William Gerstenmaier at MIT – 2009 MA Space Grant Consortium Public Lecture

William Gerstenmaier at MIT –  2009 MA Space Grant Consortium Public Lecture


[MUSIC PLAYING] HOFFMAN: My name
is Jeff Hoffman. I am the director of the
Massachusetts Space Grant Consortium. Space Grant is a
NASA-sponsored organization involving over 750 universities
nationwide of which we have 18 here in Massachusetts
who are members together with the Museum of Science
and the Christa McAuliffe Challenger Education Center. Space Grant is interested
in aerospace education, in increasing the workforce
of trained aerospace workers, engineers,
especially systems engineers. It is also a presence
that NASA has in the many states which don’t
actually have NASA centers. And one of the things which
the Massachusetts Space Grant has been doing, really,
over the last 20 years– if you look at the last
page of the handout, you’ll see a list of very
distinguished lecturers who have come here to talk
about their work in aerospace. And this year, it’s
our great pleasure to welcome William
Gerstenmaier who is the NASA associate
administrator for space operations. I’m not going to give
you a complete biography. It’s printed out on the inside. Probably all of you have
had a chance to read it. But I just want to
remind you, first of all, that with
the responsibility for spaceflight
operations, that means that Bill is responsible
for the operation of a space shuttle and the
International Space Station. So you can do the
arithmetic yourself of how many billion
dollars a year he’s actually responsible
for and how many billions worth of accumulated hardware
he is responsible for. It is a very serious
responsibility. And I think NASA and the
country is really very fortunate that in Bill they’ve
found somebody who is not just a competent– more than a competent–
excellent administrator, but is also a first-class engineer. I actually first got
to know Bill way back in the early 1980s when he
was a propulsion engineer at the Johnson Space Center. And he admitted when we were
talking about that earlier today that that’s
still his deep love. And he is still a
working engineer. And he is very much interested
in the engineering aspects of all these very
complex systems that he is responsible for. In fact, the title
of the talk that we use as a working
title for a long time is “The Transition
From the Space Shuttle to the Constellation System.” And he’ll have a few words
to say about that at the end. And we’ll certainly answer
a lot of questions about it, but, in fact, one of
the critical aspects of the transition
from the space shuttle to the constellation system is
the continued safe operation of the space shuttle itself,
which is no easy task. You’re all aware that the space
shuttle is extremely capable, but it’s very complex. It’s getting old. And over the years, we’ve
had a lot of problems, which have had to be addressed. And as an example of the sort
of continuing engineering problem that has to be dealt
with in the safe operation of the shuttle, Bill
is going to talk about a recent
systems engineering problem which had to be solved. So I think this is a really
nice talk here at MIT that you’re going to hear,
really, about a systems engineering problem of
operational importance for the space shuttle. So with that, I’m going
to plug you in, Bill, and invite you to
come up for your talk. GERSTENMAIER: Thank you. All right. So, again, thanks, Jeff. And thanks to everybody
that took time to come here. I’ll keep this kind of informal. And I’ll talk a little bit about
a systems engineering problem, as Jeff talked about. And I’ll answer any questions
on transition and other things, but I think it’s good that
you get a chance to maybe hear kind of behind the scenes how
we solve problems with the space shuttle, and how
we fly in space, and what things are there. So I’ll take this example. This is the flow
control valve issue. I jokingly call this my
senior design project. I’ll start out with kind of
a chronological order of how this unfolded. And I won’t do it in hindsight. I’m going to do
it as it occurred to us in the engineering
community and the shuttle and station programs
on a day-to-day basis. So I could go to the end. And then you would get the
Reader’s Digest version– and we fixed the valves, we flew
them, and everything was okay. But that’s not the way
it really happened. So now you get a chance
to see how it unfolded. And then you’ll
get a chance to see how we use system engineering
tools, how we use the team, how we used expertise, how
I used folks in Mississippi, people in Cleveland,
people out in California, all together as a coherent
team to go solve this problem. So with that, you ought to
get an understanding of kind of where we are overall. And I’ll answer any kind
of questions at the end. HOFFMAN: So it’s the one
closer to you that makes it– GERSTENMAIER: Yep. All right. Other way? Oops. Other way. Here we go. HOFFMAN: Yeah, because here’s– GERSTENMAIER: Here we go. Okay. HOFFMAN: That’s the
laser if you need it. And the middle one is forward. GERSTENMAIER: Okay. So this is a schematic
of the shuttle. This is that big
orange tank you see out on the outside of the shuttle
in simplified schematic. It has an oxygen tank
and a big hydrogen tank. The system that we
had the problem in is in the hydrogen system. And the way that the
shuttle works is we have the three main engines. And each one of
the main engines, we tap off the hydrogen that
cooled the outer jacket here. We tap that off, and we run it
through a little thing called a flow control valve. And this valve, this
tiny little valve, controls all the pressure
that goes into that tank. And I should have brought that– I had the valve with
me in my briefcase, but I forgot it, so we
didn’t bring the valve. But it’s a little small valve
about the size of this device. And there’s three
of them in there. And they control all the
pressurization of that tank, and so they’re obviously
a very critical component. So if you take a look
at where they live, there’s three of them. They live in the aft compartment
of the space shuttle. They’re in these
three locations. They’re latch valves
56, 58, and 57. They sit in those
three locations in the aft compartment
of the shuttle. So the main engines– the plumbing goes from
there, up to these valves. Then it runs up the
entire length of the tank, about 170-foot run of pipe. Goes back down in and drops into
the top of the external tank. And their purpose is to
keep the tank pressurized and at the proper
operating pressure. So if you take a
look at them, this is what they look
like in real life. They’re about this size,
the size of this pointer. They’re made up of shims. They sit– oops– and
this picture kind of shows a little more detail
of where they are. Let me just go back one. They have shims on them. I don’t think there’s
anything else. Here’s a solenoid that
keeps them in place. They’re here. This is the way that the
flow comes down, comes out of the main engines,
goes in here, then flows to this little
area, then flows out, in and out that 170-foot
run to the tank. You’ll notice that the entire
poppet stroke is 170/1,000 of an inch. So it hardly moves. It also never goes fully closed. It’s always open at some
point to keep the tank there, because, if you think about it,
the pressurant that’s coming in is coming from the
main engines that pressurizes the
tank that is then feeding the same main engines. So it’s a closed loop. So therefore, it never actually
has to ever fully close. And so when this solenoid
is activated– or energized, it pulls this valve
in, 170/1,000, slows down that flow,
keeps the tank pressurized. And then when it’s turned off,
it goes to the high-flow state. So with that, you know
everything about flow control valves. So you can check that off
on your resume somewhere. Now, this is what
we saw in-flight. So what we saw in-flight
was this is one valve, operated fine. This is the outlet
pressure– looked okay. This is the center
valve, latch valve 57. It went to essentially high
flow and stayed at high flow until we got main
engine shut off. This third valve,
it shut down when this one went to high flow,
because all three of them tee together, and they
flow into the tank. So when this one failed
to open, this one compensated by dropping down. Everything was fine,
absolutely no change, performed exactly
the way it should. Totally nominal
engine performance. Everything looked good. The system did exactly
what it should do. We looked at this in-flight
after the first eight minutes. We saw it right away. We assumed, ah-ha, the
electrical system broke. The solenoid didn’t work. The valve went open. We’ll fix the wires. We’ll go fly again the next day. No big deal. And you will note that
that was November 15, 2008. And again, not in hindsight–
this is as it occurred. So we looked at this. No big deal. Easy. Must be a loose
connector, loose wire. The valve didn’t fully
close, so life was okay. Now, December 19, we go
into the aft compartment. We X-ray into that all that
plumbing you saw there. We stick a couple of X-ray
plates underneath there. We put a radiation
source on the outside. We shine the X-rays through
there, and we get this picture. Now, if you look at this
picture, to the trained eye, you can’t really tell
what you’re looking at. But instead of seeing a
full, round circle here, you can see there’s,
like, a piece missing. So if you look over
here on this picture, there’s a full, round,
like, quarter-sized piece. And there’s this chunk missing. And what we see in the X-rays,
we saw this chunk missing. So that’s what gave
us a clue is, hey, there’s something wrong here. There’s a piece
missing to this valve. It looked like it failed. We pulled it out, and
this is what we found. So just a little tiny piece. And if I had it with me– it’s really small. It broke off. And then that allowed
it, essentially, to mimic high flow. And then the other
valves shut down. So the failure was this
little piece broke off, and now our problem
was– from December 19– is to figure out what caused
that little piece to break off. So the first thing
we did is we said well, we’ll go look upstream. See if there’s anything upstream
that could have flowed down into the valve. So we looked upstream,
and lo and behold, there’s this big
chunk of braise here. And if you look here,
this is the outside of the tube where
it’s braised in place. There was a hot spot
when it got braised. So the person that braised it
braised it and overheated it. It put some anomalous
gold blob on the inside. It looked like a piece
that separated off of here. We call that the separation gap. It looked like a piece
of this had broken off. So our hypothesis on December
23rd, four days later, was that a piece
of this material broke off, went down, hit
the valve, broke the valve, and therefore the
piece came off. So that was the theory
on December 23rd. We’ll find out that
this was a red herring and didn’t have anything
to do with the problem. But it was an interesting
thought at the time. So then we further
looked upstream. And again, what this is is
this is the flow control valve. This is the flow in. Then it goes here. It hits this 90 degree
corner which is essentially a block of metal. Then it goes around
another 90 degree corner. Then all three of them
T in this manifold. And then they go up
that 170 foot line up to the external tank. So we took a borescope and
went in there and we looked. And lo and behold, here’s
two little ding marks right where the particle hit. So it came in, hit this corner,
bounced off, hit this corner here, and then went up here. It made no marks on this area. Made no marks on
any of this tubing. But yet, down in this area, it
took this little chunk of metal out down in this area. Now the reason this
is important was there is a concern that first of
all, if this piece breaks off, can it overpressurize a tank? That would be one failure. The other concern was that it
turns out that the flow out of this piece– and I’ll
show you some CFD plots in a minute– but the flow out of here is
about 1,000 feet per second. So even though this particle
weighs just a couple grams, it’s just like a rifle
bullet going down this tube. And it didn’t do much damage. But could it actually
damage the tube here? And that’s a question we’re
going to have to answer later. Could it then come up
here, damage a tube? Could it ricochet here? It’s still traveling 700 feet
per second here at this point. It’s 700 or so feet per
second even out here. And then it’s about 600
feet per second all the way up that 170-foot
line into the tank. So that kind of velocity
could potentially penetrate this tubing. So now we’ve got to be careful. If another one of
these breaks off, could it then rupture
a piece of tubing and cause a hydrogen leak? Which wouldn’t be a good deal. So then the next
thing we did is we started taking a
look at our valves to see if we could see anything. So we go to a scanning
electron microscope and we take a look
at our valves. And this is what we
see on the surface. And when the shuttle
was designed, we really didn’t
have the capability to do scanning electron
microscope inspections like we do today. So we look at this. And this is pretty much
that machine surface. So if you look at where
that valve comes together, it’s just like the
quarter pieces up here. And then it comes together
in this little radius where that little quarter piece sits. So this is a 2000 times
x-ray in that little radius. So what you’re seeing here is
just basically the machining marks of how that little poppet
is machined around there. So we didn’t see
anything here that we thought was too anomalous
or too big a deal. But you can tell that there’s a
lot of machining marks in here that could mask
some things if you do the typical kind of
inspections that we do. And at this time,
all we used to do is we would put
dye on the material and we would shine a
fluorescent scope on there and we would look for
cracks or imperfections. It’s not a very
sophisticated technique, but it’s good to
find little cracks and little imperfections. And this was on January
14th when we did this test. So then we started looking at
it from a structural dynamics standpoint. And we started
looking at the flow. And as I described to
you, the flow across here is about 1,000 feet per second. It goes through a
very small orifice. And it turns out that
potentially, that flow can couple into this lip. And this thing can vibrate
at a high cycle, maybe 100,000 Hertz, and it
could actually break off. So we had this
theory at this point that maybe the
failure was associated with this extremely
resonant condition that could occur periodically. We had not changed these
valves from the beginning of the shuttle
program back in 1981. So intuitively, we didn’t
think it could be a problem. But maybe there’s
some coupling that can occur that this
thing can couple into that natural frequency
and just break off a piece. It would be essentially
an uncontrolled breakup as that occurs. So this was the first
kind of analysis we had back on January
21st that started making us get a little bit
concerned that maybe there’s something going on here more
than we had really thought. So then we went back and we
looked at our failure history, and our failure history
was kind of sordid. We didn’t have many failures. We had two failures that
occurred at acceptance test programs. So these valves had
not flown anywhere. They just went
into the test rig. We were doing acceptance
tests to make sure that they were ready, and they failed. And the crack size was– whoops– the crack
size was 57 degrees, or that little arc
was a 57 degree arc. And in this case, it
was a 72 degree arc. And then the failure that
we saw in flight, this was an 87 degree arc and
it had flown 11 times. And then this one, we
went back in our inventory and we looked, and
we could see a crack. And it was a fairly
large crack in there. About 270,000th, 0.27. Almost a quarter
of an inch crack that was very visible even with
our dive penetrate activities. We had pulled this valve out
for an anomaly back on STS-97. We hadn’t looked at the valve. We pulled it out now and
looked at it and lo and behold, there was a crack there. So we had this data, and
this is all the data we had. And what we were
struggling with was, were these initial failures
here with 0 flights– was that this resonant thing
that I just showed you on a previous page or was
it something else going on with these valves? Or were these outliers? Were these manufacturing
defects that we essentially screened out with this
acceptance test procedure? And we didn’t really
know at this time. So what we’re
trying to do here is we’re trying to look
back at past history and relate to what we to
see if we can tease out what the root cause is, or what
the root cause of the failure is. So again, now what
we’re trying to do is we’re trying to data mine. So it was unique to this
valve engine position. So we plot the three
engine positions. We plot where these
valves have flown. We’re essentially
data mining to see if this natural frequency shows
up in only one engine location. Does it show up in others? Is it a function of the
inlet/outlet diameters? It a function of
the valve housing? We’re just looking
at raw data to try to understand if we can
find any correlations. And we spent a ton
of time with this and we couldn’t find anything. We then kind of kept
looking a little bit. We pulled back the acceptance
test procedure failures. And these occurred back in 1990. And if you look at them a
little bit in these pictures, you could see that
there’s initiation site, and then they pretty much just
break in a high-cycle fatigue kind of thumbnail. This is very much
what a crack looks like in a thumbnail section. This one over here, this
is the one from flight. And you can see in
it, it evidences a couple of different zones. You see a zone 2, zone– excuse me. A zone 1, a zone 2,
and then a zone 3. And the zone 3 is
the actual failure. So when we look at this, it’s
another view of the same thing. You can see the various
thumbnails going. This is very typical of
a high-cycle fatigue. So this isn’t a one
time kind of failure. This doesn’t occur immediately. This is telltale
evidence that it occurred over a large number of cycles. So this appears to us to be
some kind of high-cycle fatigue issue, but not an
immediate failure. But our ATP cases– those all clearly look
like they just immediately failed in the first
application of loads. You put a load on
it and it failed. So we use this data to kind of
say that well, maybe these are just outliers. We’ll throw that data out. We’ve got some kind of
high-cycle fatigue problem. We’re probably
okay to fly as long as we screen for
cracks is kind of what we thought at this time. Now I will tell you
that is what I thought. I have a large team
that supports me. And part of my team
carries the title safety, so they have to think
the opposite way I do no matter what I say. And they’re thinking,
it doesn’t matter. This is just nice pictures. You’re crazy. It’s the same failure. It can happen anytime. We’re grounding the fleet. So then we’re having wonderful
discussions about all this. But that’s life. And that’s actually good. So then we said, okay. Now if they’re going to tell
me it can happen on any flight, I’ll go look at the
consequent side. So what I did now
is I went down to– a team went down to New Orleans
down to the Space Flight Center, and we
essentially mocked up the 79 feet of tubing. So we actually put 79 feet of
tubing exactly the same size there. We put an orifice in a line. We put a couple of
camera ports in. We put some laser
measurement ports in so we can get
the velocity right. And we built a little
system to drop particles into this system. And we were firing
particles at 700 feet per second down this tube. And so we fired about 200 or
300 particles down this tube. And you can see
here, this is what it looked like in
the worst bend, which was this first elbow here. Just little scuff marks. No big dings. No big hardware. And you can see here if
you look really hard, we actually bowed the
metal out a little bit with one of the shots. So it’s a kind of a
probabilistic game of if they fly exactly the right way
and they hit flat edge on, they’re just going to scrape. But if they go
knife edge on, they can really cause some damage. So even though this is
pretty compelling test data, it still wasn’t good enough
necessarily for my analysts. So then at this
time we said, okay. Can we do a better
job of inspecting? So what you see up here is– whoops. What you see up here
is we figured out a way to take that
little edge where that little metal
is and we actually polish it with diamond dust. So where you saw all those
little machine marks before, if we put diamond dust on a
little small piece of cloth and we put a
toothpick on there, we can actually shine
that piece up. So then we do the scanning
electron microscope, it’s not hidden by
the machining marks and we can look for cracks. So this was a
brand new technique that we kind of
developed on the fly to go do this diamond
polishing to not destroy it. Now the other problem I
had was I couldn’t remove a significant
amount of metal here or I would invalidate
my flight hardware. Because the shuttle
program’s ending, I took away the
flow-balancing rig that allows me to set the
solenoid strength with the flow through the valve to
the proper current so it moves in the
right direction. So I didn’t have a way, once
I removed metal from these, to ever fly these valves again. So once I actually even did
this little bit of polishing, the valve was no longer
certified for flight. So I couldn’t go look
at all my flight valves with this technique or
I would invalidate it and it wouldn’t be a
piece of flight hardware. Now I’m in the process now,
and the flow rig is up now and it’s available today. But we would’ve missed
that launch window. We would’ve been
after the Soviets. We would probably be trying
to launch about this time now with the shuttle
mission if we would’ve destroyed our flight assets. So I’m now constrained. So this is a different
problem than you’d like to have as an engineer. I would like to go take my
best inspection technique and use it, but I can’t because
if I use that best inspection technique, I’ve lost
the ability to go fly that piece of hardware. So that’s another consideration
that we face in the engineering world that sometimes you don’t
face in the outside world. So then we took a look
at our older valves, which we could easily do. These are the– or excuse me,
these are the newer valves. And because I didn’t have
the new inspection technique, I’m looking at these
with dye penetrate and I’m seeing no cracks. There’s no cracks in any of
my new valves that I’m flying. The only crack I’ve ever had
was this one that actually broke on flight on STS-126. So now I’m starting to build
rationale that maybe there’s something between my old
valves and my new valves that are there. But I’m really blinded here
because I have a very bad inspection technique. I just had this dye pen
inspection technique. I don’t have a way to really
look for the very, very small cracks. And so then what
we’re doing here is that now we
can actually start to see some of these cracks
in these older valves. And this gives you a feel for
how small we’re looking for. The big back line up here
is 2/1000ths of an inch. This crack width down here is
about thousandth of an inch . And these are really small. And so if you think about
it, I do this diamond dust on the lathe. I polish it up. And then I take 4,000 images
around the top of the valve. And then I have someone manually
inspect all 4,000 of those images looking for cracks on
the order of 1/1000th of an inch to maybe 1/10,000th
of an inch in length. And so at first I go to my
guys, why is it taking you, like, two days to
inspect my valves? You should be able to get these
pictures and get them back. And then they showed
me the 4,000 images and they asked me
if I would like to go through those 4,000
images in the next half hour and give them an answer. And I said okay, I understand. So then we went back again. And this is what we
saw with this technique in the older valves. We saw lots of cracks. I mean, they were everywhere. Now the other thing
that’s important is these valves have flown
since the first shuttle flight, so there has been no change
from the first shuttle flight. So we are flying with the same
risk whether we realized it or not since STS-1 back
in 1981 until today. And because we didn’t have
a good inspection technique, we thought everything was okay. But in reality, here’s
what we were flying with. And this is the one
that we found later. This is a big crack. A quarter of an inch long. We even saw that with a dye pen. The other ones we couldn’t see. But we had a significant
amount of cracks in our valves, which
means potentially we could be losing
a lot of these if they couple into this flow. So there’s definitely
something on here we need to be looking at. This is a serious problem. We’ve got to really
understand this before we can go back flying. So again, this is
before polishing. So you can see all the
machine marks here. Then down here, you can
see it after polishing. And then you can see, this
is what the crack looks like. And then I blew it up over here. So again, you can see the
crack over here on this side. So this is a very
good technique. This really gives us a great
way to go look at these valves. The problem is
that it invalidates the valve as a flight valve. So this is the
technique I really want to use but I can’t use. So again, just another
picture of the crack again. Now we’re again back
looking at some of these. So when we found
these cracks, we’ve now got the ability to now
load the edge of the valve. So now I put it in
an Instron machine which you guys
are familiar with, and I tack on a little
strut on the end. And now I’m going to pull
on the valve until it fails. And so what I’m
doing is I’m pulling on the valve with 250
pounds, 12,000 cycles, and I get a failure like this. I pull on the valve 175
pounds for 3,000 cycles, I get failures like this. And so what I’m doing here
is I’m trying to understand, is this high-cycle
fatigue where we get the three zones of fracture? Is that real? And you can start to
see in these pictures, it shows the various failure
zones just like we saw before. So this looks like a very
promising failure mode. So this I’m going to try to
use with my engineering team to say, I’m ready to go fly. What I’m going to try to
tell them is if I dye penned, I didn’t see any cracks. I didn’t have– I’ve got maybe 12
flights on these valves. Nowhere near these
number of cycles. I’m a long way away
from a failure. That’s good enough to go fly. Let’s go fly. So this is the
rationale I’m about ready to go try with my team. And you’ll see at the
end the timeline of where I failed with this rationale. But at least I tried. So again, this is
just the same thing. You can see this is the
part that actually failed. The three zones we talked
about– the four zones. And then down here, I
did another overload. And here what I did
is to get it to fail, I notched a little piece. So I notched the two corners,
and then I overloaded it and it popped. And why this is important
is the crack ran, and it would have ran
further except it ran it into the notch that we
put in to make it fail. So the problem here
was I had to also limit the size of the failure. Because if I lost
a big enough piece, the particle testing where
we’re shooting particles down the tube showed that I
could penetrate a piece of tube and cause a hydrogen leak
which we thought at the time was a big deal. So I was again trapped. And I had to bound the size. I had to show that enough
life in these parts would [INAUDIBLE] and I could go fly. And that’s the rough
flight rationale we were trying to get together. And then my wonderful
dynamicists, the CFD guys, came along. And they did this plot. And what they found here was
that as the engines throttle up and down, the valve
position moves a little bit. And it turns out that
depending on where we are in the throttling
case and the material, you can either couple into
one of these dynamic modes or not couple in
this dynamic mode. So going back to the original
theory where I showed you that you could get the
single event that fails, they’re now giving
me a population why it doesn’t occur very often. It only occurs when I’m in
certain throttling conditions, and I have to stay in
that throttling condition long enough for it to fail. So then we went and
we said, well, okay. We’ll try to fire
some bigger particles. So we fired them
into that elbow. And you can see right
here, I shot a hole through the elbow, which
wasn’t such a good thing. I actually got so good at
sending these things down, I could actually get them
to stick in the elbow, which was not a good thing. But my test team was
exceptionally proud of this. They calculated
ahead of time what velocity they needed to get
it to stick into the elbow. And then they beat me $5 that
it would stick in the elbow. And it stuck in the
elbow and I paid them $5. [LAUGHTER] But I didn’t feel
so good about that. So we had good analysis,
but it showed that, hey. This is really a
potential problem. And you can see the
same thing here. We also put holes. And this is what the elbow
looks like in itself. We manufactured
a bunch of these. And in Cleveland, we actually
shot these particles at them to see what would happen. So then finally, this is
kind of coming to the end, is that what happened
was we had these assets. And then luckily, my team kept
working on another inspection technique, and I’ll show
you some pictures of it in a minute. It’s eddy current. And they were able to use
eddy current to define cracks. So these are my old valves. These are the ones where
we saw the cracks before. We had previously not
seen any cracks here. But now I can get eddy
current indications that show that there are cracks
even in my flight valves. So I got a new
inspection technique that allowed me to now
determine that there were very small cracks present
in some of these valves. So now I had a method
to go hand-select valves to show that there
were no cracks with any detectable
method of inspection. And that’s eventually how
we got to go to flight. Again, this just shows the
various NDE techniques. Polishing and etching, mag
particle, eddy current, and then scanning
electron microscope. They’re kind of all
different techniques, but probably the scanning
electron microscope is the definitive one if
you can look at the images. Eddy current turned out
to be very, very good, and I’ll show you a picture
of that in a minute. But again, I didn’t have that
technique until the very end– until the March timeframe,
just before flight. And what happened was I didn’t
even know that this existed. I was about ready to
throw in the towel. I told my team we’re not going
to fly unless we can inspect. So therefore,
we’re going to have to fix the flow-balancing rig. We’re going stand down. We’re not going to fly
for a couple months. And they go, well, we’ve
got this new technique we’ve been working on. We haven’t told you about it. It’s called eddy current. We’d like to try
it on these valves. If we can and it
works, would you accept that as flight rationale? And I said, well, okay. So then they went
ahead and did that. And what they did
is they went out and they bought a bolt tester. And they had done
this at Christmas, so maybe this is
a Christmas gift. They bought this bolt tester,
and it has a very nice little probe on it that fits
right– this is the poppet– it fits right into
the area of problem. And then the valve scans around. And in about 20 minutes,
they get a trace of the entire interface. And it looks for
imperfections in there by looking at the
eddy current changes and it can detect the failures. And it turned out
to be very reliable. And this is an actual screen
sample of the picture. And even I can find the
cracks that are here. And then they repeat
down here again because they actually
rotate the part around twice to confirm them. But this is very good. It no damage to the part. And it’s 100%–
it’s actually better in some ways than the
scanning electron microscope because it doesn’t need
the human to go find It. So with this tool, I had
the way to go select valves. And this was the way
we ultimately ended up going to flight. At the same time, when I
punched a hole in the corner– we never give up at NASA, right? So we had designed this. And this is a doubler. So we built this
little device that we could install in the
orbiter out at the pad and actually go fly with. It carries a little
O-ring in here, so when I punched a
hole in the corner it seals itself
and will not leak. So I had these built.
They’re certified. They’re ready to go fly. We chose not to fly, but
they’re available if we want to go fly them. So if you can’t fix
the problem itself, can you then put some
kind of splint or Band-Aid on the outside that makes the
consequences less for you? And that was the
intent of this device, but we ended up not
having to use that. So then basically
where we ended up with what we think
is going on is hydrogen-assisted,
high-cycle fatigue. So the fact that it’s in
a hydrogen environment, it’s embrittling that interface. So when a small crack starts,
it hardens in that interface, and then cycles, and then
hardens a little more and cycles and
hardens a little more, and it finally relieves itself. So we’re pretty
confident that we can fly valves
without cracks, we have a good flight rationale. And that’s going
to be our rationale for probably the remaining
number of flights on the shuttle. We do PRA. So we looked at the probability
of the poppet breaking, the probability of the
size being big enough to cause damage, the
probability of an impact, and the probability of actually
causing some kind of damage. And in this is loss
of crew and vehicle. So we’re looking at probably
with the wear-out case, we think we have
about a 1 in 450 risk of flying with this design. So again, I’m going
to go through this, but this is basically the
chronology of what I just talked to you about. But what you see
through here is– oops. Again, I tried to get the
flight rationale here. We do a big flight
readiness review. There was no way I was going
to get the resolution here. We waited until–
the next chart– we waited till here
on February 20th. I thought I had good
enough rationale there. That didn’t work. And then we finally
got eddy current here, and then that was the
thing that actually allowed us to go fly down
here or at least attempt to fly on March 11th. And then we ended up
scrubbing on that flight for an unrelated hydrogen leak. But the thing you
ought to take out of this in terms of messages– you didn’t hear about
any of this in the press. All you hear about in the press
is the shuttle didn’t fly. Some aging hardware
problem, right? And it wasn’t an aging
hardware problem. It was a design problem. The design problem was
there from the beginning of the program. We were exposed to the
same risk all along. We had seen this a couple
times in other failures but we didn’t pursue
it to this level. And now that we finally
pursued it to this level, I think we understand
this problem and we know where we are. Now the story that’s not up
here is we flew successfully. We got back, we eddy
currented the valves. They were fine. They were crack-free. I then got my flow
bouncing facility up. I put one of the valves in
the flow balancing facility. And after the flow bouncing
facility, a crack showed up. So this implies to me that
there’s still this loading phenomena going on. The flow-balancing
facility uses nitrogen, it uses higher pressures
and higher flow rates, so it can definitely
stress these valves. So we’re still going to use
the same rationale to scan no crack-free and then go fly. We’re also looking at alternate
material to go change. So hopefully through
all this, you kind of got an idea of what it
takes to actually get a shuttle to launch and what my life
is as a program manager or AA at headquarters. Now as AA, I’m not supposed
to do any of this stuff, as Jeff said. I’m not supposed to understand
anything technically. I’m supposed to be a
politician that goes and talks to all the White House staffers
and the Executive Office of the President
and all those folks. But that isn’t my passion. My passion is this stuff. They’ve momentarily
got me stuck in DC. So rather than talking about
shuttle phase out, transition, politics, and those
kind of things, I’d rather talk
about engineering. So hopefully out
of all this, you learned something about how
we do systems engineering. This is a huge effort. The team is probably about
1,000 people supporting this. They’re in Cleveland. They’re in Louisiana. They were in California. They were in Marshall
Space Flight Center. I’ve got fluid dynamics guys. I got materials guys. I got NDE guys working
on this, and gals. I mean, it’s an amazing team
of pulling all this effort together to go essentially
from this problem we saw really in December until
flight in March, which is a pretty phenomenal
amount of work in three months. I probably fired over maybe
1,000 particles at tubes. Computer Cray runs on the
order of probably a couple hours out at Ames,
looking at the CFD stuff. So the amount of effort and
work that went into this is phenomenal. The amount of weekends,
the amount of holiday time that the team’s put in
is just unbelievable. So you don’t see any of that. But then when this
flies, I can tell you, I was not looking out
the window in Florida at the shuttle launch. I was looking at the data
of the flow control valves and watching those
pressures at the outlets to see how the
valves were doing. And I didn’t really care
about looking out the window. I knew what I needed to go
look at in terms of data. So again, that engineer
tendency comes through. So with that, I’ll
conclude and open it up to any kind of
questions you have. Anything you want to talk
about just feel free to ask, and I’ll talk to you about
any subject that you’d like. So thanks. [APPLAUSE] Yep. AUDIENCE: Are you going
to expand this validation method of using the
bolt tester to test other components on the shuttle
you might have similar worries about? GERSTENMAIER: Yep. We sure are. It turns out– we looked
at the oxygen valves. I didn’t show you, but
there’s a very similar system on the oxygen side that
pressurizes the oxygen system. We also tap the oxygen off and
feed it in the oxygen tank. We’re doing exactly the same
thing with those valves. And the technique
works really well. So this bolt tester
was actually designed by a company I think in
the oilfield industry to look at bolts– to look at bolt heads. So this tool is
designed very nice. It has two little, tiny probes
that sit right on the edge. It makes it just
perfect for doing this task for this design. So that’s another
huge lesson learned, is you don’t need to go out
and invent your new technique or your new concept. See what other folks are
doing in a totally different industry, and can you then
adapt it to the problem that you’ve got? These guys didn’t
know, but we gave them I think, $20,000 to
go by this bolt tester and it ended up saving a
shuttle flight by probably six months of effort. So we will definitely do that. We’re going to stay– I call it staying hungry. You just need to keep
looking at all these things. So when you get a little
anomaly or a little problem, that’s a gift. So then you got
to take that gift and expand it as far as you can
to understand what it’s really trying to teach you. And don’t just say, that’s a
one-of-a-kind failure and blow it off, because later I
guarantee you it ll come back. Because typically when
a major failure occurs, you’ve seen indications
of it coming along the way and you’ve ignored those
for a variety of reasons. And I think you guys
see that probably in your own testing
in your own labs. Yeah. AUDIENCE: Bill, how
concerned were you that the team becomes myopically
focused on this one problem and that other problems
that need attention in the same reviews don’t get
the same amount of attention? GERSTENMAIER:
Extremely concerned. And so they get
lectures from me. It’s called kids soccer lecture. And in kids soccer,
wherever the ball goes, the little pack of kids
moves to the ball, right? So I tell them that that’s
not how you win soccer games. You win soccer games by
being strategically placed across the field. And the ball may be
nowhere near you, but you need to be there so
when the ball gets there, you’re ready. So it’s the same
thing here. okay, you guys focus on the
flow control valve. This other broader
team, you better be positioned across
that soccer field and be ready for that next
problem that’s coming. Because I get very concerned
that you get this tunnel vision that you’re working so
hard on this one problem, that’s all we talk about. And we don’t worry about
all the other 100,000 things on this shuttle that
could be a problem, too. So that’s a very good point. Yep. AUDIENCE: At what point
where you convinced that this thing would fly? GERSTENMAIER: Well, I
was convinced probably at the second flight
readiness review. So the first flight
readiness review, I was not ready yet
because there was still enough uncertainty. But then by the second one,
I had enough of an indication that I was relying
on flight history, I was using it smartly,
that we weren’t seeing this all the time. I couldn’t believe that we could
couple into this every time. And I thought our dye pen
penetration measurement was probably good enough to go fly. So I was convinced. At that point, I was pretty
much ready to go fly. But my team at that
point convinced me that I wasn’t
ready to go flying. So I acquiesced to the team
and we decided to stand down. And it turned out that
one of those three valves we were going to try
to fly did have a crack in it when we looked at it
with the eddy current. But it also surprised us that
one of the very low flight rate valves, one of the four
flight valves, actually also had a crack in it. So you really have got
to do this inspection. So it’s the hydrogen assist
that’s causing those cracks to form at a non-uniform rate. So I was a little
bit ahead of the team I think in terms of
where I was ready to go, but the broader
team wasn’t there. Yep. AUDIENCE: Was it ever considered
as a possible solution to try to avoid
the throttle regime that was coupling
through the oscillator? GERSTENMAIER: We look at that. But it turns out
we’re throttling because the load on the
outside of the vehicles is around high Q or the
highest dynamic pressure on the outside of the shuttle. We have to throttle
back or the loads get exceeded where the shuttle
attaches to the external tank. So there’s really not
much choice there. And that’s all
automated in software. So those throttle buckets
are going to occur. They’re based on
winds of the day. They’re based on what the
atmospheric conditions are. So I can’t even predict them,
and I can’t bucket them out in software. So they’re going to happen. So they’re going to be there
and they’re going to couple in. And they’re random
when they occur. So there was no way to
defense against that. Yep. AUDIENCE: You kind of
touched on this a little bit, but I was wondering how in
general the end of the shuttle program– does that affect the way
you guys approach problems like this? GERSTENMAIER: I try to not let
it affect the way we’re flying. You know, I’m supposed to
fly all the remaining shuttle flights. There’s nine. There’s really eight,
but we’re going to get another one
added to fly in AMS. So there’ll be nine
shuttle flights. We have to get those done
by December 31st, 2010 is the schedule but I don’t
really let that drive us. We’re going to
work these things. And when we’re ready to go
fly, we’re going to go fly. So I think you need
to be, at my words, you need to be schedule-aware. There was a Soyuz
launch after this. So if I missed
this first window, then I got to go on the other
side of the Soyuz launch. My whole rest of my manifest
ripples a little bit. So then I moved
from the last flight being in September to the
last flight being in October. Eh, that’s not a big deal. We’ll do the right thing. So I think I’m aware of
where the schedule sits. But I’m surely not going
to do anything or push anything that makes us fly when
we’re not ready to go flying. And you could see
that in the team. I mean, when I sat there and
I discussed with the team– you know, you asked me
when I was ready to go fly. I was definitely
ready to go fly. When the team wouldn’t
let me go fly– they tape all these
things, so someday somebody will play this back. And I have this politically
incorrect moment where I explain to them
all the other risks that were getting pushed on
the space station side, and the assembly flights,
and all the other activities on board station that were
dependent upon this flight occurring. And that even
though we thought we were doing a
conservative thing, we may have been pushing risk in
other areas unbeknownst to us. Now I should not say
that, and I feel really bad because I’ve listened. Now, I was in the shuttle
program for both Challenger and for Columbia. So that’s tough. I mean, that’s really
hard in our business. Because I worked with all the
astronauts very closely their. Kids went to school
with my kids. And that’s a huge failure. So I’m not going to
do that knowingly and I’m not going to push hard. But I wanted them to know that
there are other risks out there and it wasn’t quite as easy
as they wanted to make it. So I exposed them a
little bit to my world. And I got a lot of
weird looks from them when I did that because they
were not really thinking about all those other risks
that were getting pushed out. But then I felt kind
of bad about that because I didn’t want to
put overpressure on them to start focusing on schedule. So it’s that kind
of, as a manager, you’ve got to know
when to push the team and when to pull
back from the team. There’s that performance curve,
and where you want to operate is you want to operate
right at that peak at the performance curve. If you’re overloaded and
you got too much work, you’re on that other
side, bad things happen. It just doesn’t work. If you’re on the other side,
you push a little bit harder, you get more performance
so you as a manager got to figure out
where your team is or where your project is. Are you on that
left side where if I push them a little
bit harder they can work a little bit
harder on weekends and they can do some
extra work and it won’t be a degradation of my project? Or are they right at that peak? And if I push them a little bit
harder, then they’re overloaded and then the whole team dynamic
falls apart and we stop? So as a manager,
you’ve got to make that kind of value
judgment of when to push and when not to push. Yep. AUDIENCE: I had a question
not quite like this, but if you’re trying to
[INAUDIBLE] flow or control the flow of a
saturated liquid and– GERSTENMAIER: It’s a gas. AUDIENCE: In this case, sure. But other times. Are you dealing with
[INAUDIBLE] problems at all where you get
some non-linear effects? And do you have any tricks
that you use to deal with that? GERSTENMAIER: Yeah, that was
our big problem was that the CFD for this particular thing– when it flows
through there, it’s like a converging,
diverging nozzle. It’s sonic at that minimum area. But then it opens back
up and it actually goes supersonic downstream. So then the question is when
this little piece breaks off and now the flow increases, how
does that dynamically change and can that accelerate
the particle maybe even 2000 feet per second? So we ran all these
Cray supercomputer CFD runs to look at this. And man, is it complicated. And man, was there
a huge debate. So then we finally said, okay. We’ll take the worst
case and that’s what we’re going to
fire particles at. Because we didn’t
know what else to do. But there’s definitely
a research area to go look at that. I mean, it is very complicated
flow and it’s not symmetric. We can now look at it. Because if you think about
it, it’s flowing in the top. Then it flows around the valve. And then it flows out. So it’s not symmetric. It actually vibrates
back and forth. It is a very complicated flow
regime when you get there. Now the other thing
that’s very interesting is when they did all those
original shuttle design, they had no CFD. So they had no capability to
do what we’re able to do now. And now I look at it,
and I don’t have the time to study it for a lifetime. So we’re trying
to determine what is the right bounding conditions
to figure out the flow particles? And it was very, very difficult. But we looked at that and
we struggled with that. And we had the
best, I would say we had some of the best CFD
folks in the country working on this problem. Yep. AUDIENCE: Sir, Is there
any way to compare, say, the complexity of the center
launch system versus the space shuttle system? And then you say, we’ll
take each collection of complications
and see which is the most reliable to get the
volume and weight and the orbit for station assembly. Is it worth the risk to
use this thing versus what we had in the Saturn system? GERSTENMAIER: I think
that’s a very good question. The shuttle’s a tremendously
capable vehicle. I mean, there’s no vehicle
that can carry– you know, this flight carried
up the solar array that goes on the outside
of the space station. That was a 40-foot-long
solar array. Weighed about 20,000 pounds. Took the full cargo capability. There’s no vehicle
that could carry that including the Saturn. So it was truly unique,
truly needed the shuttle. So there was no other way
that piece could get there. But that’s one piece. But because of that, the shuttle
is unbelievably complicated. It has a heat shield
on the outside, which is not a good thing. It’s cantilevered off
the external tank, which is not a good thing. I’ve got all these
pyro events that have to occur when we do separation. It has a hole in the heat shield
where the hydrogen and oxygen umbilical is attached to
the bottom of the orbiter and they flow
through 17-inch pipes up into the main engines that
are attached in the shuttle through that. That’s not a good thing. It’s got two doors
that have to close after you get to orbit to
make sure the heat shield is attached. So you’re launching with
a failed heat shield to begin with. Then you have to close
two doors to get it there. That’s not necessarily
a good design. So it’s a very complicated,
integrated system. And you saw here, I had to
look in the orbiter half. I had to look at the 79-feet
of pipe on the outside. I had to look at
all those systems to make sure that they
could work and be used. So it’s very complicated. So the Saturn is much
more for a single vehicle And that’s where we’re headed
with the new Ares Orion design. We’re going to separate
crew and cargo. So we’re going to fly cargo
on a separate vehicle, fly crew on another
vehicle, and I think we can cut down on
some of those interactions and some of the complexities
between the two. So I think we need to
be headed to the system that more matches
what our needs are. These flights are
needed because there’s no other vehicle than
the shuttle that can fly these remaining flights. All the hardware is
uniquely geared to them. We take the risk for
these nine flights, and then that’s about the right
time to retire the shuttle and then go on to the new
system that’s more geared to what we need to go do. Yep. You can follow up. AUDIENCE: In that
vein, though, has China’s secured an
advantage in its advance in its space program because
they look at this and say, listen. We’re going to skip
the shuttle business. We’re not going to shuttle. We’re not going
to do [INAUDIBLE].. We’re just doing
pop bottle rockets. GERSTENMAIER: What’s
interesting is if you look at the new Russian
design, which they haven’t showed you yet but you’ll
see it in about a year, they’re going back to
the shuttle a little bit. They’re going to go
to a lifting body, and they don’t think a
single-flight vehicle is the way to go. So the shuttle is
the one extreme. Totally recyclable. Everything’s reusable except
for the external tank. The Soyuz– nothing is reusable. It’s a one shot, one deal. Russians look at that. They want to try to fly 10
times with a lifting body and they want to
minimize their braking thrusters and some other
stuff on their vehicle. So they’re heading back
towards the shuttle. So it’s interesting. We’ve swung now all the
way to totally expendable. The Russians are coming back
towards some recyclable. And then the Chinese– they effectively have copied
what the Russians had. And they Chinese-engineered
it, in my terms. They got all the problem
reports for the Soyuz and they fixed
everything that showed up in the problem reports. They put a new modern
avionics on it, but it’s basically
a Soyuz system. So they, the Chinese,
are trapped back in the Soyuz vintage. The Russians are going
to be going towards us. And we’re going back towards
where the Russians are. [LAUGHTER] And that’ll show up
on some web somewhere and then I’ll be in big
trouble, but it’s okay. [LAUGHTER] All right. Yeah. AUDIENCE: Is there
any talk about having China visit the station? Maybe not the next
flight, but [INAUDIBLE]?? GERSTENMAIER: I don’t know. We don’t even know
if they’re docking system is compatible with the
docking system on station. So we have not had any
dialogue with them. We’ve had no
discussions with them. So the first thing,
again, kind of from the technical standpoint,
is are their systems even compatible with ours? They supposedly use
the Russian system, but I don’t know
if they used it. Is it truly compatible or not? They may have
changed the diameter. They may have changed some
of the latching mechanisms. They may not be compatible. So the first question
is we got to have somebody kind of politically
tell us we want to go do this. And if they do, then we got
to go back and look at it. And you’re seeing some
people talk about it, but I don’t know. At this point, I look at it
as an engineering problem. First of all, I got to
look at compatibility and then we’ll figure
out the timetable to go do whatever we want to go do. Yep. AUDIENCE: It seems a team
with a shuttle being retired, that the variety of vehicles
that would actually now go to station with ATV, HTV,
COTS, and things like that. What are the challenges
you’re facing with thinking of all these different vehicles
having to be accommodated at the station? GERSTENMAIER: Yeah, I think
what’s really interesting, back to your point– everybody thinks a
shuttle is really tough. Well, not only do I do space
shuttle and space station, I also do expendable
launch vehicles. So I even have more headaches. But I’m learning that there’s
something about space that is really about our
engineering capability. So I don’t know if you’ve
watched the ELV world, but I’m also scrubbing
ELV flights all the time for, you know, leaks
in this system. We just had the Atlas V.
Their oxygen system Just had a massive leak in
one of their oxygen pumps on a second stage. They tore it apart. They looked at the inlet. It was full of crud
from insulation that somebody had
sprayed in upstream and it all got sucked
into the inlet filter. So you tend to think
our systems are all easy and they’re not there. But if you really do the
engineering and you peel behind the press reports and you
look, we’re really working state-of-the-art
in a lot of areas. And I think it’s hard even
in the expendable world. So that’s a challenge
to us, because I think people think it’s easy. We’re working with the
orbital space corporation that they’re going to
build a new rocket for us. They’re going to use Russian
engines and a Russian design tank. They’re in the process
of qualifying that. There’s Elon Musk and SpaceX
who’s had one successful Falcon 1 launch and three failures. He likes to talk
about his one success and not his three failures. I look at him as a package. It’s good that he’s learning. He also has a lot of
trouble launching– he’s supposed to launch
here in five days I think, on April 20th with
his first payload. That’ll be pretty exciting
to see how that goes. So we’re following all that. The ATV was a
miraculous docking. I mean, all that
software was done in the first time we came up and
dock this vehicle to station, this huge vehicle to the back. We did extensive ground testing. It took us 14 days
from launch to dock. And the reason it took 14
days is orbital mechanics. We could be there in 2,
but we spent the other 12 days checking systems out. We would fly within 100 meters. We would back out. We would fly within 20 meters. We’d back out. We’d check attitude
control system. We check crew displays to
make sure all that work. So then by the time we
finally came in for the dock, it was a fully
checked-out vehicle. So we did essentially
a protoflight flight on that flight. So we had cargo that
we needed, but it wasn’t absolutely critical. And then we did
essentially, the test program all the way to dock. We’re going to do the
same thing this September with a Japanese vehicle. It’s the HTV. It’s going to fly up
underneath space station and stop and then get picked up
by the SSRMS, the Space Station Robotic system. And then berthed at the
bottom of the station. So that brings a whole new
series of challenge with us. We’ve been working that
program for 15 years. So when that thing
actually flies, it will have 15 years of hard
engineering sitting behind it before it goes and flies. And we’ll do the same
kind of, probably– I think it’s a 16-day profile
to come up and do the HTV demo and test. So again, yeah, it’s a
tremendous challenge. It’s a lot of
different vehicles. So now we have to learn a
lot of different systems. But again, that’s
what’s kind of neat as an engineer is you get to
see how the Japanese solve a problem, how the Russians
solve a problem, how the Europeans solve a problem,
how the Russians solve a problem. It’s the same physical
engineering problem. And each one of them takes a
slightly different engineering approach to it. And when I get to see,
because I get to see them all. And then I get to
kind of internalize which one might be a little
bit better in this application and which one might not be. So it’s a great program. Yep. AUDIENCE: You mentioned an
estimated failure probability of 1 in 450. That seems really
high for this problem. Is that for the
launch system overall, or is that if you haven’t
worked the problem for this particular problem,
if you hadn’t noticed it, for example? So that’s what you were
dealing with before. Do you have an overall
acceptable failure probability level? GERSTENMAIER: For
each shuttle launch, our failure probability
is about 1 in 77. And the primary driver for that
is micrometeoroid debris damage on orbit. So again, our heat
shield is fully exposed. So there’s some things that
can occur to our heat shield that we inspect two
days before we land, but we don’t inspect
any time after that. So in those final two
days, we could pick up some damage that’s
undetectable or we didn’t know about that could
be a heat shield problem. And that’s the predominant
risk during entry, and that’s what
drives the 1 in 77. This problem would have been– who knows what it would have
been before, but this 1 in 450 was this specific problem
with all the techniques that I described. So I did essentially
a distribution about all the particles
that I fired down the tubes. I did a distribution
about how likely this thing is to break between
10 degrees and 180 degrees. All those were in there, and
that’s just a mathematical sum. AUDIENCE: And it’s
always catastrophic? GERSTENMAIER: Well, we
assumed it was catastrophic. We later did analysis and we
determined we could actually tolerate that leak. The leak I showed you in the
corner, that little hole. We could actually tolerate
that hydrogen leak in the aft compartment. So it wouldn’t affect
the tank pressurization. We would have
leaked a little bit. And only if that hydrogen
were to combine with oxygen and drifted over to one of my
APUs that sits at 1,000 degrees Fahrenheit could be a
potential detonation. I think that’s very unlikely. But to just be worst case, we
assumed that that was possible and was a catastrophic failure. So I would be very careful
with our PRA stuff. It’s just a math model. The absolute values
do not mean anything. The PRA is very good if you’re
trying to compare systems. So if I’m going to make
a systems design change and I’m using the
same math model, then I can look and see which
system design gives me more reliability than another one. But to try to use this PRA
and compare it to, say, Soyuz, or compare it to HTV, or to
compare it to Saturn or other vehicles, you cannot do that. The models behind them are
so different that it’s not tractable. So I look at it as a
tool, but do not ever use this tool for any
critical decisions other than maybe looking
at two specific designs in the same system. And I have a lot of trouble
with my friends in Washington who don’t really understand
statistics explaining that. The other thing that’s
very important is– we always talk about the mean. We should really talk about
the 95 percentile and the 5 percentile. And you’ll see me, you’ll
see in all my plots– and the shuttle team has never
done this until the past three years, but I’m making
them show the 5s and 95s. And now we’re doing
statistical significance. Even though the
mean is different, is it really statistically
different between the two? The other thing
we’re playing with is now can I contract
the variance? In other words, can I
understand the problem now so the variance is smaller,
than I understand the problem better? That’s just as good sometimes
as it is changing the mean. And man, does that not
sell well in Washington. When I try to explain
to lawyers, here’s mean. Here’s one sigma. Here’s 1-sigma. Here’s why I’m trying
to control the mean and here’s why I’m trying to
control the 1-sigma variation. They look like I’m
from some other planet. [LAUGHTER] But that’s part of my job is
to convey in English terms what we’re trying to do. And you guys need to think about
that as you talk to folks, too. Yep. AUDIENCE: What do you think,
looking at your crystal ball, the station’s going
to look like in 2016? What will the US role be? And what’s the
outlook for getting some pressurized down mass? GERSTENMAIER: Well, if
the commercial cargo guys come through,
there’s going to be some pressurized down mass. We’ll get about a
metric ton, maybe 2 metric tons per year out
of the commercial guys. So we’ll get some down. I’m really dependent upon the
commercial guys coming through. So this is an awkward situation. Before we’ve had always
had a NASA backup and we didn’t count on
the commercial sector to develop a rocket or
bring capability up. And then what happens is
they run into problems, we default to the
NASA solution, and we kill a commercial industry. Well this time, they didn’t
give me enough money to do that. So this time, I am 100%
dependent upon those folks. And I am more than
proud to tell them every time I am
dependent upon them. So if they come through, we will
have a good research program. if they do not come
through, it will be a mess because
we’ll be very limited in up mass and down mass. I need about 40 metric
tons of cargo per year from the commercial sector. So ATV and HTV and Progress
can keep my crew on orbit, but I can’t do any
research and I can do very limited maintenance. To do anything
worthwhile with station, I need this commercial
cargo stuff. It’s supposed to come first
flight in 2010 and in 2011, so it’ll be very
important to see that. If they don’t come on precisely
those dates, that’s okay. I’m a program manager. I got some margin in the dates. They’re not required on
absolutely that date. But within a couple of
years, they need to be there. So the answer to your question
is that the commercial sector comes about, we’re there. Yep. AUDIENCE: With all the
work you’ve been doing, how close are you
to recertification of the shuttle recommended
by the Columbia Accident Investigation Board? And what do you still
have to do if you’re told to keep flying beyond 2010? GERSTENMAIER: Well,
what’s interesting is I argue that I have effectively
recertified to the intent. If you look at my
external tanks, they look exactly
the same as the tank I flew and returned to flight. It’s not the same tank. I changed out all
the lithium aluminum up in the dome section back
to just plain old aluminum because it’s easier
to manufacture. So when I did that, I had to
do an entire recertification of the external tank. All the finite element analysis,
all the structural analysis, all the breakup
analysis, and all that. So nobody counts that. But I would say in a sense I’ve
recertified the external tank. When I had some main
engine problems, I essentially went back
and clean-sheeted all the main engine stuff again. So I have done bits and
pieces of all the stuff that I think is needed to
keep this vehicle flying for the remaining flights. So I think I’ve satisfied
the intent of what the CAIB was asking me for in
that recertification activity. Now I do have some inspection
requirements on the orbiters that they can fly I think
five years or so many flights. And then we take them down,
we do a major corrosion inspection. Some of these orbiters will
be due for major corrosion inspection if I try
to fly beyond 2010. We’ll have to take those
orbiters out of the fleet, do that corrosion
inspection, and do that work. And that’ll be costly
and it’s not effective. I also plan on retiring
these vehicles sequentially. So when I retire
whatever vehicle first, the first thing
I’m going to go do is my hydraulic actuators–
they’ve been in the vehicle since 1980 and they’ve
never been removed. We’re going to go pull
those hydraulic actuators out we’re going to dissect
them and we’re going to go look in there and see. Because nobody has ever had a
hydraulic actuator installed in an application for how
many ever years it is. 20-some years, 28 years. So we’re going to go in and
we’re going to actually go look at that stuff. So I’m going to dismantle
one of my orbiters in the Stay Hungry
mode and I call it of looking for problems
that haven’t shown up yet to see if there’s anything else
out there that we’ve missed. So I’m going to
destructively start evaluating and testing
some of my vehicles as I take them offline. But I don’t think I need to do
a full-up certification if I do that kind of investigation. Yep. AUDIENCE: From the
recertification that you did do on the external tanks
and the main engines, did you run into any
major design problems that you thought
needed to be reworked or something like that? And from the testing that
you did do, from the analysis that you did do, how
confident would you be in extending the
shuttle for several years after when it’s currently
scheduled to come offline? GERSTENMAIER: Again,
the things we kind of discovered was we have a lot
of new tools we didn’t have when we did the original work. So we did the full finite
element models of the tank and we never had those before. I also have a
better understanding of the environment I’m
flying in than I did before. So with a combination of better
finite element and better environment, I think I
got a much better design. And I did find some
areas of the tank where some of the
pressure lines attach to the outside of the
tank that were less than the factor of safety
we wanted for materials. So we had to beef some areas
up when we did that work. So there were some
minor changes. But nothing major stuck
out as it is a big kind of hiccup or a big problem. But the neat thing was to
go back with the new tools and to go look at them, and
then pull out the old analysis and then realize how much we
had missed with the old analysis that we didn’t even know about
that was covered in a blanket factor of safety or was covered
in a blanket assumption. A handwritten note
that this is okay, and it’s got the handwritten
calculation underneath it. I now got a full 1,000-element,
finite element analysis of that individual part, and it
looks a lot different. So it was a very
instructive situation. In terms of continuing to
fly, I think it’s okay to fly, but it goes back to
the point back here. We’re getting to a point
where the need of the shuttle is not there. The uniqueness to
carry these things up and to get the big
down mass isn’t there. And if I can get to the next
generation of vehicle that has less of an integrated
and complex problem, that’s a much
better way of going. So I don’t think from a
safety standpoint I’m worried. But from a practical
standpoint, we need to retire the
shuttle when it’s done these complex
missions and then get that next generation of
vehicle that’s going to have– it will have problems . I guarantee it
will have problems. It will have problems,
especially at startup. You know, the typical
bathtub curve lives. You find a lot of problems
in a very new system. You find a lot of problems
in a very old system. In the middle, you’re
in the sweet spot. So when the new
systems start flying, they’ll find lots of
problems but that’s okay. You’re still working those
out, working the bugs out. But that system, because
the heat shield’s predicted, it has an abort
system on top– it will be inherently more safe
than what the shuttle is just by its basic design. Yep. AUDIENCE: Sir, I think when
Columbia broke up over Texas, one of the astronauts
lost was Israeli. Are we holding a
slot open for them? And if we were doing that, would
we put an Iranian in with him so that something would kick
off for President Obama’s talks with Iran? GERSTENMAIER: I don’t know. That’s probably for some
alter ego other than me. So some policy person could
talk to you about that. The Russians are very good at
flying anybody and everybody. So if you’ve got– [LAUGHTER] If you’ve got a $35–
that’s where I’m going. If you have a $35 million
dollar spare change to fly, that’s the new price and you
can be a tourist on board space station. So what I should have
done in my career– I shouldn’t have went
to work for NASA. I should have went to some
entrepreneurial company, made $35 million, and then
could be an astronaut. So I ruined my career by
going to work for NASA. No, I’m not supposed
to say that. So you’re supposed
to continue to ruin your careers by working
for NASA and working for local government stuff. And don’t make that money,
because then all you can do is go fly in space as a tourist. Anything else? Yeah. Maybe one more after this. AUDIENCE: Did you have
any input into picking the flagship mission? I think it’s Saturn or it’s
Jupiter instead of Saturn again. GERSTENMAIER: No, the
science mission director, they have a whole
bunch of committees that go look at what
scientific investigations need to be done out there. And I just focus really
on the human spaceflight side of things. Except for I provide
the launch vehicles for the scientific missions. But that’s all. So anyway, hopefully you
learned something today. Yeah. AUDIENCE: Do you
think you could just, because there’s a lot of
aerospace engineers in training here, talk a little bit about
the current economic situation at NASA? Hiring possibilities
and things like that. GERSTENMAIER: Okay. We internal to NASA, we
looked at it our age profile. And we’re aging. And so’s the aerospace
industry in general. So we think we need to bring
in some more new hires. So we’re going to try to make
a concentrated effort to bring in some fresh outs in our
next series of hiring. So we think some hiring
windows are opening up. So from our standpoint, we
want to bring some new ideas, some new, fresh blood in. It wasn’t happening because
if you’ve got a crunch project like the new Orion and
Ares stuff, what’s typically happened is the
program manager will go pick somebody
from industry who’s familiar with it that’s fairly
seasoned and bring them in. So we’re not going to force some
mixture of some new fresh outs to come in, because we think
we need to reinvigorate new ways of doing
business and new tools and new processes in our system. So you’re going to see
kind of a push for us to start looking at that. So I think this is a very
good time in spaceflight, in a sense. It’s sad in a way that
the shuttle’s retiring. But I think the
shuttle is retiring just because we can’t afford to
do shuttle and any other thing. And really, we need to do
probably some kind of upgrades to the shuttle to some extent. Maybe some kind of real
escape system or something if we continue to fly. So the shuttle’s
got to wind down. But the station is there. The station is a truly
unique research facility. We’re about done assembling. So then how can we use it? And we talk about using it
for medical and biological and all those things. But we also ought to think about
it as an engineering test bed. You know, I’ve got pumps up
there that have been running for multiple . years. I’ve got ammonia systems that
have been operating well. I’ve got heat exchanges
that are doing good. I’ve got QDs that I would
never fly in any vehicle again if I ever had a chance. So we’re never
going to fly those. But we’ve learned
all this stuff. And the idea is, now,
how can I pass that on to the next generation? Or can we do some actual
testing of these systems to see, do they make sense? Because we’re going to have
the same kind of systems on the moon. We’re going to have some kind
of cooling system, some kind of power generation system. So can we test some of
those systems and components on Space Station? Can we test software
on Space Station? Can we use TimeLiner to go
control simple functions that are controlled in
code or they’re done by crews on the ground? I want to do a day without
commands to Space Station. Typically today, we
send 1,000 commands to Space Station a day. So I’ve challenged the team,
when you’re going to Mars and you’re there,
you’re not going to be able to send commands up. I want to give you a challenge. We’re going to send no
commands for one day. After they achieve that–
they don’t know this– then they’re going to get decreed
a no commands for a week. And then after
they achieve that, they’re going to get no
commands for a month. So you can’t tell them that,
but they’ll see it on the web if they watch. Hopefully they’re busy
doing software design and not watching it. But the idea is to
push, and how can we demonstrate stuff that
might be appropriate? I told the crews
that I was going to take away all their
windows so they couldn’t look at the Earth so they could
simulate the journey to Mars for six months. And then we would return them. The crews told me that there was
no way they would ever do that. If they were going to
Mars, they would do without the view of the Earth. But if they’re this
close to the Earth and they’re spending
six months in space, they’re looking out the window. And they were not going
to participate in that. But you could help me think
of what kind of things can we do with Space Station
that demonstrates its use and expiration? Because it’s a tremendous
research facility. So again, back to
what the future is, shuttle’s ramping down. Station is a great
research facility. How do we use it? I’m invigorating a new
commercial spaceflight industry, which is exciting. They’re doing things a
different way than NASA does. They’re not doing
the traditional way. They’re doing more
entrepreneurial engineering, which is a great way
of doing business. I’ve got the new
vehicles being designed. We haven’t designed new
vehicles for a long time. The intent is to use the Ares
vehicles not only for the moon but also for Mars. So they have that future
design capability in there. So this is a great time to
come out and get involved in this industry and do things. So I think, again, the
hiring in aerospace is always up and down. It’s a pretty dynamic field. I went into aerospace
because I thought I would get out of
school and I wouldn’t be able to go to work
anywhere, and then I would use that as an excuse
to tour the world for a year. It didn’t work out well. I got out of school and
it was on the peak hiring. And so then I went
right to work, and that was the
beginning of the end. So I’ve not yet
toured the world. But again, you just have to
put up with that in aerospace. But I think it’s a
great profession. I don’t think there’s
any better team than I have in Shuttle Station,
Expendable Launch Vehicles, and Space Communications. I mean, they
understand the mission. They understand
what has to be done. They’re tremendously
disciplined. They’re inventive,
as I saw here. You know, I didn’t tell them
to go buy a bolt tester. They went out on their own. They had no idea it
was going to work. But they thought,
heck, it’s worth a try. They don’t even know if it
would even be worthwhile. They didn’t even think
we needed to do it, but they did it anyway. So what a great
work environment, to have folks that are that
dedicated, that creative, that know they have to
work together as a team. It’s almost like
being in college again being on a project team
working for that final project to get it done, except
it’s a little more intense and it lasts longer
than a semester. All right. Well, thanks. [APPLAUSE]

You May Also Like

About the Author: Oren Garnes

Leave a Reply

Your email address will not be published. Required fields are marked *