Lecture 5: Orbiter Structure + Thermal Protection System

Related Resources

Lecture Notes (PDF ‑ 2.7MB)

Tom Moser Bio (PDF)

• Download this transcript - PDF (English - US)

OK.

Good morning everyone.

As I mentioned at the last lecture, we're now moving into the nitty-gritty of the subsystems.

And we have quite an extraordinary list of speakers who actually worked on the original design of these systems.

And, as Professor Cohen mentioned, not only did they design these systems for the shuttle but, in most cases, they came from having designed essentially the same systems on the Apollo program.

So, in the question and answer period, if there are some things that you'd like to know about the comparison of Apollo and Shuttle, and also any questions about the future since some of you will be writing up possibilities for future development of some of these systems, please ask the questions.

And I spoke with Tom Moser, and he's fully prepared to handle questions during the talk.

Because there will be a lot of fairly detailed technical stuff, so if there's something that you're not familiar with, you don't understand or just have questions about, please ask while the lecture is going on.

I want to remind you, we have fairly extensive bios for all the speakers.

Rather than take the time in class to read through this, I've posted them all on the class website.

So my suggestion is go to the class website before each class and just see the background of the lecture.

Professor Cohen is going to make some personal remarks about, well, whatever it is that you want to say about our speaker.

Before we go into that, two things.

Tom Moser asked me if we had this book.

This actually is my personal copy.

I'm going to put it on reserve.

We may actually have it in the library as well.

I'll check, and I'll make sure that this gets on reserve.

This really is a rather complete book.

A lot the material that you've seen, the early design of the shuttle is in here, discussions of subsystems, and then detailed discussions of the individual flights all the way up through the first hundred shuttle flights.

It's a very nice resource, and we'll have it on reserve in the library.

The next thing.

I believe I have now indications from everybody about what you want to do your paper on.

We have two groups doing GN&C.

One group doing displays and controls.

We had two small groups interested in the propulsion system.

And I've asked Brian and other people, you've gotten together?

OK.

Only one person, Dan, I think, indicated an interest in the thermal protection system.

I know we've got a lot people on GN&C.

One of you, I think, had actually indicated an interest in thermal protection.

I will leave that up to you.

If somebody would like to work on thermal protection with Dan, he's back there and is available, I guess.

We have one group which is going to do a little bit of a different sort of project on modularity and some of the design methods that went into the shuttle compared to modern techniques that are available now, so we'll be interested in seeing what you'll come up with.

And then we had a group that wants to look at the propulsion system, but from the point of view of fuel storage and what the system would have looked like if we had possibly used alternate fuels.

We've got a nice spectrum of things that people will look at.

Any time you'd like to come and talk with me, with Professor Cohen or take advantage of one of the speakers who happens to be talking about the area that you're interested in, please do that.

We do have time usually after class, if you're free.

The speakers will generally be available so take advantage of it.

OK.

That's enough talking from me.

Aaron, I'll give this to you..

I just have a few personal comments about Mr. Moser.

He is going to talk to you today, lecture you today about the structures on the space shuttle.

But Tom, as Jeff mentioned, did the same work on the Apollo program.

I was the manager of the Command and Service Module on Apollo and on the Space Shuttle Orbiter, so Tom and I have been working tighter for many years.

And I relied very, very heavily on Tom throughout the years.

I told a little anecdote the other day, and just let me say it again because the person that helped me with it is Tom Moser.

During one of the shuttle missions, we were getting ready to come back, about 11:00 at night, I was getting ready to leave my house to go to the Control Center, which I live about ten minutes away, and we were getting ready to make the de-orbit burn, I got a call from Rockwell International, their head of the program there.

And he said, Aaron, we just did this test.

We took the panel of tiles and dumped it into a bucket of waterproofing agent and all the tiles came off.

I said what do you want me to do with that information?

I said they're getting ready to come back and there's not much I can do about that.

You're telling me all the tiles are going to come off?

He said no, they're not because that's not really what we did on the shuttle.

I said well, why did you do that test?

That's sort of a dumb test.

I had a decision to make, whether I'd call the people in the Control Center like Chris Kraft and tell him we did this test and all the tiles are going to come off.

But we've got to come back.

I decided what I would do is call my good colleague Tom Moser.

I said Tom, what should we do?

We talked for a while and talked for a while, and we decided to keep this information to ourselves until after the landing.

It turns out it all worked out fine.

There were no problems.

But my point to you is that how much I relied on Tom.

The other point is you may find yourself in that type of situation some day on a project maybe not associated with that.

Tom turned out to be afterward my Deputy Manager in the Orbiter Project Office.

Then he went on to become Head of Engineering at the Johnson Space Center and then went on to be Director of the Space Station in Washington, DC and now is a consultant.

So, with no further ado, let me turn it over to Tom.

One thing I learned to do is have my own mic because Aaron will keep it.

One of the advantages to having a gray beard, besides some of the folks in the back, is I'm not going to refer to him as Professor Cohen or as Professor Hoffman.

It's Jeff and Aaron.

It's not out of disrespect.

It's just the way I grew up so that's OK to do.

When Aaron asked me to do this, and Jeff, I thought that's easy, I'll just pull out some of my old notes and stuff like that and I will be up the next day.

Until Jeff sent me the syllabus and what it was to do, it made me start thinking about what I'd spent a good part of my life doing.

And that was designing and development of the shuttle with Aaron and some of the others, but from a systems engineering perspective which you guys are doing.

So, what I did is I went back and looked at everything from a systems engineering point of view from 1968 all the way until '81 when the shuttle flew.

But I looked at it through the knothole of a structure and thermal person.

So, that's what I'm going to present to you today.

And, as you go through each phase of the program it changes.

And sometimes it's down to the minute detail and other times it is the macro.

That's my objective, and I hope we accomplish that.

Ask me any questions any time that you want to.

Just a little bit of credit and recognition of some of the people that made this thing happen.

You're going to hear from a lot of these people.

You won't hear from John Yardley or Max Faget because they are deceased now, but these people up here made this program go.

And then you will have also some references that give you a lot more detail than I'm going to give you today, even though I'm going to cover a lot of it.

There is one unique thing about a program like this that is complex.

And that is the technical team and the management team have to work together and get together.

Everybody that is listed up there stayed on this program from day one, and that is key.

I don't think there has been a program since then that that has happened.

And I think that if people judge the Shuttle Program as being successful, I think that that's a major contribution to that success.

Beginning in '68 when the concept studies began, all the way down to operations from a structural perspective, what is important at each one of those phases in its weight and cost and produceability from day one.

But then it gets into the certification phase, the last part of the program, how are you going to certify this thing?

How are you going to prove that it's good for flight?

How are you going to prove that the crew is safe?

And you have to do it on the ground.

So, it's a completely different knothole you're looking through and a completely different set of parameters.

I didn't start on Apollo at the beginning like Aaron did.

I came out a little bit later.

But, in this program, I had the good fortune of working on it from sketchpad to launch pad.

And that's the way I characterized it.

And Aaron didn't know this, but at the end I would have worked for free to complete the program because I was going to see something from beginning to end.

And so if you ever had that opportunity to get on the program at the very beginning, I don't care what knothole you're looking at it through, stay on that program if you can because it's a completely different life at every step along the way.

So, from the knothole of Orbiter structure, I'm going to break this thing into two pieces, Orbiter structure and the thermal protection system..

On the concept studies that began in '68, what was the objective of those concept studies?

Conceiving, characterizing and characterizing by qualitative and quantitative concepts that would appear to work.

So, it was determining really the feasibility of the concepts.

When that began, the only requirement in the Shuttle Program was to have a reusable space transportation system.

Get something that goes from earth to low earth orbit and back reliably and reusable.

There wasn't a requirement on payload size, there wasn't a requirement on number of missions, there wasn't a requirement on any of those things.

That's what it was.

The variables that we all looked at, though, were budgets, yearly budgets, developments costs, operations cost.

And you'll see, as you go through some of this stuff, and probably some of the stuff that Dale Myers showed you, is development cost, you can spend a lot of money on development and reduce the operations cost or you can spend a little bit of money on development and have very high operational cost.

So, there's a trade there.

And when you're dealing with budgets that you really don't understand exactly what they are, that's a very important variable.

Payload mass and size is important from a structural and thermal standpoint because it has to do with mass and it has to do with energy that has to be dissipated during reentry.

The operational orbit is important.

Fully reusable flight systems or partially reusable, and that's a trade on cost and weight.

Turnaround time and cross-range.

Cross-range was critical to us at this point because NASA didn't have a requirement for cross-range.

And that's cross-range after you come back into the atmosphere to be able to deviate your normal ballistic trajectory coming back in.

But the Air Force thought that they had a requirement so we had to include that.

And then, as we got into the next phase of it, looking at what was important from a structural standpoint is the efficiency of the load path, the weight, the payload size, the aerodynamic surface loading, now we're beginning to get in and look at what are the wing loads, et cetera, and how does that manifest itself in weight and produceability?

We did that under two years of contracted effort.

Then within JSC, the Johnson Space Center, which was formally the Manned Space Craft Center, we conceptionally looked at designs in-house.

And we looked at 53 different designs.

You talk about a systems engineering thing, what we did was got a group of people about the size of this room and went away and locked ourselves up.

But we had expertise in every area, propulsion, guidance and control, aerodynamics, aero heating, that kind of stuff.

And we were almost doing a configuration a week when we did that.

So, when you look at 53 different configurations over basically a two-year period, we were not only just looking at it but we were quantifying then, what it meant in terms of all the parameters that I showed you a while ago.

How much did it cost?

What was the development cost?

What was the operations cost?

What was the weight?

What was the maximum temperature as we saw on the vehicle?

Was there a thermal protection system that could accommodate those types of temperatures?

That was the characterization in the systems engineering parameters that we used.

Tom, where these designs kind of refined?

Were you refining with each iteration or was it like we'll try this for a couple iterations and then maybe try something completely different?

Were you working towards a final [OVERLAPPING VOICES]?

Well, what we were doing was looking at the variables.

In other words, like here, when we looked at 53 different things, we looked at payloads ranging anywhere from 15,000 to 40,000 pounds.

We didn't know what the answer was going to be.

The driving thing there was reusability and cost profile.

We thought we knew what we could afford to do.

We looked at payloads from 8 feet in diameter to 15 feet in diameter, 30 feet long to 75 feet long.

We were looking at all of those things.

And, as we did that, we changed configuration from a straight wing, which is not good for cross-range, to a delta wing which is better for a cross-range, to a double delta wing which is even more structurally efficient.

Landing weights then was important.

Just like everybody saw the plane landing last night, it had to get that landing weight down to where it could control it.

Well, that was the same thing we were doing.

We were looking at landing weights, not only from a controllability but also from a produceability.

We looked at weights from 70,000 to 215,000 pounds, boosters from fully reusable to partially reusable, propulsion systems and various types of things.

We even looked at air breathers so that they didn't have to come back a dead stick like they do now when Jeff was in the vehicle.

And pressure fed and pump fed systems.

There was simplicity and complications in all of them.

Tankage, internal or external to the Orbiter.

Could you maybe say, for people's benefit here who have grown up in the computer age, something about the tools that you had?

I am going to do that in a minute.

You are, OK.

I'm going to give you a challenge, too.

So, we looked at all of those.

And, we not only looked at it, we quantified it to the extent that we could get the first order estimates on what the cost in all those things where.

Now then, I chose a couple of them here.

This was one of the early designs of the Orbiter.

Look where the locks and hydrogen are.

It's inside the Orbiter.

It has a straight wing so it was fairly lightweight, except for having to carry all that tankage.

The engines were on the Orbiter itself, but the payload was really small.

Very low cross-range, very low payload.

So that was probably the 8 foot diameter 40,000 pound payload.

We evolved that over a series of studies until we finally got down to about February of '72 where we said we're going to have to have a larger payload than this.

And the cost profile didn't fit.

What we did is we came up with a configuration that's almost like the shuttle that you see today.

Large payload, all the propulsion systems, the main propulsion systems are outside the Orbiter.

And it's a fly back, and part of it was throwaway.

In this case, we had a booster in line with the external tank rather than in parallel with it like the SRBs are today.

Basically that's what we started the detailed design and development with, but not exactly.

And I'll show you that.

Now then, some of us who like to worry about load pass and simplicity and low weight of the structure, we said ah-ha.

What we will do is put the engines on the external tank.

All the mass is down here.

Very little mass up here.

And for boost reduce the weight of the Orbiter, which is going to reduce development and operations costs a whole bunch and thermal protection system, but we have to swing these engines for reusability from the external tank back up the Orbiter and stow them for entry.

Well, our brother in mechanical engineers, they beat us pretty hard.

They beat us black and blue.

Anyway, that was a concept that we looked at very late in the program.

And that didn't go anywhere, even though Max Faget and I wanted to do it pretty badly.

As we continue now.

Now we're four years into the thing, we've done all these systems engineering analysis, so we end up with a final concept.

Here's what we want.

We want a 2.5 stage launch vehicle because it costs too much basically to fly back the booster.

We just didn't have the money so we said we want to have the most important part be fully reusable, so that was the Orbiter.

It was going to be a delta wing.

We figured that the mission life, we had a mission model of 500 total missions, 100 missions per vehicle, and there were five vehicles.

We had an ascent acceleration of 3 g's.

Why was that?

Really, the requirement was to keep down the inertia loads, but it was also to let people off the street flying the thing.

Go ahead.

What constitutes half a stage?

Half a stage means that the external tank is like a half a stage.

The SRB is a stage, the engine, the Orbiter is a stage, but the tank is a half a stage.

We kept the max dynamic pressure down because that was a major driver for control systems and for aerodynamic services.

You would love not to have the wings on the Orbiter going uphill.

That's a penalty that you pay.

So, one of the things to help reduce that is to keep that aerodynamic load down on the wings.

Then for atmospheric flights, and I'm going to talk a little bit more about that, we said this thing is going to come back like an airplane.

Let's fly it.

Let's design it like an airplane 2.5 g normal maneuver load factor and a negative 1 g.

A crew of four for one week.

That becomes kind of important because that sized the crew module, that sized a lot of the environmental control systems you'll hear about later and other things in the life support systems.

So, without a lot of changes, to show you what the flexibility and capability of this vehicle is, the Orbiter is now flying seven people for two weeks.

So, it went from 28 man days to 63 man days basically.

And I don't think a lot of people understand what that has done.

And there is a lot more robustness in the Orbiter, in the shuttle system that was not designed into it but had some inherent capability.

And also some of it was a little bit of forethought in the thing.

Here comes the Air Force stuff.

65,000 pounds up.

40,000 pounds return.

That was the requirements.

15 x 60.

Another important thing is we didn't know what they'd be but maybe up to five payloads at a time.

And that's going to become a problem, I'll show you about in a minute, as we start peeling this systems engineering onion of getting down into the details.

And deployable payloads.

Cross-range. A little less than 1300 nautical miles cross-range.

TPS material.

We didn't know what the hell it was going to be, but that's what we started with.

So, we began the contract for design, development, test and evaluation.

NASA does pretty good stuff in-house.

And I think with Dr.

Mike Griffin at the helm now you're going to see a lot more of that coming into NASA where they're doing a lot of stuff in-house.

But when it gets down to doing the detail, design and manufacturing and cost-control, down to the detailed parts and manifesting everything around, that's where the contract is.

NASA doesn't have that capability in a large program.

So, this is where we gave a contract to Rockwell International.

They had the integration contract.

And another company, Martin, had the external tank.

[Backhaul?] had the SRBs.

And who else am I missing?

And Rockwell had the integration and Orbiter contract, both.

This is what they started with.

That was their authority to proceed configuration, even though this is shown as in 1972.

But you see there is very little difference in the configuration then and what the configuration is today.

There was some minor mods which are not worthy of even talking about right now.

But let me give Aaron a lot of credit.

His favorite word, the whole time he was the project manager, was no.

And he had above his blackboard better is the enemy of good.

We've got something.

We know it will work.

We knew that damn configuration would work.

And Aaron got inundated with people coming back after we started the program.

Aaron, if you put reaction control jets out on the wing tips and here and up on the vertical stabilizer you get a lot more control authority.

And when you guys start looking at this guidance and control stuff in propulsion you're going to come up with that.

But it complicated the entry in the thermal protection system.

It complicated getting the fuel to those things, so Aaron said no, no, no.

And the astronauts would come in.

They'll always meet with Aaron at 7:00 in the morning because that's when they would get their word in.

And so they would have to go do flight training or something like that.

And, as they walked out the door, Aaron would say no.

They didn't hear him, but it was always no.

And that was critical in this thing.

And so the program came in at $5.1 billion.

It started $5.1 billion.

It came in at $5.1 billion.

It was only because of being able to say no.

But to say no you better do a good systems engineering job at the beginning.

And were there some faults and errors?

Yeah.

I'll confess and open my kimono here on the few of the things, but all in all it wasn't too bad.

And I will say one other thing about systems engineering.

It was interesting to watch four or five different large companies look at the various concepts.

I can say this now because none of these companies even exist in the form that they were then.

Grumman had a very large systems engineering organization.

Rockwell had a very small systems engineering organization, almost down to one or two people, but they were extremely good.

They were extremely good systems engineers.

NASA went with Rockwell for a number of reasons, but one of the things that probably benefited the program was having a very concentrated set of engineering requirements coming out of a systems engineer which almost turned out to be one guy, Ed Smith.

And he was very, very good at that.

The reason I bring that up to you, the thing that's most defficient, from my perspective now in the United States today, are good systems engineers.

Very good thermal engineers, good structural engineers, good propulsion engineers.

There are very few systems engineers that are good.

If you make a note of that and become one of those, you'd be highly sought after.

So, a little bit of this is a repeat.

As we went into these requirements, and from a government system's perspective, now the challenge was to give the contractor the requirements that they need but don't over-specify the requirements.

We were very careful to say here are the top level requirements, don't ask us what the internal loads on the wing are because we're not going to tell you what that is.

That is for you to decide.

And, if you want to change something within these constraints, you can change it.

But the burden is on you to make everything else right.

That is something that I think the Orbiter did probably better than the external tank.

I'll just say it like it is.

Go ahead.

I'm just wondering, sir, what happened to the canard configuration with the delta wing?

What happened to it?

Yeah.

It was not selected.

And I don't remember why it was not selected.

What was driving it, I don't know.

I don't have those notes anymore.

It could have been cross-range.

I don't remember that particular configuration, if it had the required cross-range for the payload mass.

I just don't remember.

I don't think it would have been cost.

I think it was a lot of complexity.

Well, it did have complexity so it had to add some cost.

Weight-wise, it probably was not too different just because of the control authority of having the canards there.

But that's a good question.

Tom, you might mention [UNINTELLIGIBLE PHRASE].

I'm going to touch on that, again, a little bit in a minute about what we did in surveying and determining the loads.

And let me hold that if I can.

Now we have begun with the design..

When you use the term top level requirements, what does the top level refer to as opposed to just requirements or performance requirements?

Well, the top level requirement changes as the phase changes.

The very beginning, in '68, the top level requirement was a transportation system.

We don't know what it's going to be, reusable, and we don't know how much payload it is going to have to carry.

So, that was the top level requirement.

Then it was to look at all of the combinations of things that you could create.

The solution was it is feasible and we think that this is about what it's going to cost.

Now, as we get into this point, these are the top level requirements.

So, the granularity of the requirements increases as the program advances.

Good question..

For the challenges, now I'm going to call it the challenges of beginning this thing, we know what the configuration is, you know what the design life is, et cetera, all that kind of stuff, but we still haven't decided on what the material of the airframe is going to be.

We estimated some stuff because it could be aluminum or it could be titanium and this is what it would be.

And it all fits within the right cost and performance envelopes, but let's optimize that from a systems standpoint a little bit and see what that is.

Some of the challenges in structural design, and I'm going to talk about each one of these things that's listed on here separately, should the cabin be an integral part of the fuselage or should it be a pressure vessel floating within the fuselage?

Trade to be made.

How are we going to account for thermal stress in this?

Well, what the hell is thermal stress?

Apollo, we didn't care a whole lot about thermal stress.

It really wasn't an issue, not to the extent that a vehicle like this is.

It was very sensitive for thermal stress.

Compartment venting.

We'll talk more about that.

Major structure concept trades to reduce weight basically.

And then how in the hell do we get the design loads on this thing?

From a structural design criteria we said, well, let's start with 1.5.

That's what all airplanes are designed for so we'll do that.

Even though some of the boosters were designed for 1.25.

Does everybody know what an ultimate factor safety is?

That's the allowable of the material that you've decided to use compared to the maximum expected load that you will ever want to see, three sigma kind of loads.

And then whatever the factor is about that, that's the factor of safety.

So, you simply take the maximum loads you can expect to find, multiply it by 1.4 and it better meet what the allowable is.

If there's margin in that allowable then that's called a design margin.

Ideally, you would like to have zero margin.

That still gives you a 40% factor of safety.

Everybody with me?

Yield is classically something that you decided on material.

Well, I want to also have a factor safety on yield.

And we sat around and asked ourselves why the hell do we care about that?

The only thing you don't want it to do is you don't want it to deform such that it won't operate so doors won't open, hinges won't work, et cetera.

We did not impose that on the program of the yield factor safety.

We didn't on the Orbiter.

The external tank did.

And they paid a weight for that because if you put a 1.2 factor safety on yield for some materials, that gives you a lower allowable than an ultimate factor safety when you're really only interested in ultimate strength.

And then we had said thermal stress is going to be important, but we don't want to be so conservative that we let the thermal stress add in such a way that it adds conservatism.

But, at the same time, we don't want it to count on it if it's relieving when we cannot really rely on it to be there.

So, it is decreasing from the stress point of view.

A scatter factor of four on life for a hundred missions.

What is scatter factor?

Scatter factor just means a factor of four.

If you have 10,000 cycles at 20,000 psi stress then you have to certify it for 40,000 cycles.

Typically, most airplanes you fly around on, they have a design life of about 20,000 flight hours.

I think that's about right.

They are fatigue tested to 80,000 flight hours to make sure that they have that kind of factor on life.

And then we said well, this thing is going to be used a lot, we've never looked at that before so we will arbitrarily say we'll use a 1.2 factor at the end of life or ultimate.

And then these are just classical engineering material allowables that everybody uses today.

A lot of people have mentioned lately, as we were thinking of the end of the life of the shuttle, that although it was designed for a hundred missions, I guess it was always assumed that those hundred missions would be flown over the course of just a few years.

And so, I think it's true, you more concerned with the long-term effects of stress than things like weathering or being exposed to salt, air over 20 years.

Is that correct?

Well, you hit a very key point.

And you're exactly right.

It turns out a hundred missions wasn't really designing anything.

I mean it could have.

Well, as a matter of fact, it didn't.

I don't know of anything.

A hundred missions design is for a cyclic stress, high cycle, low stress fatigue or low cycle high stress.

It didn't.

But the environment sitting around or the life of the material exposed has.

The leading edge turned out to be there is a degradation in the strength of the leading edge material, the carbon-carbon material because of being exposed to the conditions.

There was some corrosion found in the wings during an inspection.

Nothing was wrong with the low carrying capability, except it was beginning to corrode.

[UNINTELLIGIBLE PHRASE] You've got me mixed up with somebody else.

I'm not talking about avionics.

[LAUGHTER] No, but it's true.

There, I think, just to bring that up, the idea was they would not be good for that length of time so change them out, we're going to have to upgrade them anyway.

Aaron, I think, just left being program manager when they decided to change,no you still were there, they decided to change the general-purpose computers.

It took ten years to change the general-purpose computers because of all the certification.

Did the use and safety factors, like what numbers you were using, how much did the Apollo program [UNINTELLIGIBLE PHRASE] aircraft safety factors?

The Apollo program was like 1.2 factor of safety, as I recall, because it was a single use item.

And I'm going to take the opportunity to go back and verify that, but I think that's was right for some conditions.

And it could have been 1.5 on others.

I know on pressure alone it was 1.5 psi.

You say, well, why was it different for pressure than it was for others?

Because there was some historical data there that NASA had that said that was the right thing to use.

But that's a good question.

Now you've caught me.

I can remember on the boosters it was 1.25, but on the command module itself, let me retract that, it was probably 1.5.

It was 1.25 on the boosters and 1.5 on the crude part of the vehicle.

One of the challenges that we had here was to establish a criteria.

These were our objectives.

To assure that there was a realistic stress that we're putting in the vehicle and we weren't being overly conservative with it.

We were not reducing the stress because of thermal gradients.

And then we were incorporating the classical pressure induced stress.

And now what were the details of that?

Here were the details.

We came up with this algorithm that says we will use a factor of 1.4 on all external loads because that's aerodynamic loads, inertia loads and so forth.

We will use a factor of 1.4 on the thermally induced loads, if you will.

They are really thermally induced strains and stress.

We'll use a 1.4 factor on that if it's additive to the mechanical, but if it's subtractive we'll only use one because we probably won't reach the maximum thermal conditions so you cannot rely on that.

On pressure, we used 1.4.

Unless it was pressure alone, we used 1.5.

But the whole thing is we would never have less than 1.4 of the total combined load.

So, that's what we did.

And so you say why in the hell did you do that?

Why did you have to go to that kind of detail?

The reason being is because you probably had about 30,000 stress engineers working on the program, and they needed to know how to combine this stuff.

If you didn't, this guy is going to do one thing and this guy is going to do something different.

We got it down to that level to save weight in the vehicle and save complexity in the vehicle.

Well, we have our criteria set now.

Let me give one more story on marginal safety.

One of the people that I showed you at the top of the credits list was John Yardley.

And probably Aaron and Larry Young and other people would probably agree with this, John Yardley is probably the best engineer that I ever knew in my entire life.

He's probably one of the best managers I ever knew.

John Yardley had the job of being the Program Manager on McDonnell Douglas F4 aircraft.

And he was an old stress guy.

He knew that weight was going to be a critical parameter in the success of that program and he had to keep the weight out.

What he did, on that previous slide where I showed you the stress criteria and make sure that you have a zero margin of safety with a factor of 1.4, is he told all the stress engineers, because they all worked for him, design to a negative 10%.

Which means if you really do your job right this thing is not going to be able to reach ultimate load.

It's going to break.

But he also knew that they were probably conservative because he was one of those guys.

And he also had in his hip pocket, if he's wrong he would find out because he had the opportunity to do an ultimate load test on the airframe.

It turns out he did the ultimate load test, it passed the ultimate load capability and he saved a bunch of weight in airplane which made it a very successful airplane.

Sometimes from a systems perspective, it's what you learn in the details or in the trenches as you're coming up and being able to apply it the same way that Aaron did a lot of stuff as he was managing the program.

On the airframe we looked at a lot of different structural materials, we looked at a lot of different TPS materials, and some of the parameters that were coming out in there was not only strength of the material but how much heat sink there was because you were having to rely on that to keep the weights down.

And let me go up one slide and show you something here.

I don't know if you can read that, but on the left side what it was is it was all aluminum airframe.

It had an ablator thermal protection system on it.

And you said, well, I thought you said it was going to be fully reusable.

Well, we also had a cost constraint.

So we put that in there as a reference point.

And that was the lowest cost.

And here's weight up here.

It wasn't quite the lowest weight, it was pretty low, but it still was violating the objectives and requirements that we had.

And we said that will be our reference point.

Then we looked at different types of aluminum.

We looked a beryllium.

We looked at titanium.

We looked at the thermal protection system on a beryllium substrate.

Every kind of combination you could think of.

The interesting thing was, look where the whites were staying.

They were all staying within the 60,000 to 80,000 pound total weight envelope.

What was happening is we were decreasing the thermal protection system thickness.

If we were using titanium, which we could operate to 600 degrees, the TPS weight was going down.

Titanium was not as good a heat sink as aluminum, even though we're working it to a higher temperature.

And it turned out that the combination of TPS plus structure was pretty much a constant.

I'm oversimplifying it, but that's basically what it was.

And you can see where the cost was.

This is beryllium titanium.

The cost was way out of whack compared to everything else, so we said we're not going to do that.

And there were some other exotic materials over here for hot structures.

We said let's now decide what this airframe material is going to be.

It's going to either be aluminum or titanium.

And total weight, total cost doesn't make any difference, they're about the same.

We weren't' smart enough to decide so we went out to the skunk works.

Kelly Johnson skunk works, I don't know if you know what that means.

Kelly Johnson designed and built more airplanes in a short period of time.

And they were the ones, Larry, was it in the `50s, the SR-71 was designed, the Black Bird?

I think it was in the 1950s.

It was somewhere in there.

They had to develop titanium for that airplane.

It was a hot structure design.

We went out and spent some time with Kelly Johnson.

We went through all this stuff with him.

All right, Mr.

Johnson, at the end of the day it's a mix for us.

Would you build it out of aluminum or titanium?

He said aluminum.

And the reason being is because titanium was so difficult to work to produce.

The manufacturing was difficult.

Today it's a lot less difficult than it was then.

We made the decision and went with aluminum, so we had to protect that structure to 350 degrees.

That was a lot of work and a lot of analysis to make that decision.

And we talked to Aaron and said that's what we want to do, and he said go for it.

The next thing we looked at, we got the airframe design, now we're starting to put together the fuselage.

We said we can put this crew cabin as part of an integral part of the fuselage or we can make it a separate pressure vessel inside.

Went through the trades on this.

And we came up with some of the discrete advantages.

It's a purely simple pressure vessel when you don't have any inertia loads, except the mass that is inside the crew module itself.

There is a discrete attachment between the crew module and the forward fuselage which means you could start the design and construction of these two things in parallel.

And simple interfaces are important.

Somebody mentioned modularity, and it's probably modularity in some analytical tools.

But simple interfaces where you're putting things together are extremely important.

So, this created a very simple interface for us.

Also, we didn't have a lot of heat transfer to the crew module.

It was easy to control the environment within the crew module.

And we designed it out of a material, a 2219 aluminum, which had an inherent advantage of if it gets a crack, the crack doesn't grow catastrophically under the operating stress before it starts leaking a lot.

Well, that's good because, from a crew safety standpoint, you know that if the seals are working and it's still leaking you've got a crack in that pressure vessel but it's not going to be a crack that is going to propagate to be a catastrophic failure.

We chose the floating design.

When I talked a while ago about the crew of seven in two weeks now compared to four for seven days, back in '72 we said we don't know what the requirements are going to be, but let's make this thing as robust as we can without penalizing ourselves weight-wise.

So, we went back to Apollo and said what were all the densities in the Command Module for the Crew Module?

We figured out a density and a volume.

We said that will be our baseline.

That's what we came up with.

Well, for another 50 pounds of weight, we could increase the carrying capability of the crew module by about 500 pounds.

That was a good trade at that time so we did it.

We just said we're going to design this thing.

Instead of for 25,000 pounds we'll design it for 30,000 pounds of payload carrying capability within the crew module.

It turned out to be a good decision.

We weren't smart enough to know operationally we'll need larger crews for a longer period of time, but that helped us out a lot.

You probably also want to mention, when you look at the structure of the crew cabin, in both of the shuttle disasters, the Challenger and Columbia, we have every indication that the crew cabin actually survived the breakup of the Orbiter.

So, it really was an excellent structure.

I'm glad you brought that up. As a matter of fact, I have a note here to bring it up myself.

Jeff is exactly right that that's what it did, but it was never designed to be a crew escape module.

It had some inherent capabilities, probably could survive some things that it couldn't had it been part of the fuselage, different flight regime, so it had that inherent capability.

But it was never designed -- And I know there was a lot of talk after Challenger that it looked like it would have survived all the way, but it would have never made it all the

way. But it would have under a lot of conditions.

We said Apollo didn't have a lot of thermal stress issues, but we know this vehicle now we've skinnied down weight-wise as much as we can to the extent that the thermal gradients between any two different pieces of structure, where they were different materials or different masses is going to cause a thermal gradient.

And thermal gradient cause thermal stresses.

And you will see in a minute that was not only important to stress but is important to all these tiles we were sticking on the outside of this thing.

So we said we have to look at every one of these thermal gradients and we have to understand what that induced stress is because we had an indication it was going to probably contribute about 30% of the total stress in the vehicle.

It was going to be from thermal stressors at different flight regimes.

Kelly Johnson helped us out pretty well deciding on aluminum and titanium.

We said why don't we just fix this thing?

We'll design around all the thermal stress.

We'll put stress relief in it, like expansion joints along the sidewalk.

We'll do all these kinds of cute things and we'll simplify the heck out of this.

As a matter of fact, the SR-71, the Black Bird, it had huge thermal stress problems.

So the wing on an SR-71, normally the skin carries a lot of the wing bending.

Not true on an SR-71.

It's corrugated skin so it can expand and contract.

All the wing bending is carried in the spar caps, the frames that go out the entire wing, and the caps themselves.

They paid a penalty but avoided the thermal stress issue.

We said we'll be smart with that.

We'll go talk to the SR-71 guys.

And we'll go talk to the Concorde.

The Concorde was an airplane that had high thermal stress, even though it wasn't that high a temperature.

I think it was reaching 500 or 600 degrees outside, but it was moving fuel around all over the vehicle.

So when it moved this high mass of fuel from one part of the vehicle to the other, it was creating big thermal stresses.

They knew what to do.

They designed in stress relief at these high points.

It bit them.

Every time they did it they had fatigue failures.

Every time they did that.

They finally gave up and said just accommodate.

We said we'll do that.

Now then, we decided on that criteria.

We're going to account for thermal stress, but how can we do it?

We don't have a 3D model that we can apply mechanical loads to, I'll call aero loads mechanical loads, and temperature distribution.

The finite element model didn't exist.

We had a finite element model that had 50,000 degrees of freedom, but we didn't have a computing capability to combine thermal and mechanical loads on there at the same time to be able to decide how to size the structure.

We said now we've got a problem.

What the hell are we going to do about that?

What we did is looked at what were the conditions causing the thermal stress?

Going uphill thermal stress is not an issue.

It's all coming back in, in the entry phase.

We knew we had initial conditions that were going to primarily be the cause of it.

Coming back where the vehicle had been sitting in top sun for a long time, bottom sun for a long time, side sun for a long time, so we looked at those initial conditions as being the worse.

And we proved to ourselves that it was the worst.

Then what we cleverly did is we went around the vehicle where we had a detailed structural model of a lot of stuff.

And we created a hundred different thermal models of different types of structure.

This is one that was in the wing truss.

We had a wing skin panel, we had a truss member and a lower wing skin panel.

And we did a detailed thermal analysis of these hundred models.

We then applied that to a structural model simplified, which was giving us the internal loads and stresses that we needed, and then we hand extrapolated that over the entire vehicle.

There was no other way to do it.

So, as you look at your analytical capability probably on your damn laptop now, computing capability, you couldn't really do it on that, but think about that.

And I noticed nobody wants to talk about structures as one of these groups.

If one of you changes then I'm going to feel really good when I go back and fight the hurricane in Texas.

But that's the way we did that.

It was a necessity that we had, but we didn't have the capability so we invented a way to do it.

And, I'll show you in a minute, it worked.

Another issue that we had.

Normally you'd like to just vent everything through one area in the vehicle, but we couldn't do that because the payload bay had to be very clean.

It had to be contamination free.

And there was hydrogen in the backend of the vehicle.

There was a pressure vessel in the front-end and a bulkhead up there.

We said what we've got to do is we have dictated to ourselves that we have to design a venting system.

This turned out to be a major part of a lot of internal loads in the vehicle because of venting from one compartment to the other.

And, stop and think about it, we had vents all along the fuselage.

We had a different pressure coefficient at each one of these vents for our various attitudes during ascent, for our various attitudes during entry, so we now had a whole myriad of complicated internal pressures that we had to accommodate.

But that was pretty straightforward.

We just complicated our design with the venting system that we had, but we had to do it to meet the requirement.

I don't know that people are actually aware that there are all these vent doors because it's not something that you would normally pay attention to in the pictures.

That's right, you don't.

As a matter of fact, in this book that Jeff referenced, it shows where all the vent doors are.

I didn't show that detail to you today.

And they do open and close at different times during ascent and entry.

Venting just for carbon dioxide gases?

No.

When you start off you're at one atmosphere, right?

As you rapidly go uphill there's a delta p across internal bulkheads and internal compartments, internal and outside the vehicle.

And, depending on what the flight regime is and where the shockwave is and where the vent door is, it's changing the whole venting thing.

That's a whole lecture in itself on what we did.

The crew compartment is designed to have a delta pressure of one atmosphere, but inside the payload bay, that's not designed to be a pressurized environment.

And so you need to be sure that the air can get out of the payload bay fast enough that you don't over-pressurize, for instance, the payload bay doors or other parts of the structure.

There were some other trades that we had to make.

Let me skip forward so you can better understand this.

For reference purposes, the main engines are here, 1.5 million pounds of thrust coming into this part of the vehicle.

There is a Longeron that goes all the way along here.

A big mass up here with a crew module.

And the crew module, I showed you, had just discrete attachment points.

All of the ascent inertia loads are reacted right here, so all these loads go along this Longeron.

Now, all of a sudden we have a very good and efficient load path.

The wing right here, this is a primary load carrying member of the wing.

That's a spar.

And it ties into this big bulkhead which is right here.

When Jeff talks about the pressure differential, don't forget this thing is 15 feet in diameter here so you can imagine the total loads you have on that with a couple of psi delta p.

It's big.

That was a significant part of the driving stresses in that.

Another point I want to make about this is -- Well, I talked about simple interfaces between the crew module and the forward fuselage with bolted attachments.

We had a simple interface between the wing and the mid fuselage.

A simple interface between the mid fuselage and the aft fuselage.

The same thing with the vertical stabilizer and aft fuselage and these orbital maneuvering propulsion system.

That was important, from a structural point of view, to be able to modularize and analyze these things.

But it was also important because four different contractors built all these parts so they had to have an interface that they could not only design and analyze to but that they could physically attach to.

Sometimes, when you have just a sketch on a piece of paper, you don't think about that.

And it does cause a little bit of complexity sometimes in a program.

The main thrust structure is carrying 1.5 million pounds of load from the engines.

How do we design that?

Well, we could have done a space frame or we could have done a truss configuration.

We decided to go with the space frame or the truss rather than a plate girder, the term I didn't use correctly.

And with that we saved 1700 pounds of weight in the vehicle.

We used titanium.

And this is a compression design.

We thought we needed to get a little bit more weight out of this thing.

What can we do to increase the compression modulus of titanium?

We put boron/epoxy, scabbed it on the axial load members of the thrust structure, and that's the way we got a lot of that weight out.

That was a manufacturing problem, I won't go into now, of how you build this thrust structure, but it works fine.

The aft wing carried through -- Excuse me.

Go ahead.

I just had a quick question.

Sure.

We heard earlier that there was a CG problem in that the CG was too far forward in the aft [but bled in the back?] for a number a number of missions.

I was wondering how that weight that they had to add to the CG compared to the weight that you guys saved.

The weight of the payloads themselves, you're saying that there was a problem if heavy weights were too far aft or too far forward?

The Orbiter.

I guess the CG location was too far forward and they had to adjust it on certain missions by adding weight near the back.

Well, what that is, that is true and that's a problem.

It's not a problem.

It's something that has to be addressed on every mission, depending on what the payload is that you're carrying.

If you have a real heavy forward payload, yeah, you have to add some ballast to the aft end of the thing.

Now, normally the way they do it is they'll find some payload that can fit in the aft end to help ballast that.

But I think, in some of the early flights, we put some ballast in the back for CG control.

We've carried many tons of lead into orbit, so it was ballasting the thing for control purposes.

The same way yesterday in Jet Blue, a lot of people had to move to the back end of the airplane because they wanted that CG for a little bit different landing performance.

1307 bulkhead, we saved about 500 pounds there.

Now, see what we're doing?

We started out with the initial trades in the early concept phases.

What's the wing loading?

We didn't care about what the internal structure trades were.

Now we're getting down to trading all the stuff at a semi-macro level.

And I'll show you in a minute a micro-level that we had to get into, which was pretty interesting.

How are we doing time-wise?

We're OK.

So, we saved some weight there.

An interesting thing about the payload bay doors.

We decided that for this vehicle to be safe and to re-enter those doors had to close.

We had a lot of trouble in Gemini with things on orbit not working.

Mechanical systems quite often are problems.

Docking systems are problems.

There have been a lot of door problems on orbit in spacecraft.

And you design them and you put them in thermal vacuum chambers and they all work, but you get on orbit and sometimes they don't work.

Maybe it's thermal distortion that we're not accounting for.

So, we said that is critical.

We've got to close these payload bay doors.

What we did was say the way we're going to do that is the payload doors will carry only two types of load.

They will carry pressure loads, like Jeff talked about, and they'll carry torsion loads.

Because, if they are closed, we know that it is good for torsion in the vehicle, reacting torsional loads.

But we will not let them carry body bending loads or else we cannot make them flexible enough.

What we did is all of the body bending in this vehicle is carried along this Longeron through this section in the lower skin of the vehicle.

This is the modulus of the vehicle, if you will, at a cross-section here between this Longeron and the lower skin.

Payload bay doors don't come into being.

And the way the doors close on orbit is they start zipping along from here up to the top because they are flexible.

And the same way back here, they zip closed, zipping just a latch at a time.

They were sort of ratcheting themselves closed.

And then they close along the center line.

There has never been a problem with payload bay door closures on orbit.

It was something we decided to add to the design.

We could have made the vehicle lighter had we not done that, but we would have also complicated the safety of the vehicle if we had done it.

Sort of in line, but it's not the CG thing, we had a payload attachment issue.

And, when we were laying out all this stuff in the early `70s, we didn't know what the payloads were.

We knew what the total mass was.

We knew there may be five at a time.

We didn't know what they were.

Now, you can just go in and bolt a payload into the fuselage of the Orbiter.

And if you just do that randomly or without thinking about it, now all of a sudden you start analyzing the Orbiter and you start twisting it, what happens?

The payload becomes part of the load path.

Now, all of a sudden, you have impacted the design of the payload or maybe you have impacted the design of the Orbiter depending on what is happening in the payload.

We said ah-ha, what we'll do is make it so it's statically determinant.

If two things are attached statically determinately they cannot interact with one another as far as their stiffnesses are concerned.

We said that's what we're going to do.

We'll put attachments along the Longerons to carry the axial loads, some along the keel to carry some of the lateral loads.

Viola, we've got it.

So, the requirement became that we would design it that way.

Our next step was, and you can ask Al Louviere when he comes up about that because Al Louviere and Max Faget told me they would never fly with those Longerons that way.

We did it anyway.

What we had to do then was say now we understand what the attachment is.

How do we determine within the CG constraints for these different masses -- And we had to assume what they were not knowing exactly the definition of the payloads.

We did a Monte Carlo analysis.

Ten million cases of combined payloads.

CG locations, numbers of payloads, forward, aft, all that.

And we did that with a Monte Carlo analysis.

We said voila, that's where we're going to design the mid fuselage.

That's the way we did it.

Now getting into the detail design loads.

How do we determine all these things now?

Because now it's coming down to sizing the vehicle.

This part of the flight regime from liftoff through max Q, that's a critical loading condition, a critical design for the Orbiter.

When it gets into orbit pretty benign.

Nothing is really happening up there except some temperatures which are going to be important at this point over here, because now all of a sudden you start adding more heat into it.

Now you get into the regime where you're maneuvering in the atmosphere.

Now you're in a different loading regime which becomes critical.

So, critical as far as the airframe is concerned, is here and over here only.

Let me break that down into the constituent portions there.

Liftoff loads.

We had another statistical challenge here because what we had to do was needed to look at all the variables associated with the rocket engines.

They have start sequences.

We've got three main engines that are not going to start exactly the same time.

They're not going to come up with the same thrust profile as they start up.

The thrust vector misalignment is going to be different.

And we also had to look at ignition over pressure.

And I'll show you that was a surprise to us.

Also part of liftoff we had to look at winds and gusts, vortex shedding, proximity of aerodynamics to the other structures is on the gantry in the pad.

And then we had to do the pressurization and also look at shrinkage of these vehicles that components or elements at cryo-temperatures.

Here was a cross-section, in a generic sense, of what's happening during liftoff.

There is some combination of winds that you have to account for.

And I will show you what we did there.

The thrust profile from the SSMEs.

The SRBs come up to thrust after you get confirmation that the engines are operating at full performance.

And there is a lot of vibration acceleration going on.

Here is something that becomes pretty obvious after a while.

When you have a vehicle that is tied down here with a base moment and you put 1.5 million pounds of thrust on it, this vehicle is going to bend over this way.

There is a lot of strained energy in the solid rocket motors when that happens.

If you were to ignite the SRBs, when that vehicle is over here, the party is over because it releases all that strained energy and the SRBs couldn't take it.

When you see the Orbiter prior to liftoff, the SSMEs will come up, you will see the vehicle do like this.

And then, when it comes back over zero, viola, you kick off the SRBs.

But you have to wait until it gets back to that neutral point.

A little detail that is pretty important.

Ascent.

A really complicated part of the design of the vehicle, especially with the aerodynamic

surfaces. As I said before, you would like for these things not to be there during ascent.

They don't buy you anything.

You just need them coming back.

Some other complications here are the acoustic effects will become important, as I'll show you, in acoustic fatigue for the vehicle.

I showed you life.

Well, that's going to be a critical thing.

Another thing is the plumes of the vehicle are changing the pressure distribution as you're going up.

The pressure distribution along the Orbiter, especially the wing, is changing the whole times you're accelerating, not only through the various mach regimes but also because of the blockage from the plume expansion.

We said how in the world are going to do that?

We cannot analyze all those things.

If we do it deterministically, you won't get a capability that you need, we thought, operational.

We said what we'll do is one piece of data that we had, we had synthetic wind profiles for everything that existed at the Cape.

We said that's a given.

We'll use these synthetic wind profiles as a guideline to all of our winds aloft.

What we need to do is decide what the angle of attack and the side slip is going to be through this vehicle flying through these winds and a control system that's changing the attitude of the vehicle.

That's a factor that we have to consider and that's going to be important for the design of the elevon surfaces and all because they're getting loaded up pretty heavily at that time.

There are dispersions in the propulsion system that have to be added.

And then what we decided to do, after we looked at all that, we said what we're going to do is we're going to take all these parameters, and you won't find this in any textbook, but we created something called a squatcheloid.

And I forgot to look up what squatcheloid means.

It must be a Greek term that was really good.

But what we did was flew the vehicle through different mach numbers.

And we looked at the various conditions we could get at for combinations of dynamic pressure and angle of attack and dynamic pressure and side slip for all the mach numbers, and then we said is that realistic to do, not only from a control systems standpoint but from a standpoint of the propulsion system capability?

And we said it is feasible to do so we ought to design within those envelopes.

What we did was walked our way around all of these external points with pressure and inertial loads and everything else and we looked at the structural model that we had simplified.

And we said we found the points that were critical for the vertical stabilizer, for the outboard elevon, et cetera, and that's the way we designed the vehicle for ascent loads.

The thing that that enabled us to do, too, is it enabled us to do a rational combination that Aaron brought up a while ago.

What did you do with the SSMEs for engine out and that kind of stuff?

It let us do a rational combination of engine out and also engine vector control.

You could design the thrust structure so that the engines went out to the extremes, but it didn't make sense as far as the control system was concerned.

What we did is we saved a lot of weight in the vehicle by using a deterministic or realistic, I should say, SSME thrust profile and vector characteristics.

Well, I just mention that.

That's what the squatcheloid did for it.

Also what it did was then gave the guys who were designing ascent trajectories, now they had an envelope to design to, which was key for their operations.

Next problem.

Now we come back to descent loads.

When you said that you designed it for realistic cases instead of worst cases, does that mean the engines were never able to vector all the way out to maximum?

Right. It just could not happen?

It could not happen.

That was a failure mode that it had enough redundancy and it couldn't happen, and there wasn't any need of creating a load condition like that.

It couldn't happen.

OK, so you looked for it.

We looked for the cases where you could be in the worst case winds, the worst case misalignment with the SRB, with the different throttling of the engines.

And we did all that and said to control this vehicle, because if you cannot control the vehicle there's no need to look at that load case.

We said to control it within those environments, what's the extreme of the engines?

We said that's a design case for the thrust structure.

Good question.

Descent loads.

This was pretty easy.

The structure guys said this is a piece of cake because this vehicle is coming back in, in a ballistic trajectory.

And, viola, there are not even loads on this vehicle.

Well, that didn't make a whole lot of sense because we knew that there would have to be more maneuvering capability than anybody was fessing up to.

Not that they weren't trying to hide it, but we weren't smart enough.

The Aaron Cohen guys weren't smart enough to know all the conditions we would have to fly it to.

What we did was we went through the classical Venn diagram where you're plotting for different mach numbers.

The normal load factor versus the velocity of the vehicle that it can fly in that flight regime.

We said if this thing is going to behave like an airplane and have to perform like an airplane, we are going to design it like an airplane.

We caught a lot of guff.

When Bass Redd comes in and talks in the future ask him about this because he fought us on this hand and foot.

He said you guys don't have to design it that way.

We said well, we're going to, but let him have capability in his aerodynamics and talk to the control system guys about that, too.

And I see the Draper guys left on that.

[LAUGHTER] We said we're going to build in that capability for this thing to maneuver like an airplane.

2.5 g's normal load factor.

Follow-up classical Venn diagram where we have equivalent airspeed of 375 psf.

We were determining what the equivalent air speed for those conditions was.

And then we did it.

Now we've gotten up to a point I'll call CDR, and a point I should have mentioned a while ago.

When I showed the authority to proceed, there aren't any drawings which exist, except some sketches.

I mean there are mol line drawings and that's about it.

And the mol line of the vehicle was what came out of all the other studies.

It said that's it, we've got to put everything within this mol line for this vehicle to perform like it is.

But there are no detailed drawings.

When you get to a preliminary design review in a classical design and development program, typically that's about where you reach 10% of your drawings that are released.

And what does it mean to release a drawing?

That means you sign it off, whatever your discipline is, and it say we can make this airplane to these drawings and it's given to the people to go make it.

So, once you release a drawing you don't ever want to bring it back and change it because it costs you a lot of money.

The PDR, which was somewhere like about '73, '74, somewhere like that, that was the state which we existed.

We hadn't defined everything on the structural low pass like I told you about a while ago, nor the materials.

Now we're at the detail design.

Now we're into CDR, that's the critical design review, and 90% of all your drawings are released.

And now it gets very expensive to go back and change.

You can just see how it would ripple through the entire operation if you change a drawing at that time.

You have to, to make it work sometimes, but you like not to change it.

What we have to do here, our challenge from a structural point of view is to complete the design, do some of the details which means get weight out of the vehicle where you can scrape it without really changing a lot of stuff.

And then also decide how you're going to certify the vehicle.

It means what you're going to do on the ground to say it's really safe for the crew to get in.

That's what that was.

Weight reduction is a major part of the program.

Here are some of the things that we took out about this timeframe.

We took out 900 pounds of weight in the payload bay doors.

We didn't change the configuration, they were still flexible, but they were aluminum honeycomb.

We said we can save 900 pounds if we go to graphite/epoxy.

Graphite/epoxy characterization of the material didn't even exist then.

Literally Aaron, myself and three or four other guys sat around.

We said OK, Aaron, this is what we have, this is what we know about it, here are the risks associated and here is the weight savings.

Go for it.

So, we went for it and it worked.

That was the largest graphite/epoxy structure ever flown.

We characterized it, passed that on to the industry and that helped a bunch.

Another little interesting thing -- I have to watch my time here.

I mentioned the spending profile.

Well, we got into the program about the time we were starting to make the payload bay doors, which is probably '75, '76.

And Aaron didn't get all the money that he needed.

We built the first set of payload bay doors, which is people process dependant.

It's like laying up fiberglass.

It was all hand layup with epoxy and bake it and all that kind of stuff.

We got the first set built and we fired everybody because we didn't have enough money to keep them on the payroll for the rest of that year.

We literally laid everybody off at Rockwell in Tulsa.

And they came back a year later, not all of them, but we had to start over again.

So, there is a risk associated with that.

Thrust structure.

We saved 1200 pounds by stiffening, like I told you about a while ago.

And then we used a bunch of other composites.

A lot of people said, especially after Challenger, let's get rid of this vehicle because it's antiquated and was designed too long ago.

That probably is still one of the most advanced composite structure vehicles flying today.

Except, where there is a lot of aluminum honeycomb, you probably could go with graphite/epoxy.

And I will give you a challenge with that later on.

But there are beryllium aluminum struts in here.

There are boron/epoxy scab on devices.

There is graphite/epoxy all over the vehicle.

Not all over the vehicle.

In a lot of places in the vehicle.

The vehicle has got a lot of composites.

And we stretched to be able to do that.

Certification.

Now we've got the thing pretty well designed.

What are we going to do to certify this thing?

This is where we deviated from the norm and were pretty innovative.

Classically, in the way this program started off, there was a dedicated structural test article and there was a dedicated fatigue test article.

There were a couple of problems with that.

If you don't need it, you might as well not build it, even though that was in the program.

The situation was, as I showed you a while ago, thermal stress was a major part of that.

You couldn't apply a mechanical and thermal load to this vehicle and still be practical.

Concorde did it.

The way that Concorde was designed and certified, they applied mechanical loads in an environment in which they could induce the temperature by convective heating on that vehicle.

And it took them like three years to test the vehicle.

And it was extremely expensive.

It was a big jobs program for Greg Britton and France and some of the others, but we decided we couldn't afford to do that so we are going to have to figure out how else to do it.

Besides that, Aaron had $100 million problem that year.

What can you guy help us do?

What we'll do, we think we can do this, is take an airframe and we will apply 110% of the limit mechanical loads only to it.

And that doesn't certify anything.

And then we will put strain gauges all over this vehicle.

And we will pre-predict what the strain response is going to be for 3,000 points on the vehicle.

If we can pre-predict what the strain response is for applying a bunch of different loads then we know how to analyze the vehicle.

That proves we know how to analyze it.

We can extrapolate to 140% to our ultimate load capability from mechanical, and we will add the thermal stress to it analytically.

So, we did that.

And then we refurbished the vehicle and that became Challenger.

The test article is going to cost $100 million.

We said we don't need it.

We'll use it for a flight airframe.

And Aaron gave us a little ceramic eagle for doing it.

Don't anybody expect As out of this deal, if Aaron has anything to do with it.

There it was.

We applied the million and a half pounds of load at the backend.

We concentrated through loading fixtures, loads on the wings of the fuselage, put pressure differential at various points on the vehicle, and we did exactly what I said.

Fatigue life.

Mechanical fatigue was not a problem.

Acoustic fatigue was an issue because we had some really lightweight structures and really high acoustic levels.

You cannot see it here.

It was like 165 DB around the base-end of the thing, lower levels on other portions, so we said how are we going to do that?

We came up with a different way to do it.

What we will do is we'll go around the vehicle and we will identify a characteristic structure, graphite/epoxy, aluminum, 7075-T6 aluminum fuselage up here, wing elevon, aluminum honeycomb, et cetera.

We identified 44 test articles.

We said that's what we'll do.

We went to Aaron and said it's going to take us 44 test articles.

We went through all the rationale with each one of them, and he said you can have 14.

And so we said but that won't work.

He said go figure it out.

We went back and scratched out heads.

Sure enough, we figured out how to do more extrapolation.

So, we had 14 test articles that you see.

And then what we did was say now we've got our test articles.

Our approach to this thing was we would test them to failure acoustically.

Now we have an acoustic allowable for that type of structure because it's a function of the details.

I mean it had to be the detail.

And, in addition to making sure we have a good test, if this was our acoustic fatigue test article, only the center third was a viable part of the test because the rest of it is boundary conditions that weren't right because they were clamped along the edges or whatever.

We said only the middle third of the test article is viable.

We tested that, we got a fatigue allowable from acoustics and then we degraded it analytically for combined mechanical and combined thermal.

We did that and said also we know that it's probably not going to fail on the first flight so we'll do some inspections.

Tom, let me just make a comment.

He made it sound a lot simpler than it was.

One thing that's important, whenever you do a project or you're in charge of something, you don't want to have yes people around you.

You want to have people that say you're not doing it right.

And it didn't go down that simple.

They were not yes people, believe me.

They were certainly not yes, sir, we're going to go do this.

That's very important.

It's a wonder we still speak to one another.

[LAUGHTER] I'm sorry.

I don't know what a test article is.

It's a test specimen.

If you wanted to put so much mass in here and you weren't sure whether this seam was going to work.

You just put that much mass in here.

You add a little bit more to it and you see if that seam breaks.

That's your test article.

That's what it is, just a test specimen, test article.

But that's a good point because, don't forget, we start off with two entire $100 million test articles for static test and for fatigue test.

Not counting acoustic fatigue.

That was just mechanical fatigue.

As we got into it we said we don't need that.

Did the Challenger's mission life drop because of the test?

No.

As a matter of fact, that's a very good question.

That was one of the questions that was asked by the investigation is what's different about this vehicle than any other vehicles?

Well, it was a static test article.

And we showed ad nauseam that had nothing to do with the failure of Challenger.

The leading edge was not -- Oh, no, excuse me.

I'm off on Columbia now.

No, it didn't have anything to do with it.

As a matter of fact, this is getting into detailed details now, when you apply above a limit load on a vehicle like we did on Challenger it puts a lot of the joints in residual compression.

There is compression at the joint just as you load it and you unload it.

And residual compression increases the fatigue life of the vehicle.

And the reason it does is because fatigue is the function of tensile cycles, not compressive cycles normally.

When McDonnell Douglas tested a DC-10 and they proof load a vehicle, it carries a premium on the selling price for that because it theoretically has a longer life than one that hasn't been loaded.

Good question.

Tom, one more question.

Yeah.

How much did an increase in computer processing speed and availability allow you to do these extrapolations and like do the thermal testing just analytically?

Was that a key factor?

You mean how much as it increased?

Well, how much did it increase between like, say, Apollo and designing the Shuttle.

Not a whole lot.

As far as the analytical capabilities of the finite element models and all, you could get more detail through simplification.

There are more elements available, let me put it that way.

But as far as the crunching capability, it increased somewhat but we were still, you know, if you have to go from here to here, we were about here.

That isn't a quantitative answer for you, but we're still a long way.

We basically used mainframes, and we did have the NASTRAN model.

Yeah, we had NASTRAN.

But NASTRAN didn't have, on a large model like that, the large capability for structural loads and thermal loads.

But you used to put your cards in one day and it would take a couple days before you got your answer.

To do a complete load cycle on this vehicle for internal loads it was something like three months it would take us to do that.

And so it was quite [OVERLAPPING VOICES].

That's another story.

Thermal protection system.

Change gears now.

Let's talk about the thing that protects the vehicle.

Now I'm going to switch back and go back to get ready to proceed toward preliminary design.

What were the requirements on the thermal protection system?

It had to protect the vehicle from max temperatures like about 2800 degrees on the surface, reusable 100 times, it had to be lightweight and had to be cost-effective.

Pretty simple high-level requirements.

And Dr.

Bob Ried will talk to you about the things that they derived as far as the aerothermal in this and how it became that, but it was a given to us.

What did we know about this thing?

Well, we had some ablative TPS experience from Apollo.

Gemini had some metallic TPS on it primarily Rene 41 and some other exotic materials.

Mercury had an ablative TPS, but they weren't reusable.

They were hot structure designs which existed but that we didn't have materials that could carry the load at temperature such that it could be a fully hot structural design, and that was extremely complex.

Metallic TPS, we could get there theoretically with some fairly exotic materials called columbium and Rene 41 and some other things, but the devil is in the detail in that.

Let me tell you a story about that.

We were looking at some Haynes 188 panels.

And so we had a test article, a big panel about the size of the desk that you're sitting at, any one of you there, and it was corrugated so that it could expand and contract.

And it was good for 1800 degrees, so we tested it to 1800 degrees in the center of the panel multiple times.

And it had a frame around it where the panel could move around because it needed to, to be able to thermally expand.

And the center of the panel was 1800 degrees, the edge of the panel where the heat sink was, was 40 degrees lower temperature than the center.

And the panel floated within a gap maybe about like that, so it could move around pretty good.

But what it also did, with that temperature differential of 40 degrees, we got something called creep buckling.

The structure expanded and crept and deformed permanently.

Had we flown that vehicle, had we designed a vehicle like that, what that would have done is would have allowed plasma to flow through the shingles, if you will, and into the structure.

And that's exactly what happened in Columbia.

Letting the hot plasma gas get in the vehicle, you cannot stand it.

It's the details about that.

We said we're not going to go with a metallic design.

Plus, if you scratch it, it oxidizes.

And, if it oxidizes, then it can fail.

So we went with something that was just coming online, and that was a fused silica material.

And fused silica is pure sand, pure silica material.

That's all in the world it is.

The process is you make it into a fibrous structure, if you will.

Fibrous material is a better term.

A fibrous material that is mostly air.

It is about the same density as balsa wood.

It has an ultimate strength of about 12 psi, tensile load is about all that it can take, but it has a thermal performance that is fantastic.

As you will recall this chart here, when you look at LI-1500, is what that was with aluminum, and that's what we went with, we used this same characterization to decide what the material we were going to use was on the vehicle from a weight standpoint and a cost standpoint.

The way the tiles work thermally like this is the low strength brittle, almost like glassy material, it's a ceramic, is coated with literally a glass coating on the outside about 60-thousandths of an inch thick and it's black.

As the vehicle comes back in and dissipates its energy through drag and heating, 90% of the heat is radiated away from the vehicle, 10% of it goes into the vehicle.

But this is such a good thermal isolator, a poor thermal conductor, by the time the heat gets to the vehicle, the vehicle is back into an atmosphere where it's not heating anymore.

That dictated the thickness of these tiles, of this silica material.

The vehicle has got almost 21,000 tiles on it, and they vary anywhere from a half inch thick up to about three inches thick.

It's sculptured to stay within the mol line because the aerodynamicist told us what it has to be.

And so what we did was sculptured the TPS so that we didn't have any more than we needed.

Great job by all the thermal analysts.

I mean they did this fantastic.

I want to mention, when that says 9 pound or 22 pound tiles, that's not the weight of each individual tile, that's the density per cubic foot.

Per cubic foot, correct.

Thank you, Jeff.

What was the footnote about Columbia on that?

On the last chart, Tom, there is a footnote about the difference in the Columbia.

Let me come back to that in just one second.

What I want to talk to you about right now, this is something I had from some old material.

I was just trying to get a characterization.

What that said is on Columbia there was an infrared sensor as an experiment.

So, the number of tiles varied on that vehicle compared to all the other vehicles because of this infrared thing at the top of the vertical stabilizer.

I should have cut that off.

You're reading too close.

[LAUGHTER] We thought let's figure out how to take this fragile material and put it on this aluminum structure which has a high thermal coefficient of expansion.

The tiles have almost a zero thermal coefficient expansion.

We said we've got to isolate that.

We put a strain isolation pad [UNINTELLIGIBLE PHRASE].

Why do they vary in density?

Yeah.

Because primarily for strength, for one of the things.

And the LI-2200 was a little bit higher temperature capability.

And I don't remember [OVERLAPPING VOICES].

But it had a little higher peak temperature capability.

And that was dictated by what one of the failure modes of a tile was if you exceed the temperature too much it starts slumping.

I don't want to say melting but it begins to distort.

And a LI-2200 didn't distort to the same extent that a LI-900 tile did.

We said let's isolate the structure here from this material up here which is required to keep from failing all these tiles, so we put something between them.

It was just a very loosely woven felt material.

Now we proved that the aluminum can expand all it wants to, or within limits, we looked at it realistically, and that the tile was OK, except the tile couldn't be too large because of this relative expansion and contraction.

So, that dictated the size of the tile.

We literally pre-cracked them, if you will.

We put expansion joints is another way of looking at it.

A typical tile is 6 inches by 6 inches when it gets into the highly heated area.

Now all of a sudden we've got some room for the title to move relative to one another, structure to move underneath it because of the strain isolation pad.

And we said, viola, we've got this problem fixed.

We're good to go..

We said we've got 25,000 of these tiles that we now have to certify that they're good to go for the vehicle.

There were gaps between the tiles?

Correct.

But, when you re-enter, do the tiles expand so that there are no gaps?

No.

What we do is make sure that the gap can just close but not close such that you're loading one tile relative to the other.

That set the gap.

And, if during manufacturing which is not that precise, if the gap was too large we just stuck a gap filler in.

Not the one that was on the last vehicle.

It's a different kind of gap fill.

Just a piece of Nomex or SIP material strain isolation pad coated with rubber or with RTV, and we stuck it in between the tile just to reduce the flow if the gap was too large.

So there is no chance that you would have hot plasma coming in between them?

Yes, there is a chance you can have plasma going through there if the gap is too large.

We had a very specific requirement.

I think it was like 90-thousandths of an inch between tiles.

And if it were, say, 130-thousandths of an inch, as installed because of tolerance buildup and all that kind of stuff, then what we did was stuck a plasma flow preclude, if you will, a gap filler between those to stop the plasma flow from getting between the tiles.

And we had some experience where we lost some gap fillers, plasma flowed between the tiles, caused excessive heating on the tiles and started causing them to slump and melt a little bit, did a little bit of structural deformation but nothing significant.

Losing gap filler was a turnaround issue, not a safety of flight issue.

We made sure of that.

Excellent question.

This is more of a general question, but I'm wondering if since then anybody has done any work to find a material that could accomplish both tasks, the structure and the thermal protection rather than having to deal with these types of issues.

That was back to one of my trades were we said let's take that approach and see if we cannot design a vehicle that can take the temperature and the loads, too, both.

There was no material that existed.

I don't think a material exists today that I know of to be worked to a high enough stress that you can keep the weight down to have those kinds of temperatures and to be worked at a high temperature.

I think on the X-33 design they were talking once again of trying to make it out of a metallic structure.

Part of it was structure and part of it was tons.

But we never got to the point of being able to fly and test it.

But they also were using a thermal isolation system like tiles over part of the vehicle on the X-33.

The Buran, which was the Soviet copy of the Shuttle, they were very anxious to get away from the expense of the tiles.

And they ended up with a thermal protection system not very different than what you said.

You mean they had tiles?

Yeah.

As a matter of fact, I remember they were more like bigger blankets.

That's a good point, Larry.

I was about to skip over it.

I said they were typically 6 inches where they were really thick, but in other areas we made like 12 or 15 inch tiles that were very thin.

And the reason we could do that is we decided if they crack it doesn't matter because the gap wouldn't be large enough for the plasma flow to go through there and it would simply be a self-relieving.

So, we tried to reduce the cost of manufacturing by making some of these tiles larger.

And I will show you that in just a second.

I'm going to skip forward here and show you one thing..

That's 50-thousandths of an inch.

The allowable for the tile was 12 psi.

The ultimate stress was 12 psi.

The allowable stress was about 8 psi.

And that's with the total loads combined on the tile.

What do you have to consider in one of these 25,000 tiles that you have to assure is not going to come off the vehicle?

Remember I said when we looked in the early phase studies of the vehicle we were looking at wing loads and stuff like that?

Then we got into how is the wing going to carry the load into the fuselage to the spar and what was our design trade on that?

Those were sort of macro and semi-macro systems engineering studies.

Now we're into a micro.

Now we've got this little critical part, 6 inches by 6 inches.

Lose any one of about 10,000 and you lose the vehicle.

It's got an 8 psi allowable strength.

We said well, that's no big deal.

What are all the environments on this thing?

We started looking at pre-liftoff, liftoff, ascent, et cetera.

There is always something called mismatch.

When you take something that is not perfectly smooth and you bond something to it and they are not to the same flatness, if you will, there is going to be a stress induced into both parts of those.

Well, the structure doesn't care about that stress but this little 8 psi allowable tile does.

It says we cannot exceed about 19-thousandths of an inch under one of these tiles for this to happen.

There is ignition over pressure during ascent.

There is acoustic and vibration and that kind of stuff that has to be considered.

On ascent there are gradients because of shock moving across the tile.

There is internal pressure.

There is skin friction and drag on the tile, so you've got to consider that.

You have to consider the dynamics, the inertial loads induced in it.

And the out of plane deflection is now the vehicle flying.

The structure is deforming.

So, you've got to consider that.

Now you can see you've got 25,000 tiles with all these combinations of load conditions so how in the hell do you design that?

This is the characterization of it.

This is what happens with a structural deformation of like 10-thousandths of an inch deflection underneath a tile.

With that kind of formation it causes 1 psi.

And it linear almost.

So, 20-thousandths of an inch deflection is going to cause 2 psi.

Well, 2 psi is not a lot but it's a quarter of your allowable.

We said we've got to consider that.

We have to understand what is happening to this structure as you fly it, a condition.

This is a free body, if you will, of the pressure distribution on a tile.

It has internal pressure within the tile.

It has a pressure differential on the outside of the tile because of a shockwave moving across it because of the pressure as it varies around the vehicle.

So, you have to consider all of that.

We did all that and said we've got a problem, because what happened was all of a sudden our allowable on our tile was decreased by half.

And this was not good.

We screwed up, in the systems engineering point of view, when we did this.

Remember we put the strain isolation pad underneath the tile and we did all these other loads on it?

What we forgot, or what we didn't realize was this strain isolation pad had little stiff spots in it because of the way it was stitched to keep the strain isolation pad together.

And every stiff spot acted like a hard point.

Now, when you take a tile and you put external loads on it and there is a stress concentration on each one of those things, that stress concentration had an amplification of two.

All of a sudden our allowable were decreased by a factor of two.

And we thought we have a major problem.

This is when Aaron and I got to know one another better than we ever wanted to.

We met every day on this thing.

We had tiles bonded all over the vehicle.

Necessity was the mother of invention.

What we had to do was dissipate this stress concentration.

We said we'll put a plate underneath it, a graphite/epoxy plate or something like that.

That would have added a lot of weight to the vehicle.

Glen Ecord, a materials guy came up with the idea in the lab one weekend, he took silica powder in water and just painted it on the bottom of the tile.

What it did was fill all the pours in the tile for about three-sixteenths of an inch.

And just compacted themselves in there.

And that was an inherent capability of a tile with that powder packed in it, if you will, that doubled the strength of the tile.

What it did is it dissipated the load from being concentrated into the tile.

So, without any weight, some cost, we had to pull some tiles off the vehicle and densify them.

Now all tiles are densified.

I meant to bring one to show you today but I didn't.

Analytically, we went through 25,000 tiles.

Here was our factor of safety distribution over the entire vehicle.

We said we're good for that, but the thing we don't know is if the tile is really bonded on the vehicle like it should be.

We said we can fix that problem.

We will verify it.

We will pull on every tile and make sure that it has a capability of the maximum expected mechanical load that it is going to see.

And so we pulled on every tile.

And John Yardley, being an old stress guy, says let me ask you a question.

When you pull on every tile, how do you know you haven't induced more damage and decreased the allowable of the title because of your proof test?

Good question.

Easy answer.

We'll put a microphone on every tile and we will characterize the sound of the tile as we pull up on it, and we will get a sound allowable, if you will, for proof-testing the tile.

We did that on every tile that had to be proof-tested.

We had an acoustic emission device, we had a microphone on there, we characterized all these tiles and we did it.

Another little mother's necessity of invention.

And I'm not going to go through this.

You'll get a handout of this.

What this did is said you cannot proof load every tile, every tile is not densified, some tiles are thick, some tiles are thin, but prove under no uncertain conditions that you're safe to fly.

We went through this logic on everything.

Some of these things had gates that said go directly to fly.

Others we had to go through.

Others we had to pull off the vehicle and densify and proof load and do a bunch of other things to prove that they were OK.

We got there.

Now we're into operations.

We're just about out of time.

I know.

I've got three minutes left.

Can I have all three?

OK.

Here is what we did.

We did some pretty innovative things on this thing, and I think I've shown you some of that stuff.

But what were the surprises we had on the first flight?

Not very many.

As we were going uphill, I told you about the plume effect from the engines blocking the flow, that causes the pressure distribution on the wing to be different than we designed for.

The center pressure was further aft and outboard.

That loaded up the wing more.

It could not fly to the design conditions that we needed to under worse case.

And I'll tell you what we did on that.

Well, let me just tell you right now.

What we did was almost day-of-launch wind analysis, loads analysis for the wings with load indicators in the wing to understand what a specific flight regime was going to do for that vehicle.

And we literally designed the trajectories for the first six or eight or ten shuttle flights so it stayed within a reduced capability of the vehicle.

Because we characterized it so well, we could do that.

The other thing was the overpressure of the vehicle, when the main engines let off there was an accumulation of hydrogen gas underneath the vehicle.

And as soon as the engines fired it ignited that hydrogen and sent a big shockwave up the vehicle.

It could have been pretty bad but it wasn't, so we fixed that by isolating the isolation and also burning it off prior to engine ignition.

And then we got some tile damage from external tank.

We fixed that.

After about the second or third flight on the external tank, we changed the foam process and controlled that.

And so those were our only surprises.

You remember the chart that I showed you of all the combined environments on a tile?

This is not politically correct what I'm going to say, but I'm going to say it anyway.

The shockwaves, the pressure, the out of plane deformation, all that, you didn't see debris anyplace on that chart.

Those tiles are not designed for debris, period.

You can rationalize it.

You can arm wave it.

You can statistically analyze it.

The vehicle is not designed to fly in debris.

It can take every other thing it's designed for, but it cannot take what it's not designed for.

The engineers today have two choices.

They can either eliminate the debris from the external tank or, in my judgment, they can go back and recertify the tiles for the expected debris.

And that's probably not too big a deal, but they cannot say we're ready to fly, going through a logic matrix like I did, until they do that.

OK, guys and gals.

Here are some challenges for you.

As you go through from the beginning of a program, I would like you to be looking at this crew exploration vehicle, what other parameters would you look at other than what I've shown you here and what tools would you use?

On the combined thermal mechanical, I think a lot can be done on that.

I don't know what all the computing capability is today, but I think that you could really simplify and probably decrease the weight of the vehicle by doing that.

Could they be made more rugged?

Yeah, they probably could.

But be careful.

This is a big systems engineering issue and it's a political issue.

And I'm going to get off the stage here in one second.

Should there be a dedicated crew escape system or should the reliability be built in the vehicle?

And I'll promise you that answer is not known.

It may be known from a political standpoint that you have to have a crew escape system, and that's OK.

If that's a requirement, that's a requirement, but in a total system crew safety reliability that's not obvious.

It depends on what the design is and what the reliability of the constituent elements are.

How would you fix the ET?

Put shrink wrap all over it.

Another thing that's not part of the curriculum here is political systems engineering.

You can have the best engineering design in the world, but if you don't have the political support in a program like this it doesn't matter.

How does political influence come into a systems engineering thing, kind of like the crew escape system?

Thank you.

[APPLAUSE] Well, that was just super.

This is hopefully the first of many lectures which will take us to a much greater depth [then when we did the shuttle system?].

Free Downloads

Video

• iTunes U (MP4 - 263MB)
• Internet Archive (MP4 - 463MB)

Subtitle

• English - US (SRT)