Launch failures: what’s changed?by Wayne Eleazer
|
| During the reconstruction of the Atlas launch pad they decided to discard the separate turbopump exhaust duct. And on the next launch the Atlas blew up just after engine ignition. |
On one of the earliest Atlas D missile test launches from Cape Canaveral, the vehicle exploded at liftoff, doing severe damage to the launch pad. This was all too common at that time; it was for this reason that most US launch facilities to this day are designed with the ability to be quickly constructed and easily repaired as a higher priority than that of simply conducting efficient operations.
During the reconstruction of the Atlas launch pad they decided to discard the separate turbopump exhaust duct. The Atlas turbopump had its own exhaust, separate from the roaring flame that came from engine thrust chambers. While producing sufficient thrust to power a sizeable airplane, the turbopump exhaust was nothing compared to that from the engines and clearly could not add anything significant to what the flame bucket had to handle. So the separate exhaust duct was not rebuilt.
And on the next launch the Atlas blew up just after engine ignition.
Analysis by Rocketdyne concluded the failure was just one of those things that happened with rocket engines. Starting a rocket engine was fraught with opportunities for disaster. Rocketdyne even ended up filling the thrust chamber tubes of some of their engines with salt water to slow down the ignition process a bit. There was nothing to be done for it; one or two percent or so of the engines were going to blow up at ignition and that was that.
They cleared away the debris, rebuilt the pad, and erected another Atlas, an Atlas that, once again, blew up just after engine ignition.
Further investigation found something totally unexpected. The flame bucket at the Atlas pad was flooded with water just before engine ignition, to flush propellant spills away from the pad as well better limit damage to the facility. The fuel rich turbopump exhaust, no longer led safely away by its separate duct, had impinged on the water, accidentally duplicating the industrial process for producing hydrogen gas. The hydrogen rose up, filled the thrust chambers, and provided an extra “Pow!” that blew up the rocket at ignition.
Something had been changed and no one had realized the importance of the change until the rocket blew up. However, in this case a seemingly minor aspect of the launch pad design had been changed rather than the rocket itself. When the pad was rebuilt again the separate turbopump exhaust duct was reinstalled and the next Atlas launched successfully. Problem solved, lesson learned, once again.
Over fifteen years later, on April 13, 1975, an Atlas F booster was being launched, this time from a pad at Vandenberg AFB. The Atlas E and F boosters had many design features in common with the D model but used a different start sequence for the engines. Rather than the relatively slow start sequence of the Atlas D, the E and F models used explosive start cartridges that brought the engines up to speed much faster. As a result, the vehicle did not need a hold down system like the D model because it did not hang around the pad at start up for long, and thus had no problem with hydrogen gas being generated by the turbopump exhaust impinging on the flame bucket water. The E and F models did not need a separate turbopump exhaust duct in the flame bucket.
But in the case of Atlas 71F on that day in April, something else changed, and it once more had to do with the flame bucket deluge water—there wasn’t any. A valve on the pad had failed and the water that normally flooded the flame bucket never made it there.
It did not sound like a big problem to the launch crew and the launch proceeded; the main purpose of the water was just to limit damage to the pad. But at engine ignition an explosion occurred in the flame bucket. The vehicle lifted off but suffered an engine failure in flight; the payload never reached orbit.
| The extra attention to the fabrication process continued until the motor had completed its test program. Then the Aerospace engineer departed from the production process; at this point something had changed but no one realized it. |
Investigation revealed that the lack of a water deluge had led to an explosive jelled mixture of LOX and RP-1 collecting in the flame bucket, the result of the normal overboard leakage of propellants just prior to launch. The propellant mixture exploded at engine ignition, leading to the engine damage that doomed the flight. Once again, something had changed, but no one realized its importance.
Identifying such potentially lethal changes became a major full-time task for the space launch business, one that everyone recognized. Despite this, the innate perversity of technology, combined with the natural inclinations of human beings, kept producing new ways for unwanted changes to occur.
Solid rocket motors are especially susceptible to changes, since they cannot be test fired each time but instead must simply be constructed so as to duplicate known successful examples as closely as possible. This fact produces special requirements to detect and manage changes.
During the development of the Thiokol Star 48 rocket motor for the McDonnell Douglas PAM-D upper stage, the decision was made to push the envelope when it came to the rocket nozzle design. The Star 48 followed the highly successful oblong titanium case design of the Star 37 series but the greater thrust and longer burn time of the new motor would present a tough environment for the existing nozzle design. A well-known graphite material already in production, G-90, would be used for the nozzle throat, while an advanced carbon-carbon composite exit cone would replace the carbon-phenolic design of the earlier motors.
Test firings were conducted and went well at first. And then one test firing produced a cracked nozzle throat.
This was puzzling. G-90 had been in production for years and been made in the thousands of tons for the electric power industry; it was widely used for high voltage insulators. Eventually testing found that the physical characteristics of G-90 varied all over the map, and that was no problem for electrical insulating purposes. But such variation was a big problem for rocket motor use, and no one knew how to produce G-90 with the required characteristics. G-90 had to be abandoned for use in Star 48 nozzles and the older phenolic design approach used for the nozzle throat.
Then there was the advanced carbon-carbon exit cone employed for the Star 48. It worked okay, but the Star 48 was found to display a strange wobbling motion during flight. The Aerospace Corporation, convinced this was due to a weakness in the exit cone, began carefully examining the manufacturing process and eventually advocated adding steel pins to the nozzle structure. An Aerospace engineer began sitting next to the worker fabricating the exit cone and occasionally asking why he did it a certain way. As things turned out eventually, the added pins did not help the wobbling problem and another fix had to be devised. However, the process of having an engineer sit in on nozzle fabrication and ask things like, “Did you do it that way last time? No? Well then, why don’t we do it the way that we know worked last time?” continued. The extra attention to the fabrication process continued until the motor had completed its test program successfully and the Air Force had acquired the eight Star 48 motors required to support its planned GPS missions launched on Atlas boosters. Then the Aerospace engineer departed from the production process; at this point something had changed but no one realized it.
The Star 48 flew fifteen entirely successful missions, including one in a tandem two-motor configuration for the Air Force’s GPS, and then came Space Shuttle mission STS-41B on February 3, 1984. The mission was to deploy two commercial satellites, Palapa and Westar, from the Shuttle cargo bay, after which they would be boosted to geosynchronous transfer orbits by Star 48 motors. Neither satellite made it to its intended orbit, both Star 48 motors losing thrust shortly after ignition. The motor exit cones blew off.
Analysis indicated that the carbon-carbon exit cones were very sensitive to the assembly process. When the extra engineering attention was withdrawn from the process, defective cones were produced. The Star 48 nozzle was once more redesigned to use the older Star 37 nozzle design features.
But it did not take pushing the performance envelope for a fatal change to creep into a solid motor production process. The earlier Star 37 series of motors had been flying successfully for decades when a little problem occurred during the production of one nozzle. The production process called for the felt core of the nozzle to be heat treated by placing it in a plastic bag and soaking it in hot water. The bag broke and the nozzle core was soaked. It was dried out and production of the nozzle continued.
| Changes rarely, if ever, occur spontaneously but typically are associated with a deliberate action by some human being. Detecting such actions and assessing their full import probably is the most challenging task in mission assurance. |
On December 1, 1990, the motor with that previously water-soaked nozzle was to serve as the second stage for a Defense Meteorological Satellite Program mission launched by an Atlas E booster. Shortly before what would have been the nominal end of the motor firing, the nozzle shattered. The satellite was delivered to an orbit with a perigee 113 kilometers (70 miles) low. Since the payload required a sun-synchronous orbit, this proved to be a serious problem, a mission failure. The conclusion reached by the investigation team was that the extra step, soaking the nozzle core in water, had caused the failure. When the production mishap had occurred it was not obvious that it presented a problem, but it represented a change to the process, a change that had never been tested.
Unexpected changes were found during the investigation of one of America’s most famous space launch failures as well. The solid rocket boosters used on the Space Shuttle Challenger utilized a zinc putty that was impregnated with asbestos. During the investigation of the STS-51L failure it was discovered that the Environmental Protection Agency had forbidden the use of asbestos, so the manufacturer of the putty had substituted what they considered to be an equivalent material. The company put cotton fiber in the putty rather than asbestos, and did not bother to tell anyone about the change.
As it turned out, the change in the zinc putty was not a factor in the loss of the Challenger, but the discovery showed once again how easily unknown changes could occur, even with a man-rated system and its accompanying high level of oversight.
The above examples are all American, but the problem is all too common in the space launch industry, and international in scope. A Soviet manned mission exploded on the launch pad because some solder in the propellant system had been changed to an incompatible type. Ariane boosters failed because of changes in the flight control system and a new engine nozzle design. Virtually every booster type has had a failure related to undetected or even simply unappreciated changes. For that reason, “first flight” items as well as “out of family but within specification” hardware traditionally has received special scrutiny, even when no specific technical concerns could be identified.
Changes rarely, if ever, occur spontaneously but typically are associated with a deliberate action by some human being. Detecting such actions and assessing their full import probably is the most challenging task in mission assurance. Elaborate configuration control systems were devised and tied into the government contract management structure to ensure that engineering changes were approved by both contractor and government management prior to implementation.
And still things slipped through on occasion. The author once happened to be present at a General Dynamics engineering change approval meeting and was forced to point out that a seemingly minor design change violated the corrective action recommendations of an Air Force mishap investigation. This revealed a significant problem: Air Force regulations forbade directly informing private contractors directly of such recommendations! Corrective actions transmitted to contactors had to be in the form of specific instructions for the steps required, not a general instruction to “avoid doing such and such type of things.” Of course, this approach in turn required a detailed insight into the contractors’ engineering efforts, and that level of information typically not available even in the “good old days” of tight government control.
Detecting and evaluating changes is a challenge that has become significantly more difficult as changes in the launch industry have occurred and government controls have loosened. The use of the Total System Performance Responsibility approach, first employed on the Titan IV procurement, reduces government oversight of the hardware—and as a result tends to reduce government analysis capabilities as well. You don’t use what you don’t need and so you get rid of it.
Within the industry, mergers change the management structure of existing companies, and brand new companies coming into the space launch industry often neither have a suitable oversight structure in place nor comprehend why such a system is so important. All too often they learn the hard way why those seemingly antiquated structures were created in the first place. Trying to determine what is not truly a change in a piece of hardware but what amounts to a basic philosophical change in the responsible organizations may be the most difficult type of change to detect of all.