for a qα versus qβ envelope. The envelope shape is determined by the wind magnitude and direction. The squatcheloid can be shifted to the right or left ±qβ for yaw plane winds and up or down ±qα for pitch plane winds through trajectory shaping. Squatcheloid placement is the shifting of the squatcheloid to minimize design loads through trajectory shaping.

We flew the vehicle through different Mach numbers and we looked at the various combinations of dynamic pressure and angle of attack, and dynamic pressure and side slip – for all the Mach numbers. And then we said is that realistic to do, not only from a control systems standpoint but from a standpoint of the propulsion system capability? And we said it is feasible to do so we ought to design within those envelopes.

We walked our way around all of these external points with pressure and inertial loads and everything else and we looked at the structural model that we had simplified and we found the points that were critical for the vertical stabilizer, for the outboard elevon, et cetera, and that’s the way we designed the vehicle for ascent loads.

That it enabled us to do a rational combination of engine-out and engine vector control.

You could design the thrust structure so that the engines went out to the extremes, but it didn’t make sense as far as the control system was concerned. The engines were never able to vector all the way out to maximum, it just could not happen. That was a failure mode that it had enough redundancy and it couldn’t happen and there wasn’t any need of creating a load condition like that. We looked for the cases where you could be in the worst-case winds, the worst case misalignment with the SRB, with the different throttling of the engines.

The question we asked: To control this vehicle within those environments, because if you cannot control the vehicle there’s no need to look at that load case, what’s the extreme of the engines? That’s a design case for the thrust structure.

We saved a lot of weight in the vehicle by using a realistic SSME thrust profile and vector characteristics.

Also, the guys who were designing ascent trajectories now had an envelope to design to which was key for their operations.

Descent

This was pretty easy. The structure guys said this is a piece of cake because this vehicle is coming back in a ballistic trajectory and voila, there are no loads on this vehicle.

Well, that didn’t make a whole lot of sense because we knew that there would have to be more maneuvering capability than anybody was fessing up to. We weren’t smart enough to know all the conditions we would have to fly it to.

We went through the classical Venn diagram where you’re plotting for different Mach numbers, the normal load factor versus the velocity of the vehicle that it can fly in that flight regime.

We said, if this thing is going to behave like an airplane and have to perform like an airplane, we are going to design it like an airplane. We caught a lot of guff.

When Bass Redd comes in and talks in lecture 8, ask him about this because he fought us on this hand and foot. He said, you guys don’t have to design it that way. We said well, we’re going to, but let him talk about it in his aerodynamics and ask the control system guys about that too.

We said, we’re going to build in that capability for this thing to maneuver like an airplane.

2.5 g’s – normal load factor.

Following-up classical Venn diagram where we have equivalent airspeed of 375 psf (this is max dynamic pressure in pounds per square foot), we were determining what the equivalent air speed for those conditions was.

Detailed Design

Completing the design and establishing flight certification plans

Now we’ve gotten up to a point I call CDR or Critical Design Review, and a point I should have mentioned a while ago. When I showed the authority to proceed, there aren’t any drawings which exist except some sketches. I mean, there are line drawings of the vehicle that came out of all the other studies and that’s about it, there are no detailed drawings.

When you get to a preliminary design review in a classical design and development program, typically that’s about where you reach 10% of your drawings that are released.

And what does it mean to release a drawing?

That means you sign it off, whatever your discipline is, and it says we can make this airplane to these drawings and it’s given to the people to go make it.

So, once you release a drawing you don’t ever want to bring it back and change it because it costs you a lot of money.

The PDR, which was somewhere about 1973 or 1974, that was the state which we existed. We hadn’t defined everything on the structural low pass nor the materials.

Now we’re at the detailed design, into CDR, that’s the critical design review, and 90% of all your drawings are released and now it gets very expensive to go back and change. You can see how it would ripple through the entire operation if you change a drawing at that time. You have to, to make it work sometimes, but you like not to change it.

Important tasks in the detailed design are: complete the design from a structural point of view, reduce weight out of the vehicle where you can, scrape it without really changing a lot of stuff, and then also decide how you’re going to certify the vehicle which means answering the question: What are you going to do on the ground to say it’s really safe for the crew to get in?

Weight reduction is a major part of the program. Here are some of the things that we took out about this timeframe.

We took out 900 pounds of weight in the payload bay doors. We didn’t change the configuration, they were still flexible, but they were aluminum honeycomb. We said we can save 900 pounds if we go to graphite/epoxy. Graphite/epoxy characterization of the material didn’t even exist then. Literally, Aaron, myself and three or four other guys sat around. We said, OK, Aaron, this is what we have, this is what we know about it, here are the risks associated and here is the weight savings. Go for it. So, we went for it and it worked. That was the largest graphite/epoxy structure ever flown. We characterized it, passed that on to the industry and that helped a bunch.

Another little interesting thing, I mentioned the spending profile.

We got into the program about the time we were starting to make the payload bay doors, which is probably 1975, 1976, and Aaron didn’t get all the money that he needed. We built the first set of payload bay doors, which is people process dependent, it’s like laying up fiberglass. It was all hand layup with epoxy and bake it and all that kind of stuff. We got the first set built and we fired everybody because we didn’t have enough money to keep them on the payroll for the rest of that year. We literally laid everybody off at Rockwell in Tulsa. And they came back a year later, not all of them, but we had to start over again. So, there is a risk associated with that.

We saved 1200 pounds on thrust structure by stiffening and then we used a bunch of other composites.

A lot of people said, especially after Challenger, let’s get rid of this vehicle because it’s antiquated and was designed too long ago. That probably is still one of the most advanced composite structure vehicles flying today.

There are beryllium aluminum struts in here. There are boron/epoxy scab-on devices. There is graphite/epoxy in a lot of places in the vehicle. The vehicle has got a lot of composites and we stretched to be able to do that.

Structural Certification

Deviating from the “norm” and Innovation

Now we’ve got the thing pretty well designed, what are we going to do to certify it? This is where we deviated from the norm and were innovative.

Classically, in the way this program started off, there was a dedicated structural test article and there was a dedicated fatigue test article.

There were a couple of problems with that. If you don’t need it, you might as well not build it, even though that was in the program.

Thermal stress was a major part of that. You couldn’t apply a mechanical and thermal load to this vehicle and still be practical.

Concorde did it. The way that Concorde was designed and certified, they applied mechanical loads in an environment in which they could induce the temperature by convective heating on that vehicle and it took them like three years to test the vehicle and it was extremely expensive. It was a big jobs program for Great Britain and France and some of the others. We decided we couldn’t afford to do that, so we are going to have to figure out how else to do it. Besides that, Aaron had $100 million problem that year.

What we’ll do, we think we can do this, is take an airframe and apply 110% of the limit mechanical loads only to it. And that doesn’t certify anything. And then we will put strain gauges all over this vehicle and we will predict what the strain response is going to be for 3,000 points on the vehicle. If we can predict what the strain response is for applying a bunch of different loads then we know how to analyze the vehicle. That proves we know how to analyze it.

We can extrapolate to 140% to our ultimate load capability from mechanical, and we will add the thermal stress to it analytically.

So, we did that. And then we refurbished the vehicle and that became Challenger.

The test article is going to cost $100 million. We said we don’t need it. We’ll use it for a flight airframe. And Aaron gave us a little ceramic eagle for doing it. Don’t anybody expect A’s out of this deal, if Aaron has anything to do with it.

There it was.

We applied the million and a half pounds of load at the backend, we concentrated through loading fixtures, loads on the wings of the fuselage, and put pressure differential at various points on the vehicle.

Mechanical fatigue was not a problem.

Acoustic fatigue was an issue because we had some really lightweight structures and really high acoustic levels. Following two pictures show fatigue tests.

You cannot see it here.

It was like 165 DB around the base-end of the orbiter, lower levels on other portions.

We went around the vehicle and identified characteristic structures: graphite/epoxy, aluminum, 7075-T6 aluminum, fuselage, wing elevon, aluminum honeycomb, et cetera. We identified 44 test articles.

We went to Aaron and said it’s going to take us 44 test articles. We went through all the rationale with each one of them, and he said: You can have 14!

And so we said: But that won’t work.

He said: Go figure it out.

We went back and scratched out heads. Sure enough, we figured out how to do more extrapolation, so we had 14 test articles that you see. Our approach was to test them to failure acoustically.

Now we have an acoustic allowable for that type of structure because it’s a function of the details.

And, in addition to making sure we have a good test, only the center third of the test article was a viable part of the test because the rest of it is boundary conditions that weren’t right because they were clamped along the edges or whatever. We said, only the middle third of the test article is viable.

We tested that, we got a fatigue allowable from acoustics and then we degraded it analytically for combined mechanical and combined thermal. Also, we know that it’s probably not going to fail on the first flight, so we’ll do some inspections.

One thing that’s important, whenever you do a project or you’re in charge of something, you don’t want to have Yes-people around you. You want to have people that say you’re not doing it right. And it didn’t go down that simple. They were not yes people, believe me. They were certainly not ‘yes, sir, we’re going to go do this’! That’s very important. It’s a wonder we still speak to one another.

That’s a good point because, don’t forget, we start off with two entire $100 million test articles for static test and for fatigue test, not counting acoustic fatigue. That was just mechanical fatigue. As we got into it we said we don’t need that.

– Did the Challenger’s mission life drop because of the test?

No. That’s a very good question. That was one of the questions that was asked by the investigation: what’s different about this vehicle than any other vehicles, whether it was a static test article? We showed ad nauseam that it had nothing to do with the failure of Challenger.

As a matter of fact, this is getting into detailed details now, when you apply above a limit load on a vehicle like we did on Challenger it puts a lot of the joints in residual compression. There is compression at the joint just as you load it and you unload it. And residual compression increases the fatigue life of the vehicle. And the reason it does is because fatigue is the function of tensile cycles, not compressive cycles normally. When McDonnell Douglas tested a DC-10 and they proof load a vehicle, it carries a premium on the selling price for that because it theoretically has a longer life than one that hasn’t been loaded.

– How much did an increase in computer processing speed and availability between, say, Apollo and designing the Shuttle allow you to do these extrapolations and the thermal testing analytically? Was that a key factor?

As far as the analytical capabilities of the finite element models and all, you could get more detail through simplification. There are more elements available, let me put it that way.

But as far as the crunching capability, it increased somewhat but we were still a long way.

We basically used mainframes, and we did have the NASTRAN model. But NASTRAN didn’t have, on a large model like that, the capability for structural loads and thermal loads. We used to put punched cards in one day and it would take a couple days before you got your answer. To do a complete load cycle on this vehicle for internal loads it was something like three months.

Thermal protection system

Change gears now. Let’s talk about the thing that protects the vehicle. Now I’m going to switch and go back to get ready to proceed toward preliminary design.

What were the requirements on the thermal protection system?

It had to protect the vehicle from max temperatures of about 2800 degrees on the surface, reusable 100 times, it had to be lightweight and had to be cost-effective. Pretty simple high-level requirements.

Dr. Bob Ried in Lecture 9 will talk to you about the things that they derived as far as the aerothermal and how it became these requirements, but it was a given to us.

What did we know about this thing?

TPS Options

We had some ablative TPS experience from Apollo. Gemini had some metallic TPS on it, primarily René 41 and some other exotic materials. Mercury had an ablative TPS. But they weren’t reusable. They were hot structure designs which existed, but we didn’t have materials that could carry the load at temperature such that it could be a fully hot structural design, and that was extremely complex.

Metallic TPS, we could get there theoretically with some fairly exotic materials called columbium and René 41 and some other things, but the devil is in the detail in that.

Let me tell you a story about that.

We were looking at some Haynes 188 panels. And so we had a test article, a big panel about the size of the office desk, and it was corrugated so that it could expand and contract. It was good for 1800 degrees, so we tested it to 1800 degrees in the center of the panel multiple times. It had a frame around it where the panel could move around because it needed to be able to thermally expand. The center of the panel was 1800 degrees, the edge of the panel where the heat sink was, was 40 degrees lower temperature than the center. The panel floated within a gap, so it could move around pretty good. But what it also did, with that temperature differential of 40 degrees, we got something called creep buckling. The structure expanded and crept and deformed permanently. Had we flown that vehicle, had we designed a vehicle like that, what that would have done is would have allowed plasma to flow through the shingles, if you will, and into the structure. And that’s exactly what happened in Columbia.

Letting the hot plasma gas get in the vehicle, you cannot stand it.

It’s the details about that. We said we’re not going to go with a metallic design. Plus, if you scratch it, it oxidizes. And, if it oxidizes, then it can fail.

So, we went with something that was just coming online, and that was a fused silica material. Fused silica is pure sand, pure silica material. That’s all in the world it is.

The process is you make it into a fibrous structure, if you will. Fibrous material is a better term. A fibrous material that is mostly air. It is about the same density as balsa wood. It has an ultimate strength of about 12 psi, tensile load is about all that it can take, but it has a thermal performance that is fantastic.

As you will recall this chart here, when you look at LI-1500, is what that was with aluminum and that’s what we went with, we used this same characterization to decide what the material was we were going to use on the vehicle from a weight standpoint and a cost standpoint.

The way the tiles work thermally, they are low strength brittle, almost like glassy material, it’s a ceramic coated with literally a glass coating on the outside about 60-thousandths of an inch thick and it’s black.

As the vehicle comes back in and dissipates its energy through drag and heating, 90% of the heat is radiated away from the vehicle, 10% of it goes into the vehicle. But this is such a good thermal isolator, a poor thermal conductor, by the time the heat gets to the vehicle, the vehicle is back into an atmosphere where it’s not heating anymore.

That dictated the thickness of these tiles, of this silica material.

The vehicle has got almost 21,000 tiles on it, and they vary anywhere from a half inch thick up to about three inches thick. It’s sculptured to stay within the MOL line because the aerodynamicists told us what it has to be. And we sculptured the TPS so that we didn’t have any more than we needed.

Great job by all the thermal analysts. I mean, they did this fantastic.

I want to mention, when that says 9 pound or 22 pound tiles, that’s not the weight of each individual tile, that’s the density per cubic foot. That density variation was required primarily for strength. The LI-2200 had a little bit higher peak temperature capability. One of the failure modes of a tile was if you exceed the temperature too much it starts slumping. I don’t want to say melting, but it begins to distort. LI-2200 didn’t distort to the same extent that a LI-900 tile did.

We thought, let’s figure out how to take this fragile material and put it on this aluminum structure which has a high thermal coefficient of expansion. The tiles have almost a zero thermal coefficient expansion. We said, we’ve got to isolate that.

We put a strain isolation pad. We said, let’s isolate the structure from the material which is required to keep from failing all these tiles, so we put something between them. It was just a very loosely woven felt material.

Now we proved that the aluminum can expand all it wants to, or within limits, we looked at it realistically, and that the tile was OK, except the tile couldn’t be too large because of this relative expansion and contraction. That dictated the size of the tile. We literally pre-cracked them, if you will. We put expansion joints – is another way of looking at it.

There were gaps between the tiles. When you re-enter, the tiles expand. What we do is make sure that the gap can just close but not close such that you’re loading one tile relative to the other. That set the gap. During manufacturing, which is not that precise, if the gap was too large, we just stuck a gap filler in. It’s a different kind of gap fill, just a piece of Nomex or SIP material strain isolation pad coated with rubber or with RTV, and we stuck it in between the tile just to reduce the flow if the gap was too large. There is a chance you can have hot plasma going through there if the gap is too large. We had a very specific requirement, I think it was like 90-thousandths of an inch between tiles. And if it were, say 130-thousandths of an inch as installed because of tolerance buildup and all that kind of stuff, then what we did was stuck a plasma flow preclude, if you will, a gap filler between those to stop the plasma flow from getting between the tiles. And we had some experience where we lost some gap fillers, plasma flowed between the tiles and caused excessive heating on the tiles and started causing them to slump and melt a little bit, did a little bit of structural deformation but nothing significant. Losing gap filler was a turnaround issue, not a safety of flight issue. We made sure of that.

– This is more of a general question, but I’m wondering if since then anybody has done any work to find a material that could accomplish both tasks, the structure and the thermal protection rather than having to deal with these types of issues.

We tried to take that approach if we can design a vehicle that can take the temperature and the loads. There was no material that existed. I don’t think a material exists today that I know of to be worked to a high enough stress that you can keep the weight down to have those kinds of temperatures and to be worked at a high temperature. I think on the X-33 design they were talking once again of trying to make it out of a metallic structure. Part of it was structure and part of it was tons. But we never got to the point of being able to fly and test it. They also were using a thermal isolation system like tiles over part of the vehicle on the X-33.

The Buran, which was the Soviet copy of the Shuttle, they were very anxious to get away from the expense of the tiles. They ended up with a thermal protection system not very different than the shuttle. They were more like bigger blankets.

A typical tile is 6 inches by 6 inches when it gets into the highly heated area. They were typically 6 inches where they were really thick, but in other areas we made 12 or 15 inch tiles that were very thin. The reason we could do that is we decided if they crack it doesn’t matter because the gap wouldn’t be large enough for the plasma flow to go through there and it would simply be a self-relieving. We tried to reduce the cost of manufacturing by making some of these tiles larger.

Now all of a sudden we’ve got some room for the title to move relative to one another, structure to move underneath it because of the strain isolation pad, and voila, we’ve got this problem fixed. We’re good to go.

Detailed Design

We said, we’ve got 25,000 of these tiles that we now have to certify that they’re good to go for the vehicle.

The ultimate stress on the tile was 12 psi, the allowable stress was about 8 psi, and that’s with the total loads combined on the tile. What do you have to consider in one of these 25,000 tiles that you have to assure is not going to come off the vehicle?

Remember I said, when we looked in the early phase studies of the vehicle, we were looking at wing loads and stuff like that? Then we got into how is the wing going to carry the load into the fuselage to the spar and what was our design trade on that?

Those were sort of macro and semi-macro systems engineering studies. Now we’re into a micro.

Now we’ve got this little critical part, 6 inches by 6 inches. Lose any one of about 10,000 and you lose the vehicle. It’s got an 8 psi allowable strength.

We said well, that’s no big deal. What are all the environments on this thing? We started looking at pre-liftoff, liftoff, ascent, et cetera.

There is always something called mismatch. When you take something that is not perfectly smooth and you bond something to it and they are not to the same flatness, if you will, there is going to be a stress induced into both parts of those. Well, the structure doesn’t care about that stress, but this little 8 psi allowable tile does. It says, we cannot exceed about 19-thousandths of an inch under one of these tiles for this to happen.

There is ignition over pressure during ascent. There is acoustic and vibration and that kind of stuff that has to be considered. On ascent there are gradients because of shock moving across the tile, there is internal pressure, there is skin friction and drag on the tile, you have to consider the dynamics, the inertial loads induced in it and the out of plane deflection. Now the vehicle is flying, the structure is deforming, so you’ve got to consider that.

Now you can see, you’ve got 25,000 tiles with all these combinations of load conditions, so how in the hell do you design that?

Structural Deformation and Pressure Induced Stress

This is the characterization of it. This is what happens with a structural deformation of 10-thousandths of an inch deflection underneath a tile. With that kind of formation it causes 1 psi and it’s linear almost, so 20-thousandths of an inch deflection is going to cause 2 psi. Well, 2 psi is not a lot but it’s a quarter of your allowable.

We said, we’ve got to consider that, we have to understand what is happening to this structure as you fly it. A condition!

This is a free body, if you will. Of the pressure distribution on a tile it has internal pressure within the tile, it has a pressure differential on the outside of the tile because of a shockwave moving across it and because of the pressure as it varies around the vehicle. So, you have to consider all of that.

We did all that and voila, we’ve got a problem. Because of what happened, all of a sudden our allowable on the tiles was decreased by half and this was not good. We screwed up in the systems engineering point of view when we did this.

Do you remember that we put the strain isolation pad underneath the tile and we did all these other loads on it? What we forgot, or what we didn’t realize was this strain isolation pad had little stiff spots in it because of the way it was stitched to keep the strain isolation pad together and every stiff spot acted like a hard point. Now, when you take a tile and you put external loads on it and there is a stress concentration on each one of those things, that stress concentration had an amplification of two. So, all of a sudden our allowables were decreased by a factor of two.

Tile Stress Allowables

And we thought, we have a major problem. This is when Aaron and I got to know one another better than we ever wanted to. We met every day on this thing. We had tiles bonded all over the vehicle.

Necessity was the mother of invention!

What we had to do was dissipate this stress concentration. We said, we’ll put a plate underneath it, a graphite/epoxy plate or something like that. That would have added a lot of weight to the vehicle.

Glen Ecord, a materials guy, came up with the idea in the lab one weekend, he took silica powder in water and just painted it on the bottom of the tile. That filled all the pours in the tile for about three-sixteenths of an inch and just compacted themselves in there. That was an inherent capability of a tile with that powder packed in it that doubled the strength of the tile. It dissipated the load from being concentrated into the tile.

So, almost without any weight, some cost as we had to pull some tiles off the vehicle and densify them, now all tiles are densified.

We went through 25,000 tiles analytically.

Here was our factor of safety distribution over the entire vehicle. We said, we’re good for that!

But, the thing we don’t know is if the tile is really bonded on the vehicle like it should be. We said, we can fix that problem, we will verify it.

We will pull on every tile and make sure that it has a capability of the maximum expected mechanical load that it is going to see. And so, we pulled on every tile.

John Yardley, being an old stress guy, says let me ask you a question.

– When you pull on every tile, how do you know you haven’t induced more damage and decreased the allowable of the title because of your proof test?

Good question. Easy answer.

We’ll put a microphone on every tile and we will characterize the sound of the tile as we pull up on it, and we will get a sound allowable, if you will, for proof-testing the tile.

We did that on every tile that had to be proof-tested. We had an acoustic emission device, we had a microphone on there, we characterized all these tiles and we did it.

This diagram said that you cannot proof-load every tile, every tile is not densified, some tiles are thick, some tiles are thin.

We went through this logic on everything. Some of these things had gates that said go directly to fly. Others we had to pull off the vehicle and densify and proof load and do a bunch of other things to prove that they were OK. We got there.

Operations

Now we’re into operations.

We did some pretty innovative things on this thing, and I think I’ve shown you some of that stuff. But what were the surprises we had on the first flight? Not very many.

As we were going uphill, I told you about the plume effect from the engines blocking the flow, that caused the pressure distribution on the wing to be different than we designed for. The center pressure was further aft and outboard. That loaded up the wing more. It could not fly to the design conditions that we needed to under worst case.

What we did was almost day-of-launch loads analysis for the wings with load indicators in the wing to understand what a specific flight regime was going to do for that vehicle and we literally designed the trajectories for the first six or eight or ten shuttle flights so it stayed within a reduced capability of the vehicle. Because we characterized it so well, we could do that.

The other thing was the overpressure of the vehicle. When the main engines lit-off there was an accumulation of hydrogen gas underneath the vehicle and as soon as the engines fired, it ignited that hydrogen and sent a big shockwave up the vehicle. It could have been pretty bad but it wasn’t, so we fixed that by isolating the isolation and also burning it off prior to engine ignition.

And then we got some tile damage from external tank. We fixed that. After about the second or third flight on the external tank, we changed the foam process and controlled that.

Those were our only surprises.

You remember the chart that I showed you of all the combined environments on a tile?

This is not politically correct what I’m going to say, but I’m going to say it anyway. The shockwaves, the pressure, the out of plane deformation, all that, you didn’t see debris anyplace on that chart. Those tiles are not designed for debris, period. You can rationalize it. You can arm wave it. You can statistically analyze it. The vehicle is not designed to fly in debris. It can take every other thing it’s designed for, but it cannot take what it’s not designed for.

The engineers today have two choices. They can either eliminate the debris from the external tank or, in my judgment, they can go back and recertify the tiles for the expected debris. And that’s probably not too big a deal, but they cannot say we’re ready to fly, going through a logic matrix like I did, until they do that.

System Engineering Challenges

Here are some challenges for you.

As you go through from the beginning of a program, I would like you to be looking at the crew exploration vehicle, what other parameters would you look at other than what I’ve shown you here and what tools would you use?

On the combined thermal mechanical, I think a lot can be done on that. I don’t know what all the computing capability is today, but I think that you could really simplify and probably decrease the weight of the vehicle by doing that.

Could they be made more rugged? Yeah, they probably could. But be careful.

This is a big systems engineering issue and it’s a political issue. Should there be a dedicated crew escape system or should the reliability be built in the vehicle?

And I’ll promise you that answer is not known.

---

My comment: Russian Buran shuttle had crew escape system.

---

It may be known from a political standpoint that you have to have a crew escape system, and that’s OK. If that’s a requirement, that’s a requirement, but in a total system crew safety reliability that’s not obvious. It depends on what the design is and what the reliability of the constituent elements are.

How would you fix the ET? Put shrink wrap all over it.

Another thing that’s not part of the curriculum here is political systems engineering. You can have the best engineering design in the world, but if you don’t have the political support in a program like this it doesn’t matter. How does political influence come into a systems engineering?

aaa

Introduction

Subsystems

yellow