WEBVTT 00:00:09.349 --> 00:00:16.349 We're quite lucky today to have Bob Sieck talk to us about launch operations. 00:00:17.390 --> 00:00:24.329 Bob joined NASA early in his career after a spell with the Air Force. 00:00:24.329 --> 00:00:26.619 This was in the early '60s. 00:00:26.619 --> 00:00:31.550 And he worked on prelaunch checkout and servicing of Gemini and Apollo. 00:00:31.550 --> 00:00:33.160 Then went into the Shuttle Program. 00:00:33.160 --> 00:00:37.260 He worked on ground operations for the Approach and Landing Tests. 00:00:37.260 --> 00:00:44.230 We will hear more about that testing when Gordon Fullerton comes here at the beginning 00:00:44.230 --> 00:00:46.899 of December. 00:00:46.899 --> 00:00:53.899 And then he worked as Launch Director for a lot of the early Shuttle missions, including 00:00:54.479 --> 00:00:56.889 my first flight. 00:00:56.889 --> 00:01:02.870 And then went to be the Shuttle Operations Director at Kennedy Space Center. 00:01:02.870 --> 00:01:08.890 But then after the Challenger accident he came back and worked on another, I don't know, 00:01:08.890 --> 00:01:11.159 40 or so launches. 00:01:11.159 --> 00:01:13.729 I think my last launch was in '96. 00:01:13.729 --> 00:01:15.399 You had already graduated, right? 00:01:15.399 --> 00:01:15.799 Yeah. 00:01:15.799 --> 00:01:22.799 But Bob was the Launch Director of the first four of my flights. 00:01:23.619 --> 00:01:30.619 He is the head of the whole team of really thousands of people who are responsible for 00:01:31.189 --> 00:01:37.109 getting the Shuttle ready to fly and for certifying that, in fact, it is ready to fly. 00:01:37.109 --> 00:01:44.109 It is a very complicated, critical and from the safety point of view absolutely one of 00:01:46.280 --> 00:01:52.908 the most important things we do, is to figure out when this incredibly complex vehicle is 00:01:52.908 --> 00:01:54.609 really ready to go. 00:01:54.609 --> 00:02:01.609 Bob is going to talk to us both about some of the technical aspects of the launch operations. 00:02:04.140 --> 00:02:09.350 But also I hope, from a systems engineering point of view, we will have a chance towards 00:02:09.350 --> 00:02:15.330 the end to talk about some of the planning that was going on while the Shuttle was being 00:02:15.330 --> 00:02:20.400 designed and some of the compromises which had to be made, some of which we've already 00:02:20.400 --> 00:02:26.630 addressed, between the efficiency of turning around and maintaining a vehicle like the 00:02:26.630 --> 00:02:33.630 Shuttle vis-à-vis the actually initial upfront cost of it. 00:02:34.520 --> 00:02:38.610 With that as an introduction, Bob, I will turn it over to you. 00:02:38.610 --> 00:02:41.030 Thanks, Jeff. 00:02:41.030 --> 00:02:41.920 And good morning. 00:02:41.920 --> 00:02:47.640 As Jeff indicated, I got into the business of launching people and payloads into space 00:02:47.640 --> 00:02:49.660 a long time ago. 00:02:49.660 --> 00:02:56.660 I was privileged to be part of all of the human space flight programs, so I did a lot 00:02:56.690 --> 00:02:57.230 of that. 00:02:57.230 --> 00:03:01.260 What I didn't do, I saw most of. 00:03:01.260 --> 00:03:05.010 And I have an opinion on all of it, so please ask questions. 00:03:05.010 --> 00:03:12.010 If I don't have the answer, I am sure to have an opinion. 00:03:12.350 --> 00:03:19.350 I am going to spend a little bit of time, we talk about launch operations, but that's 00:03:19.900 --> 00:03:26.700 the final three to four days of a campaign that begins three to four months before you 00:03:26.700 --> 00:03:33.300 actually start the countdown clocks and put the astronauts in the vehicle and go fly. 00:03:33.300 --> 00:03:38.579 So I am going to spend some time on the background of preparing the Shuttle, the ground systems, 00:03:38.579 --> 00:03:45.579 the flight systems prior to the launch count process particularly to talk about the engineering 00:03:46.560 --> 00:03:50.420 involvement and the responsibilities in those processes. 00:03:50.420 --> 00:03:55.440 But, in order to talk about launching, I have to talk some about the operations of putting 00:03:55.440 --> 00:04:01.200 the final pieces together and doing the tests and inspections prior to launch. 00:04:01.200 --> 00:04:07.170 And then I want to get into the real meat of it which is the human factors, the role 00:04:07.170 --> 00:04:14.170 of the engineer, the role of the managers in the process of testing, inspecting, checking 00:04:15.890 --> 00:04:21.899 the flight systems, the ground systems and certifying that it is OK to put the crew in 00:04:21.899 --> 00:04:23.150 and go fly. 00:04:23.150 --> 00:04:27.390 And that's where we're going to spend most of our time, but I've got to go through some 00:04:27.390 --> 00:04:32.190 background first. 00:04:32.190 --> 00:04:37.230 I don't know how many of you have been to the Kennedy Space Center. 00:04:37.230 --> 00:04:38.700 Anybody been down there? 00:04:38.700 --> 00:04:40.610 OK, so you've seen it. 00:04:40.610 --> 00:04:47.610 It is a city where we've launched everything since the beginning programs, Mercury, Gemini, 00:04:50.480 --> 00:04:51.280 Apollo. 00:04:51.280 --> 00:04:56.800 The most prominent fixture is this Vehicle Assembly Building which was used for the Apollo 00:04:56.800 --> 00:05:01.960 Program to put together the 300 foot tall Saturn-Apollo rocket. 00:05:01.960 --> 00:05:06.570 Shuttle is about half that size but we use this building to do the assembly. 00:05:06.570 --> 00:05:08.330 And I will talk a little bit about that later. 00:05:08.330 --> 00:05:09.060 But it is a city. 00:05:09.060 --> 00:05:11.240 We have our own power systems. 00:05:11.240 --> 00:05:16.240 We have facilities to check out the orbiter to process the solid rocket motors. 00:05:16.240 --> 00:05:18.540 We have administrative homes for the people. 00:05:18.540 --> 00:05:25.540 And, of course, we have the highly visible launch pads that are out on the ocean. 00:05:27.010 --> 00:05:28.350 And we also have a runway. 00:05:28.350 --> 00:05:33.909 When the weather cooperates and we can bring the shuttles back to Florida, we can take 00:05:33.909 --> 00:05:37.770 care of the landing and recovery there. 00:05:37.770 --> 00:05:38.810 The process. 00:05:38.810 --> 00:05:40.900 We'll talk a little bit about the process. 00:05:40.900 --> 00:05:47.900 When an orbiter returns from its previous mission, it goes through essentially a disassembly, 00:05:52.090 --> 00:05:58.110 inspection and then build it back up and test it to make sure that it is still within the 00:05:58.110 --> 00:06:05.110 certification base that the engineers set up for it that you've already heard from previous 00:06:05.240 --> 00:06:08.450 to this lecture. 00:06:08.450 --> 00:06:14.889 You would like to think that if the Orbiter flies and the rest of the element is a successful 00:06:14.889 --> 00:06:21.889 mission you can just do it like an airplane, take down the down cargo, whatever, get it 00:06:21.950 --> 00:06:27.760 configured for the next payload that is going to go up, clean the windshield, so to speak, 00:06:27.760 --> 00:06:30.900 and the crew cabin and go fly it again. 00:06:30.900 --> 00:06:33.060 But the rules don't allow you to do that. 00:06:33.060 --> 00:06:39.900 The rules that the other engineers who have talked to you have set up are such that you 00:06:39.900 --> 00:06:44.860 have to assume that in some way, even though during the mission everything seemed to work 00:06:44.860 --> 00:06:51.860 OK, that that hardware was compromised through the process of reentering, landing, refurbishing 00:06:52.870 --> 00:06:55.760 those systems that have to be refurbished. 00:06:55.760 --> 00:06:57.770 Something may have been invalidated. 00:06:57.770 --> 00:07:03.850 So you have to test all that stuff that worked just fine in the previous mission, plus all 00:07:03.850 --> 00:07:10.169 of the systems that were not used in the previous mission, particularly the backup system, the 00:07:10.169 --> 00:07:16.800 things that you would have to rely on in the event that the primary system doesn't cooperate 00:07:16.800 --> 00:07:18.060 during the next mission. 00:07:18.060 --> 00:07:25.060 And, because of the way the Orbiter was built with its miles of wiring and thousands of 00:07:25.260 --> 00:07:32.050 components that are active components, you have to disassemble a lot of that stuff in 00:07:32.050 --> 00:07:36.169 order to meet the requirements that the program is levied on. 00:07:36.169 --> 00:07:42.270 After the Orbiter lands and you get it safe and the crew is out and you take out the payload, 00:07:42.270 --> 00:07:49.230 we spend a minimum of two to three months, roughly a quarter of a million labor hours 00:07:49.230 --> 00:07:56.230 of touch labor on the Orbiter to do this disassembly, test, inspection, refurbishment process before 00:07:57.800 --> 00:08:04.580 we move it from the hanger, take it to that Vehicle Assembly Building, integrate it with 00:08:04.580 --> 00:08:09.610 the tank and the solid rocket boosters and take it on out to the launch pad to go fly 00:08:09.610 --> 00:08:11.820 again. 00:08:11.820 --> 00:08:14.120 And that's where the lion's share of the work is. 00:08:14.120 --> 00:08:21.070 The work on the tank and the payloads and the solid rocket boosters is all peripheral 00:08:21.070 --> 00:08:23.990 to the processing of the Orbiter. 00:08:23.990 --> 00:08:25.990 Yes, sir. 00:08:25.990 --> 00:08:32.149 [AUDIENCE QUESTION] Do you find a lot of failures when you go through? 00:08:32.149 --> 00:08:33.838 We find very few. 00:08:33.838 --> 00:08:38.250 And you could do the tradeoff of, well, is this effort worth it? 00:08:38.250 --> 00:08:44.639 But, on the other hand, the few that you find, you're glad that you found them because if 00:08:44.639 --> 00:08:50.309 not you may not have discovered them until you got out to the launch pad and serviced 00:08:50.309 --> 00:08:51.670 your hazardous systems. 00:08:51.670 --> 00:08:54.550 Or, worse yet, you find out when you get in the mission. 00:08:54.550 --> 00:09:01.550 And then the impact of that could be not only a safety impact but could be a higher consequence 00:09:02.209 --> 00:09:07.839 than spending the month to two months in an orbiter processing facility doing that work. 00:09:07.839 --> 00:09:08.170 Yes? 00:09:08.170 --> 00:09:10.170 But is there a learning curve? 00:09:10.170 --> 00:09:15.509 I mean after each mission do you know which system you have to look at specifically? 00:09:15.509 --> 00:09:22.509 We look at it and say this system is performing just fine so we don't have to do this intense 00:09:24.389 --> 00:09:28.449 invasive inspection and test every flight. 00:09:28.449 --> 00:09:33.649 Maybe we can just do it once a calendar year or every two to three missions, whatever the 00:09:33.649 --> 00:09:40.649 designer thinks is the criteria for checking on the health of this system. 00:09:41.660 --> 00:09:43.089 And we've done that over the years. 00:09:43.089 --> 00:09:47.920 And after we've had a couple of years of missions where everything is working just fine, we 00:09:47.920 --> 00:09:50.709 start relaxing these requirements. 00:09:50.709 --> 00:09:57.709 And then something like Challenger happens or something like Columbia happens and the 00:09:58.110 --> 00:10:03.680 pendulum of conservatism swings the other direction. 00:10:03.680 --> 00:10:10.680 And we do more tests and more inspections to verify the hardware because people want 00:10:12.110 --> 00:10:17.040 to be able to say, and we want to be able to say, well, we've done everything possible 00:10:17.040 --> 00:10:22.860 to make sure that that's a 100% functional, operating, safe orbiter. 00:10:22.860 --> 00:10:29.860 And so getting this process down to where it meets the original advertising brochure 00:10:30.990 --> 00:10:37.610 which was we're going to fly these things every two to three weeks, you start in that 00:10:37.610 --> 00:10:38.110 direction. 00:10:38.110 --> 00:10:43.019 And then events occur either during the mission or you have the really bad incidents like 00:10:43.019 --> 00:10:44.259 Challenger and Columbia. 00:10:44.259 --> 00:10:47.869 And the conservatism swings the other way and you end up doing more work. 00:10:47.869 --> 00:10:54.869 And, in addition to that, engineers, because we are what we are, I was one, we have all 00:10:56.990 --> 00:10:59.850 this hardware available, we like to modify it. 00:10:59.850 --> 00:11:01.009 We change it. 00:11:01.009 --> 00:11:08.009 We upgrade it because there is new technology available in computers or in composite materials. 00:11:08.149 --> 00:11:13.100 So, when the orbiter gets to this processing facility, regardless of how well the mission 00:11:13.100 --> 00:11:19.059 flew, the designers, with their good intensions, say we want this orbiter to last another five 00:11:19.059 --> 00:11:25.189 years or ten years so we want you to do this upgrade to the avionics system or we want 00:11:25.189 --> 00:11:29.910 to change out all of the actuators that hold the payload in the payload bay and this and 00:11:29.910 --> 00:11:30.160 that. 00:11:29.990 --> 00:11:31.889 So you modify. 00:11:31.889 --> 00:11:33.079 And that adds more time. 00:11:33.079 --> 00:11:40.079 It makes more complexity to the process which invites more tests and inspections. 00:11:42.230 --> 00:11:49.230 You're constantly in a mode where unfortunately, if the mission flies perfectly, by the time 00:11:52.699 --> 00:11:59.699 you plan your campaign through the processing facility -- You plan your campaign with schedules to last 00:12:09.980 --> 00:12:16.980 two months maybe, roughly a third of the work you do is work that you hadn't planned when 00:12:18.550 --> 00:12:21.929 you initially brought that orbiter into the orbiter processing facility. 00:12:21.929 --> 00:12:22.999 It's nonstandard work. 00:12:22.999 --> 00:12:27.329 It is stuff that you uncover in the process of doing your test or inspection or its new 00:12:27.329 --> 00:12:32.550 requirements or new changes that come from the designers that have to be implemented. 00:12:32.550 --> 00:12:37.959 And, from an efficiency standpoint, if you're in the manufacturing or production business, 00:12:37.959 --> 00:12:39.970 that is not efficient. 00:12:39.970 --> 00:12:45.850 If a third of your work that you laid out for the next two months, at the end of that 00:12:45.850 --> 00:12:50.360 two month period, a third of it was stuff that you had not planned on doing which means 00:12:50.360 --> 00:12:55.800 you don't have the parts ready, you don't have the engineering, you don't have the instructions. 00:12:55.800 --> 00:12:56.559 Yes? 00:12:56.559 --> 00:13:01.889 Do you build in time to cover that now? 00:13:01.889 --> 00:13:03.850 Contingency time, yes. 00:13:03.850 --> 00:13:09.360 Let me go back to that. 00:13:09.360 --> 00:13:16.360 We set up our team and operations to run five days a week, two shifts a day leaving the 00:13:16.839 --> 00:13:21.050 weekends free to catch up for this nonstandard stuff. 00:13:21.050 --> 00:13:27.980 We essentially end up running a six day work week if we're in a standard template of flying 00:13:27.980 --> 00:13:32.509 three missions a year, which we're not now because we're still recovering from the Columbia 00:13:32.509 --> 00:13:33.290 accident. 00:13:33.290 --> 00:13:40.290 We end up working six days a week and roughly every three or four days we will work a continuous 00:13:41.860 --> 00:13:46.019 around the clock 24 hour operation. 00:13:46.019 --> 00:13:53.019 We try to maintain that original schedule but we only make it roughly 50% of the time 00:13:56.589 --> 00:14:02.100 due to this, again, nonstandard work, the extra stuff that works its way in. 00:14:02.100 --> 00:14:05.779 And that's why we have a big team. 00:14:05.779 --> 00:14:09.670 Our team is made up of the United Space Alliance as a contractor. 00:14:09.670 --> 00:14:10.980 They do the hands-on work. 00:14:10.980 --> 00:14:12.179 They have the technicians. 00:14:12.179 --> 00:14:15.699 They have the engineers that staff the consoles. 00:14:15.699 --> 00:14:21.829 And they are roughly a 6,000 population at Kennedy Space Center. 00:14:21.829 --> 00:14:24.589 They take care of the orbiter, the tank, the boosters. 00:14:24.589 --> 00:14:30.299 They are responsible for maintaining all of our equipment that hooks into the shuttle 00:14:30.299 --> 00:14:33.749 that is required, the process of servicing it. 00:14:33.749 --> 00:14:40.529 And they have ties to the contractors, the original equipment manufacturers that built 00:14:40.529 --> 00:14:41.879 the hardware. 00:14:41.879 --> 00:14:47.239 Technically, they can gain access to all the original manufacturing records for the parts 00:14:47.239 --> 00:14:49.790 that are in the shuttle. 00:14:49.790 --> 00:14:56.790 NASA's responsibility -- NASA owns the requirements for the Shuttle. 00:15:03.439 --> 00:15:09.559 We delegated all the operational work to the contractors, but it's a national resource. 00:15:09.559 --> 00:15:11.079 Taxpayers paid for it. 00:15:11.079 --> 00:15:13.360 The government has a responsibility. 00:15:13.360 --> 00:15:17.639 They cannot divest themselves from that. 00:15:17.639 --> 00:15:24.639 NASA owns the requirements for saying what you test, what you inspect and what the specifications 00:15:25.149 --> 00:15:27.389 are for acceptable performance of that. 00:15:27.389 --> 00:15:31.259 That is controlled by NASA. 00:15:31.259 --> 00:15:36.579 The management of the contractor at Kennedy is done by NASA engineers in an organization 00:15:36.579 --> 00:15:41.850 that has roughly 500 people out of the 2000 population at Kennedy Space Center of civil 00:15:41.850 --> 00:15:42.679 service people. 00:15:42.679 --> 00:15:46.569 500 are directly associated with the Shuttle. 00:15:46.569 --> 00:15:48.269 The rest do payload work. 00:15:48.269 --> 00:15:54.230 The Space Station, of course, is a big work item now at the Kennedy Space Center. 00:15:54.230 --> 00:15:55.779 And they are responsible for the requirements. 00:15:55.779 --> 00:16:01.769 If somebody wants to change the requirement, a NASA person has to approve that change. 00:16:01.769 --> 00:16:04.559 And we do insight and everything the contractor does. 00:16:04.559 --> 00:16:11.559 We have at each one of the milestones, when we leave the processing facility, when we 00:16:15.829 --> 00:16:19.730 leave the Vehicle Assembly Building and when we get ready to launch, there is a review 00:16:19.730 --> 00:16:26.189 conducted by NASA to review the work that was done by the contractor during the preceding 00:16:26.189 --> 00:16:28.279 weeks or months. 00:16:28.279 --> 00:16:35.279 And NASA approves moving the vehicle onto the next stage of its assembly prior to launch. 00:16:35.429 --> 00:16:42.429 And the launch director specifically is responsible not only for those last few days of the campaign, 00:16:44.509 --> 00:16:51.339 so to speak, leading up to launch, but also insuring the government contractor team has 00:16:51.339 --> 00:16:54.970 all the tools available to them to be successful. 00:16:54.970 --> 00:16:59.359 Is the work being scheduled in an orderly fashion? 00:16:59.359 --> 00:17:06.130 Is the ever-tightening budget constraining their ability to get their work done? 00:17:06.130 --> 00:17:09.339 Is there too much scheduled pressure to meet a milestone? 00:17:09.339 --> 00:17:11.380 That is the launch director's job. 00:17:11.380 --> 00:17:16.929 The launch director doesn't just come in the last three days of the campaign with a tie 00:17:16.929 --> 00:17:20.109 and a suit and orchestrate the countdown. 00:17:20.109 --> 00:17:26.459 They have a responsibility from the beginning to the end of the campaign. 00:17:26.459 --> 00:17:29.220 Engineering. 00:17:29.220 --> 00:17:35.590 I have already addressed this, but the NASA engineers manage the requirements, the changes 00:17:35.590 --> 00:17:36.720 to the requirements. 00:17:36.720 --> 00:17:42.779 They are the ones in addition to the contractor, this is a check and balance, that look at 00:17:42.779 --> 00:17:47.820 all the data, the engineering results of the tests and the inspections. 00:17:47.820 --> 00:17:50.630 And they approve that they met the requirements. 00:17:50.630 --> 00:17:54.130 Also, they participate in critical operations. 00:17:54.130 --> 00:17:59.980 A critical operation is a test on a specific system. 00:17:59.980 --> 00:18:04.639 Servicing of the vehicle for launch count or any of the non-standard work that comes 00:18:04.639 --> 00:18:07.500 up during the process. 00:18:07.500 --> 00:18:09.380 They audit what the contractor does. 00:18:09.380 --> 00:18:14.779 And, of course, because we're the customer and they are the contractor, we have a lot 00:18:14.779 --> 00:18:20.309 of criteria to grade them on for their award fee performance. 00:18:20.309 --> 00:18:24.419 The operations people manage the scheduling. 00:18:24.419 --> 00:18:29.000 As I indicated, we like to work five days a week, two shifts a day. 00:18:29.000 --> 00:18:33.659 We really end up working six days a week and sometimes around the clock. 00:18:33.659 --> 00:18:37.299 The scheduling activity is dynamic. 00:18:37.299 --> 00:18:39.139 And NASA approves all the scheduling. 00:18:39.139 --> 00:18:41.850 We have to approve all the overtime. 00:18:41.850 --> 00:18:48.850 We have the authority to say stop or go not only in launch count but anywhere in the campaign 00:18:49.139 --> 00:18:54.799 of processing the hardware, as well as the big picture schedule, you know, how many times 00:18:54.799 --> 00:18:59.179 a year you're going to fly and which orbiter is assigned to which payload in those missions. 00:18:59.179 --> 00:19:04.880 That is still a NASA responsibility. 00:19:04.880 --> 00:19:10.600 Orbiter processing facility, like I mentioned before, it is like a hanger for an airplane. 00:19:10.600 --> 00:19:17.600 A big part of the work effort used to be the tile. 00:19:17.659 --> 00:19:21.639 I think you already had a presentation on tile. 00:19:21.639 --> 00:19:27.850 There are 25,000 to 30,000 of these little bricks glued to the vehicle. 00:19:27.850 --> 00:19:34.850 We classically damage about a hundred of them on each mission due to ice and things coming 00:19:35.110 --> 00:19:40.600 off the tank that have to be replaced, but we also pull another hundred or so off just 00:19:40.600 --> 00:19:45.950 to inspect the integrity of the glue that is holding the tile to the structure of the 00:19:45.950 --> 00:19:46.200 vehicle. Because a lot of those little bricks have been glued on there for 25 years and have 00:19:53.200 --> 00:19:57.179 flown 25 to 30 missions. 00:19:57.179 --> 00:20:04.179 Although we have offline test programs that try to duplicate the environment that the 00:20:04.409 --> 00:20:10.440 tile sees either from a calendar standpoint or the thermal cycles of the mission, you 00:20:10.440 --> 00:20:14.830 would like to go to the real hardware and see what is happening. 00:20:14.830 --> 00:20:20.019 We do that invasive type of work of actually destroying tile, pulling it off the vehicle 00:20:20.019 --> 00:20:27.019 just to make sure that the aging process is not causing any degradation of the system. 00:20:27.429 --> 00:20:34.429 We pull the engines out and do the maintenance on the engines offline because the aft fuselage 00:20:34.659 --> 00:20:38.899 of the orbiter is a terrible place to work. 00:20:38.899 --> 00:20:43.210 Any of the hardware we can get out of there and do it on the bench, it is much better 00:20:43.210 --> 00:20:48.419 to do that than to try to do it in the vehicle with people crawling all over wire bundles 00:20:48.419 --> 00:20:49.850 and structure and that sort of thing. 00:20:49.850 --> 00:20:56.090 They are concerned about the collateral damage to do the other work in that compartment of 00:20:56.090 --> 00:20:58.299 the vehicle where the engines are. 00:20:58.299 --> 00:21:03.340 Of course, you've got to take the accommodations from the previous mission out of the payload 00:21:03.340 --> 00:21:07.009 bay and put in the new stuff for the next mission. 00:21:07.009 --> 00:21:10.029 I already mentioned modifications. 00:21:10.029 --> 00:21:16.600 Unfortunately, we change more stuff than we probably should but in order to keep up with 00:21:16.600 --> 00:21:23.600 the aging of the vehicle and the new technology that goes with the territory of flying a system 00:21:24.380 --> 00:21:29.080 that was designed over 30 years ago. 00:21:29.080 --> 00:21:34.289 And we prepared for the next milestone which was the vehicle assembly building operations. 00:21:34.289 --> 00:21:39.820 This is where we put the big pieces together. 00:21:39.820 --> 00:21:42.070 The solid rocket boosters are stacked. 00:21:42.070 --> 00:21:44.440 There are four segments in each booster. 00:21:44.440 --> 00:21:51.440 That is a very critical process but only takes less than a month to do. 00:21:52.200 --> 00:21:58.490 The external tank comes in essentially ready to fly from Mississippi. 00:21:58.490 --> 00:22:05.490 Except, as you know now, because of the Columbia accident, we are still looking at the ramifications 00:22:05.580 --> 00:22:12.580 of these lines and other fittings on the tank. 00:22:13.000 --> 00:22:16.940 The acreage foam on the tank, just to digress a little bit, is sprayed on. 00:22:16.940 --> 00:22:18.299 And that stuff is tough. 00:22:18.299 --> 00:22:25.139 Early in the program we had problems with some of that coming off, but we solved that 00:22:25.139 --> 00:22:26.000 years ago. 00:22:26.000 --> 00:22:32.690 What we haven't solved is where you have to do a manual application of foam over a fitting 00:22:32.690 --> 00:22:37.110 that is there because that is where the crane is attached to it or because there is a line 00:22:37.110 --> 00:22:39.730 there that has to be installed at the Kennedy Space Center. 00:22:39.730 --> 00:22:42.049 You cannot do it back at the factory. 00:22:42.049 --> 00:22:47.980 Putting that thermal protection system foam on there is a labor-intensive process. 00:22:47.980 --> 00:22:50.710 It is a critical technique process. 00:22:50.710 --> 00:22:56.669 And, obviously, there are still flaws in the process that the engineers haven't sorted 00:22:56.669 --> 00:22:57.200 out yet. 00:22:57.200 --> 00:23:02.269 And that is why that stuff keeps coming off the tank in those places. 00:23:02.269 --> 00:23:09.269 But the solid rocket motors are attached to this mobile launch platform with four bolts 00:23:09.350 --> 00:23:12.500 the diameter of my wrist. 00:23:12.500 --> 00:23:14.889 The structure engineers really figured this out good. 00:23:14.889 --> 00:23:19.980 There are four on each one of those that are attached to the launch platform. 00:23:19.980 --> 00:23:25.960 The tank is attached to the boosters with four attach points, and those are bolts, again, 00:23:25.960 --> 00:23:28.600 that are the diameter of my wrist. 00:23:28.600 --> 00:23:35.259 And then the orbiter is hung on the tank in three places with the same sized bolts. 00:23:35.259 --> 00:23:42.230 You've got six million pounds of weight that is attached to the mobile launch platform 00:23:42.230 --> 00:23:48.190 that is held up by these four bolts, well, eight total on the solid rocket motors. 00:23:48.190 --> 00:23:53.580 And they work out the dynamics of when the engines start because the vehicles sways like 00:23:53.580 --> 00:23:58.700 this because the center of gravity is not right over where those eight bolts are attached. 00:23:58.700 --> 00:23:59.879 And that system works fine. 00:23:59.879 --> 00:24:05.470 It always amazed me that you could hang that much weight on those few bolts that are only 00:24:05.470 --> 00:24:09.580 the diameter of this, but it works. 00:24:09.580 --> 00:24:16.580 The orbiter is brought over after its campaign, it's hung on the tank and we test all those 00:24:19.600 --> 00:24:24.899 connections between the solid rocket booster, the platform, the tank and the orbiter. 00:24:24.899 --> 00:24:28.379 And that only takes about a week to do that. 00:24:28.379 --> 00:24:31.720 And, if that looks good, we have a review of all of that work. 00:24:31.720 --> 00:24:37.429 And if the review says we didn't leave anything undone, that we shouldn't take out the launch 00:24:37.429 --> 00:24:40.750 pad then we go out to the launch pad. 00:24:40.750 --> 00:24:44.110 [AUDIENCE QUESTION] Sure. 00:24:44.110 --> 00:24:51.110 Say a little bit about this difference from just bringing your car into have a 50,000 00:24:52.799 --> 00:24:59.799 mile checkup, that is the clean room aspects, the following of procedures, of having a checker. 00:25:00.039 --> 00:25:00.289 Sure. 00:25:00.289 --> 00:25:05.610 Well, a 50,000 mile checkup on a car is usually an external inspection. 00:25:05.610 --> 00:25:10.750 You change the oil and the filter and you check all the belts and the radiator hoses 00:25:10.750 --> 00:25:13.399 and you change all the fluids. 00:25:13.399 --> 00:25:16.870 Well, you do that with the orbiter also. 00:25:16.870 --> 00:25:23.370 But, in the case of the orbiter, you want to know whether you are this far away from 00:25:23.370 --> 00:25:30.019 having to do a valve job or the rings in the engine have now got so many thousand miles 00:25:30.019 --> 00:25:32.100 on them. 00:25:32.100 --> 00:25:33.960 We have the equivalent. 00:25:33.960 --> 00:25:38.289 You take the heads off the engine and you give it a valve job. 00:25:38.289 --> 00:25:45.289 And you take the pistons out of the block and you check for scoring in the block. 00:25:45.830 --> 00:25:50.669 You take the transmission out and you pull the gears out and make sure that the synchronizers 00:25:50.669 --> 00:25:52.690 are still OK. 00:25:52.690 --> 00:25:53.860 And you go through the rear-end. 00:25:53.860 --> 00:25:57.379 And you take all the avionics out. 00:25:57.379 --> 00:26:02.129 Or, you take your carry-on test equipment in and you hook it up to these connectors 00:26:02.129 --> 00:26:06.419 on the airflow meter and the computer in your vehicle and you run all those diagnostics 00:26:06.419 --> 00:26:10.110 to make sure all that stuff, even though it worked fine after you turned that ignition 00:26:10.110 --> 00:26:15.970 key off the last time, that all the redundancies and all the capability is still within that 00:26:15.970 --> 00:26:18.190 hardware and all the margins are still there. 00:26:18.190 --> 00:26:24.360 And then you button it back up and you make sure you button it back up properly, all of 00:26:24.360 --> 00:26:29.960 which is pre-established quite rigid flowcharts, checklists. 00:26:29.960 --> 00:26:32.320 A checker checking the checker. 00:26:32.320 --> 00:26:36.279 Oh, yes, and you have inspectors where there are critical things. 00:26:36.279 --> 00:26:41.000 If you're torquing the connecting rods onto the crankshaft, it says that you've got to 00:26:41.000 --> 00:26:43.779 do those bolts at 50 something foot pounds. 00:26:43.779 --> 00:26:45.139 And the technician will do that. 00:26:45.139 --> 00:26:49.860 And there will be an inspector there verifying that he set the torque wrench at 50 foot pounds 00:26:49.860 --> 00:26:54.620 and it really clicked there, and they stamp the procedure that it was done that way. 00:26:54.620 --> 00:26:58.279 I wanted to just add to that, I mean, even more emphasis. 00:26:58.279 --> 00:27:04.840 You don't do anything to the vehicle or to the payload unless you have a written procedure. 00:27:04.840 --> 00:27:11.840 What is absolutely not allowed is oh, there is a little problem, something didn't work 00:27:13.269 --> 00:27:14.940 the way it was supposed to in the test. 00:27:14.940 --> 00:27:15.940 Let's just fiddle around. 00:27:15.940 --> 00:27:18.590 Let's throw a few switches and see what happens. 00:27:18.590 --> 00:27:23.940 Well, I mean, that is normally the way you work at things if you're in a laboratory or 00:27:23.940 --> 00:27:26.480 working on your car. 00:27:26.480 --> 00:27:30.330 But the thing is you need absolute traceability. 00:27:30.330 --> 00:27:37.330 Because if something later on turns up out of spec or there is an anomaly during flight, 00:27:37.940 --> 00:27:42.909 you need to be able to recreate everything that was done to the orbiter. 00:27:42.909 --> 00:27:48.090 That is why we keep such good records on parts. 00:27:48.090 --> 00:27:54.899 Well, you can tell you that story about the tires that you just mentioned. 00:27:54.899 --> 00:27:58.820 People keep track of where all the parts of the orbiter came from, the lot numbers. 00:27:58.820 --> 00:28:05.820 And so, if any problem turns up, you can actually then trace on the orbiter and see if it affects 00:28:07.249 --> 00:28:08.879 there. 00:28:08.879 --> 00:28:15.879 All the work is done for approved work authorization documents, every step, every touch labor item 00:28:18.110 --> 00:28:20.480 that is done on the vehicle. 00:28:20.480 --> 00:28:24.899 And if you deviate from that procedure, which is approved by engineering, you have to get 00:28:24.899 --> 00:28:29.590 engineering approval to deviate from it. 00:28:29.590 --> 00:28:35.200 The assembly process, the standard work process of putting the vehicle together after a mission, 00:28:35.200 --> 00:28:41.559 there is over two million verifiable work items for the standard flow. 00:28:41.559 --> 00:28:48.200 And that doesn't include modifications or the nonstandard work that comes up, the proverbial 00:28:48.200 --> 00:28:54.620 glitch that occurs when you're checking out your computer system or when you pressurize 00:28:54.620 --> 00:28:59.309 this fluid system and the leak rate is higher than the specification allows. 00:28:59.309 --> 00:29:04.139 Well, engineering comes in and says OK, here is the trouble procedure. 00:29:04.139 --> 00:29:10.570 Here is what you're going to pursue, but you don't do any of that until the engineers write 00:29:10.570 --> 00:29:14.690 the procedure and give it to the technicians or the console operators that say OK, here 00:29:14.690 --> 00:29:17.889 is what you're going to do to try to find out the source of this leak. 00:29:17.889 --> 00:29:22.929 As Jeff indicated, you don't just start throwing switches and turning valves and say well, 00:29:22.929 --> 00:29:24.820 let's see if we can find out what's going on here. 00:29:24.820 --> 00:29:26.799 It is all pre-approved. 00:29:26.799 --> 00:29:32.679 And the reason for that is when you have these reviews that culminate into final review before 00:29:32.679 --> 00:29:38.779 you get ready to fly, you want to be able to say that this vehicle is assembled per 00:29:38.779 --> 00:29:44.210 print, that the designer's requirements, the people that you've already heard from that 00:29:44.210 --> 00:29:48.539 certified that this system will work just fine in flight if it looks like this when 00:29:48.539 --> 00:29:53.110 we launch it, you're trying to prove that this is what it looks like when you launch 00:29:53.110 --> 00:29:58.419 it and it is within the certification base and it is per the engineering drawings that 00:29:58.419 --> 00:30:00.279 we were given and it met all these requirements. 00:30:00.279 --> 00:30:06.330 Otherwise, you are guessing that it is OK to go fly the machine. 00:30:06.330 --> 00:30:11.659 And you cannot do that in this business. 00:30:11.659 --> 00:30:13.950 [AUDIENCE QUESTION] Yes. 00:30:13.950 --> 00:30:20.950 Does that seem to create any sort of tension on the engineers feeling like their hands 00:30:22.909 --> 00:30:23.850 are tied to go out and do stuff? 00:30:23.850 --> 00:30:28.840 Well, no, because they are the ones that ultimately say what goes in those two million steps. 00:30:28.840 --> 00:30:35.840 And if they want to add more tests or checks or inspections it is within their purview 00:30:35.980 --> 00:30:37.610 to propose that. 00:30:37.610 --> 00:30:42.409 The program, there is a group of senior engineers that are on these what we call control boards 00:30:42.409 --> 00:30:47.059 that approve the requirements that are implemented at the Kennedy Space Center. 00:30:47.059 --> 00:30:51.919 And they can say yeah, that's a good idea or, no, we don't want to change this, go back 00:30:51.919 --> 00:30:58.139 and give us some more rationale for what you think is a good idea to do to this system. 00:30:58.139 --> 00:31:05.139 In that respect, it is probably somewhat frustrating for the engineers because they cannot do anything 00:31:06.129 --> 00:31:10.570 different from last time unless they can justify the rationale for it. 00:31:10.570 --> 00:31:17.570 But that's the way it ought to be. 00:31:18.840 --> 00:31:23.330 The launch pad. 00:31:23.330 --> 00:31:29.549 The facilities at the launch pad are pretty simple. 00:31:29.549 --> 00:31:35.529 These are the same launch pads we flew from in Apollo. 00:31:35.529 --> 00:31:40.559 We've got storage facilities for the liquid hydrogen, liquid oxygen. 00:31:40.559 --> 00:31:46.679 We try to spend a minimum amount of time at the launch pad because Florida is a nice place 00:31:46.679 --> 00:31:53.679 to be on spring break but it's a bad place to have exotic hardware sitting outdoors with 00:31:54.039 --> 00:31:59.049 all that salt, humidity and all the other elements that mother nature throws at you 00:31:59.049 --> 00:31:59.580 like lightening. 00:31:59.580 --> 00:32:06.580 And, I think you can see down here, we have a good lightening protection system. 00:32:07.190 --> 00:32:13.779 There is a single mast with two wires that go out about a half a mile from the launch 00:32:13.779 --> 00:32:14.129 pad. 00:32:14.129 --> 00:32:16.149 It makes a good Faraday shield. 00:32:16.149 --> 00:32:21.090 And over the years we've been whacked a lot of times with lightening. 00:32:21.090 --> 00:32:23.169 In fact, it's a good attraction for lightening. 00:32:23.169 --> 00:32:28.360 And we have never gotten energy inside of that Faraday shield to damage any hardware. 00:32:28.360 --> 00:32:32.360 However, when we get lightening down there, we tell the workers to stand down and, of 00:32:32.360 --> 00:32:33.669 course, seek safe haven. 00:32:33.669 --> 00:32:35.879 But we have instrumented it. 00:32:35.879 --> 00:32:42.259 And it has taken some big hits, but we haven't gotten anything major inside that would cause 00:32:42.259 --> 00:32:44.169 us a problem from electric. 00:32:44.169 --> 00:32:44.779 Yes? 00:32:44.779 --> 00:32:50.249 After you take the Shuttle out onto the launch pad, is it very expensive to roll it back 00:32:50.249 --> 00:32:53.279 when you find a problem and then bring it back out again? 00:32:53.279 --> 00:32:53.529 Yes, it is. 00:32:53.509 --> 00:32:59.700 And that's why we have these reviews before we commit it to go to the launch pad to make 00:32:59.700 --> 00:33:05.860 sure that we're not taking any unknowns or any work out to the launch pad that should 00:33:05.860 --> 00:33:10.879 rightfully be done either in the Vehicle Assembly Building or further back in the Orbiter Processing 00:33:10.879 --> 00:33:11.220 Facility. 00:33:11.220 --> 00:33:16.820 It is a lengthy process because it takes about a week to hook everything up at the pad and 00:33:16.820 --> 00:33:22.799 check it before you go into the process of servicing the propellants and doing the hazardous 00:33:22.799 --> 00:33:28.869 work which has to all be undone if you roll back to the Vehicle Assembly Building. 00:33:28.869 --> 00:33:34.039 You've got to make sure you're really ready to go before you head on out there. 00:33:34.039 --> 00:33:34.570 Yes? 00:33:34.570 --> 00:33:38.249 Approximately how many times has that happened? 00:33:38.249 --> 00:33:39.309 Going back? 00:33:39.309 --> 00:33:46.309 Well, we probably have done it for technical reasons maybe 20% of the time. 00:33:52.619 --> 00:33:56.539 For weather reasons like we're worried about a hurricane or something like that the same, 00:33:56.539 --> 00:34:01.529 about 20% of the time. 00:34:01.529 --> 00:34:04.850 One out of every five times we've gone to the launch pad, we've had to come back for 00:34:04.850 --> 00:34:11.719 either a weather problem or a technical problem that either occurred at the launch pad or 00:34:11.719 --> 00:34:18.719 it's something that happened with a different vehicle in the fleet that may still be in 00:34:18.750 --> 00:34:23.280 the Orbiter Processing Facility or a components that is similar to one that is on the Shuttle 00:34:23.280 --> 00:34:28.290 that is at the pad that they were doing testing in the laboratory or doing what we call fleet 00:34:28.290 --> 00:34:30.239 leader testing at one of the NASA facilities. 00:34:30.239 --> 00:34:37.239 And they said, you know, there is an inherent flaw in this auxiliary power unit and we have 00:34:37.909 --> 00:34:43.710 to change the ones that are in the orbiter because they were manufactured at the same 00:34:43.710 --> 00:34:47.949 time or they have the same component on them and you cannot do that work out at the launch 00:34:47.949 --> 00:34:49.909 pad so you've got to roll it back. 00:34:49.909 --> 00:34:55.690 So the hardware at the pad may be just fine from the standpoint that you followed your 00:34:55.690 --> 00:35:00.830 processes and they checked out great in the previous part of the campaign. 00:35:00.830 --> 00:35:05.440 But an offline issue can cause you to say no, we've got to roll back and go change out 00:35:05.440 --> 00:35:12.440 this hardware or fix it or further test it before we can commit it to go fly. 00:35:12.620 --> 00:35:16.090 We have a big water tower out there also which I will talk about later. 00:35:16.090 --> 00:35:19.330 That is our sound suppression system. 00:35:19.330 --> 00:35:25.620 But basically a month is the maximum time you like to spend out there. 00:35:25.620 --> 00:35:31.830 We used to put a lot of payloads in the Orbiter Processing Facility when we were flying laboratories 00:35:31.830 --> 00:35:32.630 and that sort of thing. 00:35:32.630 --> 00:35:39.630 Space Station hardware, we install all that out at the launch pad now. 00:35:39.640 --> 00:35:44.790 And we test all the connections at the new facility. 00:35:44.790 --> 00:35:47.390 And we have a simulated launch count with the astronauts. 00:35:47.390 --> 00:35:51.810 And this is a tradition that goes back to the Mercury program. 00:35:51.810 --> 00:35:54.360 They bring the astronauts down to the Cape. 00:35:54.360 --> 00:36:01.150 They go through a day, two days of training, emergency egress, familiarization with the 00:36:01.150 --> 00:36:04.610 hardware, And then we have a simulated launch count without the propellants and all the 00:36:04.610 --> 00:36:11.610 hazardous stuff just to, if nothing else, remind the launch team that this is more than 00:36:12.360 --> 00:36:13.030 just a machine. 00:36:13.030 --> 00:36:15.770 We are going to fly people in this thing. 00:36:15.770 --> 00:36:18.540 And this occurs roughly two weeks before launch. 00:36:18.540 --> 00:36:23.070 And it is a good readiness test for the whole team. 00:36:23.070 --> 00:36:24.130 It's serious. 00:36:24.130 --> 00:36:26.890 We're a couple weeks before flight. 00:36:26.890 --> 00:36:27.830 The crew is in town. 00:36:27.830 --> 00:36:31.530 This vehicle is going to look the best it ever has. 00:36:31.530 --> 00:36:36.860 And we do a simulated launch countdown to within a couple seconds of liftoff. 00:36:36.860 --> 00:36:43.860 And then we do a simulated abort with the safeing of the vehicle and the crew gets out. 00:36:43.990 --> 00:36:46.450 And I will just add something. 00:36:46.450 --> 00:36:51.730 That is always something the crew looked forward to, first of all, because you actually get 00:36:51.730 --> 00:36:56.720 to get in the vehicle which, despite the fact that we have pretty good simulators in Houston, 00:36:56.720 --> 00:37:03.420 there is nothing like actually crawling inside the shuttle that you're going to fly in. 00:37:03.420 --> 00:37:07.060 And there is a lot of safety training that you do down at the Cape which is really kind 00:37:07.060 --> 00:37:09.020 of fun. 00:37:09.020 --> 00:37:14.470 You don't have any pictures of the launch escape, the pad slide wire basket? 00:37:14.470 --> 00:37:15.920 No, I don't think so. 00:37:15.920 --> 00:37:20.100 There is a requirement that you need to be able to get off the pad quickly if there is 00:37:20.100 --> 00:37:22.090 a launch emergency. 00:37:22.090 --> 00:37:27.250 And, of course, on the real launch day, unlike the simulated countdown where the pad is crawling 00:37:27.250 --> 00:37:33.780 with people, on launch day there are very few people, even when you're getting into 00:37:33.780 --> 00:37:35.360 the vehicle because it is fueled. 00:37:35.360 --> 00:37:37.750 And then everybody else leaves. 00:37:37.750 --> 00:37:44.630 So they have this big slide wire where if you have to get out of the orbiter in a hurray 00:37:44.630 --> 00:37:49.870 you go out and you jump in the bag, hit a little guillotine and it cuts you loose and 00:37:49.870 --> 00:37:51.060 you slide all the way down. 00:37:51.060 --> 00:37:57.210 Actually, in the early days, the astronauts kept saying we need to try this out. 00:37:57.210 --> 00:38:01.420 And they said no, you cannot do it because it hasn't been man rated. 00:38:01.420 --> 00:38:03.720 We said wait a minute. 00:38:03.720 --> 00:38:09.220 Well, it's rated for emergency use only so you cannot try it out. 00:38:09.220 --> 00:38:16.220 And then after Challenger they insisted that somebody actually ride down in it. 00:38:17.790 --> 00:38:18.240 Not every crew. 00:38:18.240 --> 00:38:21.070 Just one person tried it out. 00:38:21.070 --> 00:38:27.140 But the other thing that you do, once you get down to the bottom there is an underground 00:38:27.140 --> 00:38:28.780 bunker that you run into. 00:38:28.780 --> 00:38:34.540 And either you stay there and wait for help or they have these armored personnel carriers 00:38:34.540 --> 00:38:38.250 sitting around there with little tanks which you get in. 00:38:38.250 --> 00:38:40.330 And you've got to be able to drive your tank. 00:38:40.330 --> 00:38:43.700 They have a breakout section of the fence so you drive the tank through the fence out 00:38:43.700 --> 00:38:45.460 to a helicopter pickup point. 00:38:45.460 --> 00:38:49.810 So we all have to go out and learn how to drive the tank. 00:38:49.810 --> 00:38:53.940 And we drive over the sand dunes and everything. 00:38:53.940 --> 00:38:59.160 And then also they have a big pool which they light on fire. 00:38:59.160 --> 00:39:05.560 And they give you a big fireman's hose and they show you how to make your way through 00:39:05.560 --> 00:39:10.310 a fire by squirting a water path in front of you. 00:39:10.310 --> 00:39:15.930 All the little things you dream of as a kid, to be a fireman, drive a tank. 00:39:15.930 --> 00:39:17.690 So it's good fun. 00:39:17.690 --> 00:39:22.260 But it is part of the extensive safety procedures that they have. 00:39:22.260 --> 00:39:26.190 And all these things periodically they have to exercise. 00:39:26.190 --> 00:39:30.190 They do go through, every once in a while, a disaster drill down at the Cape where they 00:39:30.190 --> 00:39:36.340 simulate an emergency where they have to pick up the crew either outside the launch pad 00:39:36.340 --> 00:39:39.290 or either out in the ocean. 00:39:39.290 --> 00:39:46.290 And you've got to keep people at full operational readiness. 00:39:46.380 --> 00:39:49.410 That's one of the aspects of training. 00:39:49.410 --> 00:39:53.640 We train for the anomalies, the nonstandard things. 00:39:53.640 --> 00:39:58.380 The standard work, they do so much of that anyway you don't have to train for that. 00:39:58.380 --> 00:40:01.990 You don't have to train to put a payload in the payload bay. 00:40:01.990 --> 00:40:06.060 You don't have to train to power up your system and run your system checkout because that 00:40:06.060 --> 00:40:07.560 is a repetitive thing. 00:40:07.560 --> 00:40:14.350 But the nonstandard stuff, when things go wrong, that's where the emphasis of the training 00:40:14.350 --> 00:40:14.950 is. 00:40:14.950 --> 00:40:16.920 And, like Jeff said, it's a lot of fun. 00:40:16.920 --> 00:40:20.150 It's fun for the launch team, too. 00:40:20.150 --> 00:40:26.890 We have a control center at the Cape, and it is called the Launch Control Center. 00:40:26.890 --> 00:40:29.180 You would think this is where you launch it from. 00:40:29.180 --> 00:40:29.820 Well, you do that. 00:40:29.820 --> 00:40:35.390 But all of the other work that is done in the preceding three months is controlled from 00:40:35.390 --> 00:40:41.750 the Launch Control Center by test conductors and engineers who wrote the procedures and 00:40:41.750 --> 00:40:44.760 the software that implement all the requirements. 00:40:44.760 --> 00:40:50.030 And they control the activity on the orbiter or the tank or the boosters when it is still 00:40:50.030 --> 00:40:53.800 back in the offline facilities or the Vehicle Assembly Building or out to the launch pad. 00:40:53.800 --> 00:40:56.030 They do it from the Launch Control Center. 00:40:56.030 --> 00:40:58.680 We automate what we can from there. 00:40:58.680 --> 00:41:03.420 But for the manual activity -- And a lot of it is manual because regrettably you cannot 00:41:03.420 --> 00:41:07.210 do all this refurbishment on the shuttle with automated systems. 00:41:07.210 --> 00:41:09.720 It wasn't built that way. 00:41:09.720 --> 00:41:16.720 It is all managed from out Launch Control Center with old computers but with a great 00:41:17.200 --> 00:41:24.200 team 00:41:29.390 --> 00:41:31.320 of people. 00:41:31.320 --> 00:41:36.120 The software we use in the computers, I am not going to go into a lot of detail because 00:41:36.120 --> 00:41:40.570 it is really old stuff, but it works. 00:41:40.570 --> 00:41:46.900 It is like the software program that the FAA uses to track airplanes. 00:41:46.900 --> 00:41:48.980 It is hacker-proof. 00:41:48.980 --> 00:41:54.430 There are no external interfaces outside of the Launch Control Center firewall. 00:41:54.430 --> 00:41:57.640 It works just fine. 00:41:57.640 --> 00:42:01.620 And that is where we do the management of our day-to-day operations from our Launch 00:42:01.620 --> 00:42:02.200 Control Room. 00:42:02.200 --> 00:42:06.240 And we call it the LPS Launch Processing System software. 00:42:06.240 --> 00:42:08.910 We've tried to change it a couple of times over the years. 00:42:08.910 --> 00:42:10.350 Buy new hardware. 00:42:10.350 --> 00:42:17.350 We have supplemented it with laptops so that we can do more human engineering displays, 00:42:18.490 --> 00:42:24.410 but the computers are the same ones that we bought back in the late '70s. 00:42:24.410 --> 00:42:28.320 But then so are the computers that are on the orbiter that fly the machine. 00:42:28.320 --> 00:42:32.310 So it works. 00:42:32.310 --> 00:42:37.880 This is a bit repetitive, but I want to go through it again to make sure to emphasize 00:42:37.880 --> 00:42:41.170 what the role of the engineering is. 00:42:41.170 --> 00:42:45.820 The designers that you've heard from, they certified their design. 00:42:45.820 --> 00:42:52.820 And they did extensive testing, just like Detroit does on a car on the door latch. 00:42:54.260 --> 00:43:00.530 And they've tested that door latch and said, well, this thing out to be good for 250,000 00:43:00.530 --> 00:43:06.140 miles or 20 years or so many gazillion opening and closings of the door before it wears out 00:43:06.140 --> 00:43:07.150 and you've got to replace it. 00:43:07.150 --> 00:43:08.370 Well, they did all that. 00:43:08.370 --> 00:43:13.590 And to make sure that that hardware is still within the certification base, they developed 00:43:13.590 --> 00:43:16.370 requirements, sent them down to the Cape. 00:43:16.370 --> 00:43:23.150 We put them in the procedures, either manual procedures or software to implement those 00:43:23.150 --> 00:43:24.310 requirements. 00:43:24.310 --> 00:43:30.870 And the team, United Space Alliance the contractor and the NASA engineers will certify at each 00:43:30.870 --> 00:43:35.050 of the milestone reviews and the process of moving the hardware out to the pad they've 00:43:35.050 --> 00:43:37.210 met those requirements. 00:43:37.210 --> 00:43:43.440 And they did that either by participating in the activity or by reviewing the test data. 00:43:43.440 --> 00:43:50.440 And that allows us to sign a certificate of flight readiness a few days before launch 00:43:51.940 --> 00:43:54.450 that all the requirements have been met. 00:43:54.450 --> 00:43:59.330 When we get into launch count, we take in a subset of those requirements that when everything 00:43:59.330 --> 00:44:05.150 is powered up and ready to go fly all of these systems that are active ought to look like 00:44:05.150 --> 00:44:06.990 this. 00:44:06.990 --> 00:44:11.080 The voltages should be between this upper limit and this lower limit. 00:44:11.080 --> 00:44:14.400 The pressure should be between here and here. 00:44:14.400 --> 00:44:18.190 These indicators should show that they are open and these indicators should say that 00:44:18.190 --> 00:44:21.390 this latch is closed or the valve is closed or whatever. 00:44:21.390 --> 00:44:24.750 And we put that in what is called launch commit criteria. 00:44:24.750 --> 00:44:31.750 And that is the acceptable limit for the performance of that hardware when you're at that point 00:44:31.840 --> 00:44:37.840 which is nine minutes before launch when everybody commits that they are ready to go fly. 00:44:37.840 --> 00:44:44.610 And all those requirements, again, are implemented by procedures in software. 00:44:44.610 --> 00:44:50.970 And the three days of launch count have roughly, these are numbers, but about 500 requirements. 00:44:50.970 --> 00:44:55.520 There are thousands of measurements associated with those requirements. 00:44:55.520 --> 00:45:01.140 And most of the looking at those measurements is done by computers, obviously. 00:45:01.140 --> 00:45:07.850 But you have the engineer involved because if it is not within limits you turn to the 00:45:07.850 --> 00:45:09.300 engineer for what is wrong. 00:45:09.300 --> 00:45:12.610 Is there any chance to go fix this or do we have to change hardware? 00:45:12.610 --> 00:45:14.750 Do we have to do trouble shooting? 00:45:14.750 --> 00:45:16.800 So it's not a hands-off operation, obviously. 00:45:16.800 --> 00:45:23.800 The structure of the launch team, the launch director is shown in the middle, but that doesn't mean 00:45:31.760 --> 00:45:37.220 he or she is the only one with a go or a no-go button. 00:45:37.220 --> 00:45:44.180 The people the implement the requirements, there are roughly 150 of them in our Control 00:45:44.180 --> 00:45:50.420 Center, and they are the ones that provide the go, no-go for all the subsystems both 00:45:50.420 --> 00:45:54.550 flight and ground that everything is operating within the limits. 00:45:54.550 --> 00:46:01.550 They report that to a team of test conductors, NASA and contractor, and that's reported to 00:46:02.150 --> 00:46:03.560 the launch director. 00:46:03.560 --> 00:46:07.220 We are not along, obviously. 00:46:07.220 --> 00:46:14.220 We have an engineering support area, which are all the hidden senior engineers that you 00:46:14.270 --> 00:46:15.390 don't see on television. 00:46:15.390 --> 00:46:19.330 And there is a room full of about 150 to 200 of those. 00:46:19.330 --> 00:46:25.480 And they are looking at the performance of these systems as they are activated in launch 00:46:25.480 --> 00:46:25.850 count. 00:46:25.850 --> 00:46:30.670 And they've got all the trend data, the previous history of it. 00:46:30.670 --> 00:46:34.750 And they're looking at things like, well, all right, everything is in limits, but is 00:46:34.750 --> 00:46:36.810 it within family? 00:46:36.810 --> 00:46:41.970 The last time the system performed the voltage with this or the pressure was this. 00:46:41.970 --> 00:46:43.390 Well, it's still in limits. 00:46:43.390 --> 00:46:47.380 But it's not the same as it was before so we go look at it. 00:46:47.380 --> 00:46:50.400 Well, that's for this group of engineers over here. 00:46:50.400 --> 00:46:53.680 These guys and gals are running through their procedures. 00:46:53.680 --> 00:46:59.560 And, if everything was within limits, we just turn to the next page and go onto the next 00:46:59.560 --> 00:47:01.000 one. 00:47:01.000 --> 00:47:03.100 And they also have the emergency procedures. 00:47:03.100 --> 00:47:09.380 If something bad happens these are the people that will implement the emergency procedures. 00:47:09.380 --> 00:47:12.700 This offline support, they're out there. 00:47:12.700 --> 00:47:16.410 They're the senior people, they've been there before, they've been out there who knows how 00:47:16.410 --> 00:47:23.410 many years and they're asking questions like that didn't look right or we missed that step, 00:47:26.210 --> 00:47:28.050 go back and check it again. 00:47:28.050 --> 00:47:29.820 That's what they are for. 00:47:29.820 --> 00:47:35.590 The mission management team over here, these are the people that do the certificate of 00:47:35.590 --> 00:47:36.520 flight readiness. 00:47:36.520 --> 00:47:41.730 These are the folks that stand up in the readiness reviews and say I gave the Cape folks a good 00:47:41.730 --> 00:47:43.180 set of requirements. 00:47:43.180 --> 00:47:47.110 There is nothing that happened with the hardware that they're responsible for. 00:47:47.110 --> 00:47:50.360 And all those offline facilities are on previous missions. 00:47:50.360 --> 00:47:53.140 That shouldn't have any cloud over this mission. 00:47:53.140 --> 00:47:56.960 They are responsible for certifying that. 00:47:56.960 --> 00:48:02.600 And they do that through a structure of the mission management team. 00:48:02.600 --> 00:48:07.010 You've got, of course, the flight director with flight rules and the flight team that 00:48:07.010 --> 00:48:09.420 they look at during the launch count process. 00:48:09.420 --> 00:48:16.420 And you will hear more about that from Wayne Hale. 00:48:17.220 --> 00:48:23.810 And they, obviously, have a go, no-go input to the launch director in the decision process 00:48:23.810 --> 00:48:25.670 also. 00:48:25.670 --> 00:48:28.670 We have an integration activity. 00:48:28.670 --> 00:48:34.470 They system engineers are each responsible for, you know, they have boundary conditions 00:48:34.470 --> 00:48:35.940 on what they are responsible for. 00:48:35.940 --> 00:48:37.150 It is these pieces of hardware. 00:48:37.150 --> 00:48:38.030 It is this wiring. 00:48:38.030 --> 00:48:40.250 It is these actuators or latches or whatever. 00:48:40.250 --> 00:48:42.580 But a lot of that stuff fits together. 00:48:42.580 --> 00:48:47.260 Integration is a technical term for making sure that this person talks to this person 00:48:47.260 --> 00:48:49.100 and that they are hooked in with this one. 00:48:49.100 --> 00:48:56.100 That activity is done by a console in the Control Room, again, with senior engineers 00:48:56.990 --> 00:49:02.470 who actually manage all the automated software that runs the last couple hours of launch 00:49:02.470 --> 00:49:04.960 count that really launches the vehicle. 00:49:04.960 --> 00:49:06.980 And they are tied in with that. 00:49:06.980 --> 00:49:10.890 You also have the more subjective stuff. 00:49:10.890 --> 00:49:13.680 We launch on a public range. 00:49:13.680 --> 00:49:20.680 Public safety is obviously an issue, so the range has to make sure that it is safe to 00:49:20.690 --> 00:49:25.030 fly from a public standpoint, there are no boats in the launch danger area, no airplanes 00:49:25.030 --> 00:49:30.930 and that the weather meets the criteria of being able to track the vehicle should it 00:49:30.930 --> 00:49:31.640 go off course. 00:49:31.640 --> 00:49:38.070 And, of course, the payload has to certify, particularly if there is an active payload, 00:49:38.070 --> 00:49:42.320 that all of their launch commit criteria is met. 00:49:42.320 --> 00:49:47.910 And last, but certainly not least, you have safety oversight of all of that activity. 00:49:47.910 --> 00:49:52.650 And what I don't show on there, of course, is the flight crew, but they are obviously 00:49:52.650 --> 00:49:56.990 in communication with all of these people. 00:49:56.990 --> 00:50:00.780 So that is the network. 00:50:00.780 --> 00:50:05.420 But everybody out here has no-go authority. 00:50:05.420 --> 00:50:12.420 Anybody can come on the Net or press their switch and say I've got a problem, we're not 00:50:13.220 --> 00:50:14.600 going anywhere. 00:50:14.600 --> 00:50:19.450 And it is the launch director and the launch team's responsibility to make sure that problem 00:50:19.450 --> 00:50:26.450 is addressed, hold at the convenient, graceful to stop all the activity hold point until 00:50:26.800 --> 00:50:28.900 the issue is resolved. 00:50:28.900 --> 00:50:33.770 The real job, and I'll get into this later, of the launch director is to say no when everybody 00:50:33.770 --> 00:50:40.770 else wants to go because, as you get further into the launch count, the "launch fever" 00:50:41.750 --> 00:50:43.410 process sets in. 00:50:43.410 --> 00:50:50.410 It is a natural thing, it seems to be. 00:50:52.240 --> 00:50:52.580 People want to go. 00:50:52.580 --> 00:50:57.480 I want to ask you about that a little bit, I know we'll get into it later on, but flight 00:50:57.480 --> 00:51:03.100 rules and the launch decision, there are flight rules that say you must scrub if these conditions 00:51:03.100 --> 00:51:04.330 are not met. 00:51:04.330 --> 00:51:04.740 Right. 00:51:04.740 --> 00:51:08.680 And, yet, there is a tendency to allow judgment to come in. 00:51:08.680 --> 00:51:15.680 Let's take an example of a limit on crosswind at you landing to the return to launch site. 00:51:19.980 --> 00:51:25.690 You see it go above limits, but the rules strictly says no, you cannot go. 00:51:25.690 --> 00:51:26.930 Talk about that a little bit. 00:51:26.930 --> 00:51:32.570 That is what we use the mission management team for. 00:51:32.570 --> 00:51:34.220 And you bring up the weather example. 00:51:34.220 --> 00:51:38.500 Most of this stuff is pretty straightforward. 00:51:38.500 --> 00:51:43.450 It is either the voltage pressure temperature is in limits or out of limits. 00:51:43.450 --> 00:51:47.510 A person can question that and say I don't like the trend, and you've got to stop and 00:51:47.510 --> 00:51:53.900 clear the air if they say I want more discussion on this, I want more data review and that 00:51:53.900 --> 00:51:54.820 sort of thing. 00:51:54.820 --> 00:52:01.820 If it is a discussion like that involves activity outside of the Control Room beyond the purview 00:52:03.050 --> 00:52:07.040 of the console operators that are running through the procedure, we rely on the mission 00:52:07.040 --> 00:52:13.240 management team to manage that activity so the console operators can concentrate on their 00:52:13.240 --> 00:52:17.410 launch commit criteria and their procedures and their software. 00:52:17.410 --> 00:52:22.520 Something like crosswind limits, if there is a debate with the flight director and the 00:52:22.520 --> 00:52:28.920 weather people, we hold the clock and say mission management team, that is yours. 00:52:28.920 --> 00:52:34.870 You manage it, and whatever you have to do to resolve the decision, we'll scrub if need-be, 00:52:34.870 --> 00:52:41.590 we'll hold if need-be, or if the community can get comfortable that these crosswinds 00:52:41.590 --> 00:52:46.440 that are peaking occasionally out of spec, that it's OK to go fly anyway, then we will 00:52:46.440 --> 00:52:50.550 wait to hear from the flight director that that's OK. 00:52:50.550 --> 00:52:55.220 We don't insulate the Control Room from that, but we don't want to burden the control center 00:52:55.220 --> 00:52:57.520 with work and what is an offline issue. 00:52:57.520 --> 00:53:02.140 And it is up to the mission management team to disposition that. 00:53:02.140 --> 00:53:07.200 And you bring up weather because weather is one of the few things that there is really 00:53:07.200 --> 00:53:09.290 a lot of judgment still involved. 00:53:09.290 --> 00:53:13.250 Is the weather good enough to go fly? 00:53:13.250 --> 00:53:18.390 And it is probably the only thing that is in that category because everybody has an 00:53:18.390 --> 00:53:19.430 opinion on the weather. 00:53:19.430 --> 00:53:20.860 And Florida weather is dynamic. 00:53:20.860 --> 00:53:24.880 And usually, unless it is wintertime, there are clouds. 00:53:24.880 --> 00:53:29.390 And there is always a tendency, if you've held for weather or the weather is marginal, 00:53:29.390 --> 00:53:34.530 to hold longer to see if the weather gets better. 00:53:34.530 --> 00:53:40.350 And the real issue for the launch director is to try to convince people, if the weather 00:53:40.350 --> 00:53:42.770 is good enough, that this is good enough. 00:53:42.770 --> 00:53:46.220 And, yeah, you could wait longer for it to get better but it's good enough. 00:53:46.220 --> 00:53:48.990 We're running out of window time. 00:53:48.990 --> 00:53:53.910 All the time we sit here on the ground with all these systems humming along, the probability 00:53:53.910 --> 00:54:00.540 of some glitch or something coming up to scrub you is increased. 00:54:00.540 --> 00:54:06.500 And just as a personal note, when I was I the Air Force, I was a weather forecaster 00:54:06.500 --> 00:54:08.600 for Missile Operations. 00:54:08.600 --> 00:54:15.520 And I felt that that was a waste of an engineer's time because I was a graduate engineer with 00:54:15.520 --> 00:54:17.310 my diploma sticking out of my pocket. 00:54:17.310 --> 00:54:21.180 I wanted to go launch missiles and rockets, and the Air Force said Lieutenant Sieck is 00:54:21.180 --> 00:54:25.220 going to be a weather forecaster supporting Missile Operations. 00:54:25.220 --> 00:54:32.220 I endured that for a couple of years and put all of that experience in my hip pocket. 00:54:32.930 --> 00:54:36.940 And I didn't need it until I got into this launch director job. 00:54:36.940 --> 00:54:43.940 And I spent many hours talking to the weather people who provide the forecast for the launch 00:54:44.860 --> 00:54:51.860 going over all of the data and the technical aspects of the weather situation to see if 00:54:52.520 --> 00:54:57.370 there it was prudent to sit here any longer and wait for the weather to improve or whether 00:54:57.370 --> 00:55:02.440 it was better to scrub, get these guys out of their uncomfortable suits and send them 00:55:02.440 --> 00:55:06.410 back to crew quarters and recycle for the next day. 00:55:06.410 --> 00:55:13.410 And they won't necessarily scrub, but you have to disposition their concern. 00:55:14.060 --> 00:55:17.950 And you will hold until their concern is taken care of. 00:55:17.950 --> 00:55:18.640 Yes? 00:55:18.640 --> 00:55:25.640 This is unrelated, but you know how the Russians, in going out to the launch pad, use a rail 00:55:28.380 --> 00:55:31.050 track and they have the rocket flat? 00:55:31.050 --> 00:55:32.270 Can you do that with the shuttle? 00:55:32.270 --> 00:55:39.270 Instead of stacking it like this and then rolling it out, would it be better, easier? 00:55:40.360 --> 00:55:46.400 Well, the problem with that are the solid rocket boosters. 00:55:46.400 --> 00:55:53.400 They weight approximately, when assembled, a little less than three million pounds a 00:55:54.130 --> 00:55:54.880 piece. 00:55:54.880 --> 00:55:58.740 And the joints that caused the Challenger accident are critical. 00:55:58.740 --> 00:56:04.930 And I don't know if they went through the technical aspects of the design, but these 00:56:04.930 --> 00:56:07.650 things are 14 feet in diameter. 00:56:07.650 --> 00:56:13.280 Each segment weighs 300,000 pounds and they have these two cleavaces that come together 00:56:13.280 --> 00:56:16.230 with O rings in there. 00:56:16.230 --> 00:56:21.040 And what caused the Challenger accident was there was rotation in these joints to the 00:56:21.040 --> 00:56:25.770 point where the O rings, because of cold weather, weren't making a good seal and caused a gas 00:56:25.770 --> 00:56:26.150 path. 00:56:26.150 --> 00:56:30.250 And 1200 degree temperature. 00:56:30.250 --> 00:56:35.090 Exhaust plume just cut through the metal once it found a path. 00:56:35.090 --> 00:56:37.310 So you want to maintain the integrity of these joints. 00:56:37.310 --> 00:56:41.250 If you stacked them horizontally, and that could be done, and then you lift this thing 00:56:41.250 --> 00:56:47.000 vertically, the joints aren't certified to maintain their integrity doing that. 00:56:47.000 --> 00:56:51.720 Plus, you'd need some kind of huge crane to pull this 3 million pounds from horizontal 00:56:51.720 --> 00:56:52.480 to vertical. 00:56:52.480 --> 00:56:59.480 I think it's something that could have been done, had it been built into the design at 00:57:00.450 --> 00:57:00.810 the beginning. 00:57:00.810 --> 00:57:04.400 And the Russians have a tradition of doing this. 00:57:04.400 --> 00:57:07.760 And so that is the way they design their rockets. 00:57:07.760 --> 00:57:10.300 For whatever reason, we never started that way. 00:57:10.300 --> 00:57:13.880 From the very beginning, our rockets got stacked vertically. 00:57:13.880 --> 00:57:20.880 And that's the way all of the American rockets have been designed. 00:57:23.240 --> 00:57:24.920 Yes? 00:57:24.920 --> 00:57:31.920 [AUDIENCE QUESTION] The launch director, whether it is flight worthy, actually, that mission 00:57:32.750 --> 00:57:38.920 management team is responsible for the flight worthiness because they encompass not only 00:57:38.920 --> 00:57:44.430 watching what you did in launch count, but the certification of all this hardware before 00:57:44.430 --> 00:57:46.890 it even got to the launch pad. 00:57:46.890 --> 00:57:52.880 And, ultimately, the launch director is responsible for conducting an orderly launch and making 00:57:52.880 --> 00:57:57.580 sure that this mission management team doesn't have any issues, that that engineering team 00:57:57.580 --> 00:58:03.090 doesn't have any issues, that the console operators have really completed their procedures. 00:58:03.090 --> 00:58:04.780 That is their responsibility. 00:58:04.780 --> 00:58:10.590 And, if there is any fuzz on that, so to speak, even though console operators say they're 00:58:10.590 --> 00:58:14.680 go, and the mission management team says they're go and flight says they're go, if there is 00:58:14.680 --> 00:58:20.230 any concern about that, it's the launch director's job to say no, we're not going to go fly today. 00:58:20.230 --> 00:58:25.910 We are going to give you another day or two days to do more homework, look at more data, 00:58:25.910 --> 00:58:27.060 have more discussions. 00:58:27.060 --> 00:58:31.680 We're going to scrub today, even though everybody may say we're go. 00:58:31.680 --> 00:58:34.220 And that has happened before. 00:58:34.220 --> 00:58:41.220 And I always wondered, after not too many times, when I've said no, when everybody wants 00:58:41.980 --> 00:58:46.500 to go, whether I'll get the phone call saying well, I'm glad you made it safe today, Sieck, 00:58:46.500 --> 00:58:48.060 but you don't have this job tomorrow. 00:58:48.060 --> 00:58:50.830 Well, I never got that call. 00:58:50.830 --> 00:58:53.170 Never did. 00:58:53.170 --> 00:59:00.170 The process, not to bore you with it, but since it is an operation, normally we try 00:59:00.290 --> 00:59:02.910 to launch in the middle of a week, Wednesday or Thursday. 00:59:02.910 --> 00:59:07.630 We usually take the weekend off before that to clean up everything and give the launch 00:59:07.630 --> 00:59:11.140 team a rest, so we power up everything. 00:59:11.140 --> 00:59:13.390 And that's the way we start the process. 00:59:13.390 --> 00:59:17.990 And that's a couple of shifts worth of work to bring up the ground systems, the flight 00:59:17.990 --> 00:59:24.290 systems, make sure that all the avionics hardware really comes to life. 00:59:24.290 --> 00:59:28.680 And we put in a no work hold at the end of that to take care of any problems. 00:59:28.680 --> 00:59:35.680 If that all goes well then we get into the more critical activity that has time constraints 00:59:35.980 --> 00:59:37.780 associated with it. 00:59:37.780 --> 00:59:39.200 We load the fuel cell. 00:59:39.200 --> 00:59:44.370 That is the power plants and the orbiter reactants, liquid hydrogen and liquid oxygen, because 00:59:44.370 --> 00:59:45.440 they have limited life. 00:59:45.440 --> 00:59:49.610 Even if you don't have the fuel cells activated that stuff boils off and you lose it and that 00:59:49.610 --> 00:59:52.970 could count against your mission capability. 00:59:52.970 --> 00:59:56.160 And that is a hazardous operation also. 00:59:56.160 --> 01:00:00.420 And then we put in another no work hold at the end of that. 01:00:00.420 --> 01:00:07.420 And then we have a period of time where we bring up the final systems, put in the time 01:00:10.610 --> 01:00:16.280 critical storage, particularly when we're flying laboratories and you put in plants 01:00:16.280 --> 01:00:22.730 or critters or whatever it may be either in the crew module or the payload bay. 01:00:22.730 --> 01:00:29.730 And the last 12 hours down here is when you really have got to make sure this is a real 01:00:29.800 --> 01:00:32.130 decision point right here. 01:00:32.130 --> 01:00:38.220 Are we going to load the external tank, put a cycle on the tank? 01:00:38.220 --> 01:00:43.910 And we know that putting liquid hydrogen and liquid oxygen, and there is roughly half a 01:00:43.910 --> 01:00:50.710 million gallons in a tank, puts stresses into the hardware. 01:00:50.710 --> 01:00:54.460 You really don't want to do that unless you're pretty sure you're going to launch that day 01:00:54.460 --> 01:00:56.010 or that night. 01:00:56.010 --> 01:01:00.650 We have a meeting before that to make sure the weather looks pretty good and that the 01:01:00.650 --> 01:01:05.150 mission management team is not working any offline issues. 01:01:05.150 --> 01:01:07.090 And that has happened before. 01:01:07.090 --> 01:01:11.090 A war story for you. 01:01:11.090 --> 01:01:17.590 In the early '80s, in one of our missions, we assembled the mission management team to 01:01:17.590 --> 01:01:20.860 decide whether or not we ought to go load the external tank and go fly. 01:01:20.860 --> 01:01:21.470 Everything looked pretty good. 01:01:21.470 --> 01:01:24.490 And the orbiter project manager said well, I need to make you aware of this. 01:01:24.490 --> 01:01:31.490 I just got a telegram from the manufacturers of the tires. 01:01:31.750 --> 01:01:38.750 And the manufacturer said they were inspecting a lot, a lot of the tires of which we have 01:01:39.310 --> 01:01:45.380 two of them from the same lot on the Orbiter, and they found some blems on these tires. 01:01:45.380 --> 01:01:51.530 And they don't know whether it's a manufacturing flaw or an aging defect. 01:01:51.530 --> 01:01:55.560 And we don't know whether it affects the integrity of the tires. 01:01:55.560 --> 01:01:59.780 But since we knew you were launching tomorrow, we thought we would share this with you. 01:01:59.780 --> 01:02:04.650 Warm regards, BF Goodrich, I think it was at the time. 01:02:04.650 --> 01:02:09.190 Well, the mission management team threw on that on the table and said hey, we've got 01:02:09.190 --> 01:02:10.400 to go work this. 01:02:10.400 --> 01:02:15.310 These people, we don't know, they haven't said they're not certifying the tires. 01:02:15.310 --> 01:02:17.080 They just said they've got a problem. 01:02:17.080 --> 01:02:19.070 Well, that's fine. 01:02:19.070 --> 01:02:25.370 The mission management team, go work that and let's talk about whether or not it's prudent, 01:02:25.370 --> 01:02:32.320 under these circumstances, to go load the tank with some probability that we get all 01:02:32.320 --> 01:02:35.640 the way down to T minus nine minutes and you folks are going to say hey, we need to look 01:02:35.640 --> 01:02:40.210 at more test data on these tires or have more discussions with BF Goodrich on whether or 01:02:40.210 --> 01:02:41.470 not we go fly today. 01:02:41.470 --> 01:02:45.410 Well, you don't want to load the tank and go through all that if that's what you think 01:02:45.410 --> 01:02:50.150 the situation is going to be eight hours away from that. 01:02:50.150 --> 01:02:54.930 And you've put a cycle on the tank, you've used up a lot of cryos that you cannot save 01:02:54.930 --> 01:02:56.010 because of the heat leak. 01:02:56.010 --> 01:03:01.220 Plus, your launch team has put a cycle on, depending on the time of day, they've been 01:03:01.220 --> 01:03:02.730 up all day, all night or whatever. 01:03:02.730 --> 01:03:08.040 Those are the kinds of issues that you need to make sure get worked. 01:03:08.040 --> 01:03:12.540 And the mission management team has to handle that, but the launch director has to decide 01:03:12.540 --> 01:03:16.330 just go work that for another day or two. 01:03:16.330 --> 01:03:19.430 We're not going to load the tank. 01:03:19.430 --> 01:03:25.150 Or, what's the promise of this coming to fruition, the possibility so that it makes sense to 01:03:25.150 --> 01:03:27.050 go try to fly? 01:03:27.050 --> 01:03:29.900 What did you do with the tires? 01:03:29.900 --> 01:03:35.150 In that case, we went ahead and tanked. 01:03:35.150 --> 01:03:39.990 The subsystem manager for that, which you may have already heard from, went back to 01:03:39.990 --> 01:03:45.350 a lot of the test data that they had run on the tires, that they had been fairly recent. 01:03:45.350 --> 01:03:48.380 Langley, I think, was involved in it. 01:03:48.380 --> 01:03:53.330 And they said we don't have to worry about those blems being a problem for the tires 01:03:53.330 --> 01:03:56.320 that are on the Orbiter which, by the way, you don't have any access to at the launch 01:03:56.320 --> 01:03:56.570 pad. 01:03:56.560 --> 01:04:00.030 If we were going to change the tires, you would have to roll back to the Orbiter Processing 01:04:00.030 --> 01:04:01.900 Facility. 01:04:01.900 --> 01:04:08.060 And that would be a couple of month's worth of impact to that flight. 01:04:08.060 --> 01:04:13.960 We ended up not doing anything with the tires, but it had the mission management team really 01:04:13.960 --> 01:04:17.090 busy for about eight hours. 01:04:17.090 --> 01:04:21.670 And this process takes about three days. 01:04:21.670 --> 01:04:26.660 And we have refined those procedures, as you might expect over the years, to make this 01:04:26.660 --> 01:04:30.900 as an efficient and repetitive a process as we can. 01:04:30.900 --> 01:04:37.900 In addition to minimizing the hazards to the people and the equipment. 01:04:39.670 --> 01:04:46.670 Before we got to terminal count, usually we take like a two minute break. 01:04:48.730 --> 01:04:55.730 This is a good time to do that. 01:05:01.520 --> 01:05:08.520 Terminal count phase. 01:05:14.779 --> 01:05:19.590 After the tank is loaded, half a million gallons of liquid hydrogen, liquid oxygen, and there 01:05:19.590 --> 01:05:24.400 are no leaks, and we have leak detectors all over the vehicle, and we've scrubbed a lot 01:05:24.400 --> 01:05:31.400 of launches because of leaks, we give the crew a go to come on out. 01:05:33.320 --> 01:05:38.840 And a crew of seven or eight people, it takes an hour and a half to get them all in and 01:05:38.840 --> 01:05:42.380 get them connected, check their communications and that sort of thing. 01:05:42.380 --> 01:05:48.070 Roughly three hours before launch we bring them out, we get them all connected, we close 01:05:48.070 --> 01:05:52.770 the hatch and we verify the integrity of the crew module. 01:05:52.770 --> 01:05:59.770 And clockwise we're down to T minus 20 minutes, but if it's a rendezvous window, and most 01:06:00.410 --> 01:06:01.380 of them are now. 01:06:01.380 --> 01:06:08.050 The launch window is only five to ten minutes long so we have to be in phase with the same 01:06:08.050 --> 01:06:13.220 plane that the Space Station is in and we've got to get in phase with being able to catch 01:06:13.220 --> 01:06:18.100 the Space Station or have it catch us. 01:06:18.100 --> 01:06:22.560 The launch window, we don't have enough energy in the Shuttle to steer to any orbit we'd 01:06:22.560 --> 01:06:23.580 like to. 01:06:23.580 --> 01:06:28.210 The launch window is only about ten minutes long, so we put in a long hold at T minus 01:06:28.210 --> 01:06:32.110 nine minutes for those kinds of missions. 01:06:32.110 --> 01:06:37.850 It is the equivalent of the two minute timeout in a professional football game. 01:06:37.850 --> 01:06:44.850 Everybody has a chance to review their information, discuss their strategies, if it's a long launch 01:06:45.520 --> 01:06:52.010 window, if it was just a lab mission then we only wait for ten minutes at this T minus 01:06:52.010 --> 01:06:52.560 nine mark. 01:06:52.560 --> 01:06:58.040 But, if it's a short window, we set up the clock such that we hold there for almost an 01:06:58.040 --> 01:06:59.330 hour. 01:06:59.330 --> 01:07:04.450 And then, as you saw on that previous chart, we do a poll of all those people and make 01:07:04.450 --> 01:07:10.050 sure that they are all still go and they're not working any problems or issues. 01:07:10.050 --> 01:07:17.050 And then we start this automated software program that looks at, in addition to the 01:07:17.070 --> 01:07:21.279 systems engineers and their consoles looking at all their information, we have an automated 01:07:21.279 --> 01:07:25.360 program called the Ground Launch Sequencer that looks at all the measurements, all the 01:07:25.360 --> 01:07:27.880 parameters to make sure that they are within limits. 01:07:27.880 --> 01:07:33.370 And it issues all the commands to the vehicle and the ground support equipment. 01:07:33.370 --> 01:07:38.300 And we did that so we could manage the repeatability of that process. 01:07:38.300 --> 01:07:45.300 And you had to take the human factor button pressing out of the process as much as possible. 01:07:48.520 --> 01:07:51.720 And there is not a lot of work that goes on in there. 01:07:51.720 --> 01:07:53.230 And there is very little manual work. 01:07:53.230 --> 01:07:54.640 You get five minutes. 01:07:54.640 --> 01:07:59.980 The orbiter access arm, their ability o get out of the vehicle in a big hurry is retracted. 01:07:59.980 --> 01:08:04.029 It takes two to three minutes to pull that back, but we can get it back up to the vehicle 01:08:04.029 --> 01:08:10.750 in less than 30 seconds which is about the amount of time it takes them to unstrap and 01:08:10.750 --> 01:08:15.950 get out of there anyway if there's a fire or something bad like that, that they have 01:08:15.950 --> 01:08:18.170 to do an emergency egress. 01:08:18.170 --> 01:08:23.839 They start the propulsion units on the Orbiter that pressurize the hydraulic system. 01:08:23.839 --> 01:08:29.660 Just like on an airplane, there is an automated test of all the aero surfaces like they do 01:08:29.660 --> 01:08:30.649 on the end of a runway. 01:08:30.649 --> 01:08:36.330 But this is done by the computer and it wiggles the elevons and the rudder and the main engines 01:08:36.330 --> 01:08:38.979 to make sure all of that works. 01:08:38.979 --> 01:08:45.979 And we also start the conditioning of the propellant at the engine interface. 01:08:46.799 --> 01:08:49.770 And they already had the discussion about the main engines. 01:08:49.770 --> 01:08:54.440 You have to make sure that the quality of the fluid in the external tank and the quality 01:08:54.440 --> 01:09:01.339 of it that's right there at the injector of the engine is within the temperature and density 01:09:01.339 --> 01:09:03.779 parameters that the engine was certified at. 01:09:03.779 --> 01:09:06.839 Because we have to drain the propellant out of the fill lines. 01:09:06.839 --> 01:09:13.000 And, once we've started doing that, that propellant starts heating up right there on those valves 01:09:13.000 --> 01:09:16.250 that are going to go into the injector and start the main engines on the Orbiter. 01:09:16.250 --> 01:09:19.359 That limits our ability to stop and hold after that. 01:09:19.359 --> 01:09:23.940 We are good for four to five minutes after that starts. 01:09:23.940 --> 01:09:28.899 And that process starts at T minus five minutes. 01:09:28.899 --> 01:09:34.960 After that point in time, we are either going to launch or scrub in the next ten minutes. 01:09:34.960 --> 01:09:40.979 And then we pressurize the oxygen tank and we pressurize the hydrogen tank, but anywhere 01:09:40.979 --> 01:09:43.750 in this period of time we can stop. 01:09:43.750 --> 01:09:49.729 If an engineer or the automated sequencer says something is out of limits, we will stop 01:09:49.729 --> 01:09:54.580 at those milestones and disposition that problem if we can. 01:09:54.580 --> 01:09:59.540 But, per our rules, we won't waive any requirements at that point. 01:09:59.540 --> 01:10:05.440 Even though an engineer may have a perfectly good explanation as to why this temperature, 01:10:05.440 --> 01:10:11.260 pressure or whatever, our limit is not being met, if the launch commit criteria, the launch 01:10:11.260 --> 01:10:16.059 rules says no, it has to be like this, then we're not going to go launch that day. 01:10:16.059 --> 01:10:17.520 We won't. 01:10:17.520 --> 01:10:24.380 After 31 seconds, the solid rocket boosters come to life. 01:10:24.380 --> 01:10:29.380 The propellant doesn't ignite, but their hydraulic system is powered up. 01:10:29.380 --> 01:10:33.110 Their avionics systems are powered up. 01:10:33.110 --> 01:10:37.559 Their engine nozzles are checked again in an automatic sequence. 01:10:37.559 --> 01:10:43.610 And at 10 seconds, if everything looks good and all these measurements that our Ground 01:10:43.610 --> 01:10:50.540 Launch Sequencer has been looking at, we send up the computer data bus a go to the onboard 01:10:50.540 --> 01:10:52.940 computers that said all of our stuff has been satisfied. 01:10:52.940 --> 01:10:54.460 Now, we're still looking at a few things. 01:10:54.460 --> 01:11:00.000 We're looking at those bolts that are holding the solid rocket motors to the launch pad. 01:11:00.000 --> 01:11:05.780 And the ability to blow the nuts that are holding them, should that system fail, we 01:11:05.780 --> 01:11:09.210 would send the cutoff to the onboard computers. 01:11:09.210 --> 01:11:13.400 Regardless of where the engines were in their startup sequence, the three main engines, 01:11:13.400 --> 01:11:15.400 everything will stop. 01:11:15.400 --> 01:11:20.420 And hopefully it will gracefully come to a stop and we will safe all the systems and 01:11:20.420 --> 01:11:21.170 go from there. 01:11:21.170 --> 01:11:27.070 But that is the final handshake that is preplanned between flight and ground is that ten seconds 01:11:27.070 --> 01:11:29.920 when we send a command up to the computer saying we are all go. 01:11:29.920 --> 01:11:33.070 We can still shut you off, and we can shut you off manually, too. 01:11:33.070 --> 01:11:40.070 If a console operator sees something happening that they think could compromise the safety 01:11:40.440 --> 01:11:42.340 of the launch, they can call for a cutoff. 01:11:42.340 --> 01:11:44.190 And we have a switch that says cutoff. 01:11:44.190 --> 01:11:51.190 It sends a command to the onboard computers, and it will stop everything within 10 to 20 01:11:51.460 --> 01:11:52.240 milliseconds. 01:11:52.240 --> 01:11:59.240 But you don't like to put humans in a position to have to make that call. 01:11:59.920 --> 01:12:06.920 And that's why all of the critical stuff is done by the computers. 01:12:09.670 --> 01:12:11.940 And I mentioned the Ground Launch Sequencer. 01:12:11.940 --> 01:12:16.420 That's a console and operators in the back of the Control Room. 01:12:16.420 --> 01:12:20.880 And they are the ones, by the way, that determine nobody presses a button for launch. 01:12:20.880 --> 01:12:27.880 A woman in the back of the Control Room types the liftoff time into the computer when the 01:12:28.790 --> 01:12:31.830 launch director tells her, hey, look, it looks like we're going to come out of our T minus 01:12:31.830 --> 01:12:33.780 nine minute hold at this point in time. 01:12:33.780 --> 01:12:34.960 So here is the liftoff time. 01:12:34.960 --> 01:12:35.920 Put that in the computer. 01:12:35.920 --> 01:12:38.230 And after that it's a hands-off operation. 01:12:38.230 --> 01:12:45.230 Can I ask, are these commands being physically sent, I mean they're hard line cable? 01:12:47.830 --> 01:12:51.460 It's what we call a launch data vest. 01:12:51.460 --> 01:12:56.890 It's a cable that is connected from the computers in the Control Room through the liftoff umbilical 01:12:56.890 --> 01:13:01.860 into the Orbiter computers. 01:13:01.860 --> 01:13:04.790 It's a data train. 01:13:04.790 --> 01:13:07.170 And when is that connection broken? 01:13:07.170 --> 01:13:08.010 At liftoff. 01:13:08.010 --> 01:13:14.360 The onboard computers will check the health of the main engines, and if the three main 01:13:14.360 --> 01:13:19.050 engines are within all of their operating parameters, the turbines and the pumps and 01:13:19.050 --> 01:13:26.050 the temperatures then it sends a command to those eight bolts that hold the solid rocket 01:13:29.240 --> 01:13:35.280 boosters to the mobile launch platform and the bolts that hold the external tank vent 01:13:35.280 --> 01:13:36.470 arm to the tank. 01:13:36.470 --> 01:13:42.050 And the two Orbiter umbilicals that says fire the nuts, we're going to go. 01:13:42.050 --> 01:13:45.400 And that is orchestrated by the onboard computers. 01:13:45.400 --> 01:13:50.150 And when that happens you're flying, you're going. 01:13:50.150 --> 01:13:57.150 The command to ignite the igniters on the solid rocket motors is sent at that time also 01:13:57.820 --> 01:14:02.110 by the onboard computers within a couple of milliseconds. 01:14:02.110 --> 01:14:03.510 So all that happens at once. 01:14:03.510 --> 01:14:08.440 And it's an onboard automated thing. 01:14:08.440 --> 01:14:15.440 I talked about the human factor that repeatability is important. 01:14:20.380 --> 01:14:27.270 And I mentioned I gave the engineers, you know, I always threw rocks at them because 01:14:27.270 --> 01:14:28.520 they always want to change things. 01:14:28.520 --> 01:14:32.890 It is the launch director's responsibility to manage. 01:14:32.890 --> 01:14:39.790 They're the owner, so to speak, of the launch count procedures, the 5,000 pages of documentation 01:14:39.790 --> 01:14:46.790 and the 500 or so software programs that are executed in the launch count process. 01:14:46.809 --> 01:14:49.710 And we discouraged changes to that for obvious reasons. 01:14:49.710 --> 01:14:53.360 Unless there is a modification to the flight hardware or the ground hardware or we found 01:14:53.360 --> 01:15:00.170 something in our previous launch attempt that said we need to fix this or there's an opportunity 01:15:00.170 --> 01:15:05.670 to increase the margins, we don't change it. 01:15:05.670 --> 01:15:10.270 We try to maintain the procedure and the hardware the way it always has been. 01:15:10.270 --> 01:15:11.960 And it essentially is. 01:15:11.960 --> 01:15:17.630 We do training, obviously, but we train for the nonstandard work. 01:15:17.630 --> 01:15:24.630 Just like in the flight team, we have a simulation supervisor that throws diabolical failures 01:15:25.210 --> 01:15:32.020 out there and we have computer programs and into the control center we bring the launch 01:15:32.020 --> 01:15:33.670 team, power up the consoles. 01:15:33.670 --> 01:15:39.040 And their displays look like the shuttle is at the pad and it is getting ready to launch 01:15:39.040 --> 01:15:46.040 and we throw failures at them to test their reaction and to find bugs in our safing procedures. 01:15:47.059 --> 01:15:50.690 And we've done that over the years. 01:15:50.690 --> 01:15:57.690 I think the next generation of vehicles will probably have more automation. 01:15:58.130 --> 01:16:04.050 And that will probably be a better thing but you will never take the console operator out 01:16:04.050 --> 01:16:09.150 of the Control Center either, the Launch Control Center or the Flight Control Center. 01:16:09.150 --> 01:16:16.150 You need the person there to disposition the problems, but predictability is what we're 01:16:19.059 --> 01:16:20.830 always after. 01:16:20.830 --> 01:16:27.830 And stable procedures, be they flight or ground, give predictable results. 01:16:27.900 --> 01:16:30.809 And that is why we automate. 01:16:30.809 --> 01:16:37.809 And we control change, too. 01:16:38.140 --> 01:16:40.850 Responsibility. 01:16:40.850 --> 01:16:45.020 I talked about the engineers. 01:16:45.020 --> 01:16:48.710 I didn't mention, I don't think, technicians and inspectors. 01:16:48.710 --> 01:16:55.710 But when a technician stamps a procedure that I torque that bolt and the inspector stamps 01:16:58.260 --> 01:17:02.309 that same procedure and said I saw him torque that bolt, that is their warranty that that 01:17:02.309 --> 01:17:05.480 event really happened. 01:17:05.480 --> 01:17:08.230 And that paper trail and that warranty is very important. 01:17:08.230 --> 01:17:15.230 When an engineer signs a procedure that tested the Flight Control System that said I reviewed 01:17:15.540 --> 01:17:20.690 all the data, didn't see any glitches, everything met specifications, that signature is his 01:17:20.690 --> 01:17:26.960 or her warranty that the procedure ran correctly and that they understood the requirements 01:17:26.960 --> 01:17:28.650 that were implemented by that procedure. 01:17:28.650 --> 01:17:31.540 And the requirements were met. 01:17:31.540 --> 01:17:34.000 And that is important. 01:17:34.000 --> 01:17:41.000 Our whole concept of launch readiness is based on people being responsible for their system, 01:17:44.090 --> 01:17:50.480 be it the designer that signs it that says there is nothing going on offline, there are 01:17:50.480 --> 01:17:54.480 no faxes out there that say there is a cloud over the tires. 01:17:54.480 --> 01:18:00.670 Or, my last test of the main engines at Stennis, there was nothing there that says these three 01:18:00.670 --> 01:18:04.960 engines that are on this orbiter shouldn't work just fine. 01:18:04.960 --> 01:18:07.180 And they do that in a flight readiness process. 01:18:07.180 --> 01:18:10.150 That is their warranty and responsibility. 01:18:10.150 --> 01:18:12.950 And we hammer this home. 01:18:12.950 --> 01:18:19.950 And it probably comes from, I had this quote in my office for years and I am going to bore 01:18:20.330 --> 01:18:26.430 you with it, and maybe some of you can guess where this came from. 01:18:26.430 --> 01:18:27.700 Responsibility is a unique concept. 01:18:27.700 --> 01:18:32.440 It can only reside in here in a single individual. 01:18:32.440 --> 01:18:37.790 You may share it with others, but your portion is not diminished. 01:18:37.790 --> 01:18:41.710 You may delegate it but it is still with you. 01:18:41.710 --> 01:18:47.630 You may disclaim it but you cannot divest yourself of it. 01:18:47.630 --> 01:18:54.630 Even if you do not recognize it or admit its presence, you cannot escape it. 01:18:54.750 --> 01:19:00.920 If responsibility is rightfully yours, no evasion or ignorance or passing the blame 01:19:00.920 --> 01:19:04.220 can shift the burden to someone else. 01:19:04.220 --> 01:19:06.500 And this is what we push home. 01:19:06.500 --> 01:19:13.500 And, by the way, this quote was Admiral Rickover who was testifying before Congress after the 01:19:16.380 --> 01:19:20.130 first nuclear submarine accident. 01:19:20.130 --> 01:19:23.300 And he was saying I am responsible. 01:19:23.300 --> 01:19:28.860 It is my program, it is my submarine, I am responsible. 01:19:28.860 --> 01:19:35.860 Even though somebody else was commanding it, it doesn't matter, I am responsible. 01:19:36.150 --> 01:19:43.090 And we impress that on the managers, the engineers, the technicians, the inspectors, you know, 01:19:43.090 --> 01:19:43.880 you're important. 01:19:43.880 --> 01:19:45.750 And the work you do is important. 01:19:45.750 --> 01:19:50.630 And when you sign or stamp that procedure or give a go on the Net that is your warranty 01:19:50.630 --> 01:19:57.520 that everything is working and you understand the requirements. 01:19:57.520 --> 01:20:04.420 Very important in the business that we're in. 01:20:04.420 --> 01:20:05.110 Decision making. 01:20:05.110 --> 01:20:12.110 On the chart. 01:20:13.030 --> 01:20:19.250 This structure has been in place since the Mercury program. 01:20:19.250 --> 01:20:24.000 There is nothing new here. 01:20:24.000 --> 01:20:31.000 And the only issue comes in when there is a gray area. 01:20:31.130 --> 01:20:37.640 Who makes the call and how much judgment is involved in the call? 01:20:37.640 --> 01:20:42.340 And I gave you the example of weather. 01:20:42.340 --> 01:20:43.350 Everybody has an opinion on it. 01:20:43.350 --> 01:20:44.980 It can be judgmental. 01:20:44.980 --> 01:20:51.980 Well, the weather decision is if it is launch weather related it is the launch director's 01:20:52.650 --> 01:20:54.910 responsibility to determine if it's good enough. 01:20:54.910 --> 01:21:01.910 If the flight director has an issue with the return to launch site winds, that ultimately 01:21:04.770 --> 01:21:07.920 is his or her decision. 01:21:07.920 --> 01:21:14.400 The people may get involved in it and they may have offline discussions with the flight 01:21:14.400 --> 01:21:21.400 director, but it is still ultimately his decision. 01:21:21.860 --> 01:21:25.420 And that is the way it has to be because they are responsible. 01:21:25.420 --> 01:21:32.420 This mission management team is not responsible for the go, no-go decision on weather on launch 01:21:34.390 --> 01:21:34.739 day. 01:21:34.739 --> 01:21:36.910 It's the flight director for the flight stuff. 01:21:36.910 --> 01:21:40.460 It is the launch director for the launch-related stuff. 01:21:40.460 --> 01:21:43.290 And it is set up that way so there is no fuzz on it. 01:21:43.290 --> 01:21:49.770 Other people can have an opinion, other people can have input, but unless this person up 01:21:49.770 --> 01:21:56.710 here says launch director we're no go, it is the launch director's decision in that 01:21:56.710 --> 01:22:01.160 case. 01:22:01.160 --> 01:22:05.610 Communication. 01:22:05.610 --> 01:22:08.800 Real important. 01:22:08.800 --> 01:22:13.650 And I will give you an example of that. 01:22:13.650 --> 01:22:16.080 Apollo 13. 01:22:16.080 --> 01:22:23.080 Most of you probably don't remember Apollo 13, but Apollo 13 was like Challenger and 01:22:24.309 --> 01:22:28.630 the Columbia except we didn't lose the flight crew. 01:22:28.630 --> 01:22:31.059 But it was just as disastrous an event. 01:22:31.059 --> 01:22:37.420 And by all rights the crew shouldn't have made it safety back to earth, but thanks to 01:22:37.420 --> 01:22:44.420 the heroics of the flight crew and the flight team and the timing of when that event occurred 01:22:45.030 --> 01:22:46.640 they were able to get back home. 01:22:46.640 --> 01:22:53.640 But that was all caused by activity that was done on the ground well before the launch. 01:22:55.330 --> 01:22:59.620 And, specifically since I was involved in that, I remember this like it was yesterday. 01:22:59.620 --> 01:23:02.420 Of course, part of that is an old age thing. 01:23:02.420 --> 01:23:06.330 Stuff that happened 40 years ago comes in loud and clear. 01:23:06.330 --> 01:23:12.280 Stuff that happened four days ago, I have a hard time remembering. 01:23:12.280 --> 01:23:19.280 But we had a tank in the spacecraft that we ran our simulated launch count. 01:23:20.239 --> 01:23:23.610 And back then we put propellants in the vehicle, all the hazardous stuff and detanks. 01:23:23.610 --> 01:23:26.610 And we couldn't detank the liquid oxygen out of this tank. 01:23:26.610 --> 01:23:31.070 They had the fuel cells on the spacecraft. 01:23:31.070 --> 01:23:32.750 And just a little more history. 01:23:32.750 --> 01:23:38.670 The tank had been dropped when it was installed back in California, but engineers and managers 01:23:38.670 --> 01:23:42.520 did some tests and some rationale on saying well, it's still OK to install it. 01:23:42.520 --> 01:23:43.400 We got it down the Cape. 01:23:43.400 --> 01:23:46.360 We put the liquid oxygen in it and all the rest of the system. 01:23:46.360 --> 01:23:49.330 We couldn't get it out of this tank. 01:23:49.330 --> 01:23:54.440 And after reviewing it they found, well, the stand pipe in there that is used to drain 01:23:54.440 --> 01:23:58.390 it on the ground was probably bent or damaged and that's why we cannot get it out. 01:23:58.390 --> 01:24:04.520 So the managers and engineers got together for a few days and said turn the heaters on 01:24:04.520 --> 01:24:08.850 in the tank and vent the liquid oxygen off. 01:24:08.850 --> 01:24:14.110 Heat it up and it will boil off as oxygen gas through another loop that takes it through 01:24:14.110 --> 01:24:16.970 the fuel cells and out vent on the vehicle. 01:24:16.970 --> 01:24:19.309 Use the heaters to go do that. 01:24:19.309 --> 01:24:25.940 So they developed the procedure and we went on station at night a week after we had the 01:24:25.940 --> 01:24:30.210 anomaly and turned everything on and turned on the heaters. 01:24:30.210 --> 01:24:32.380 And it is fine. 01:24:32.380 --> 01:24:35.260 You can see the liquid is turning to gas and it is coming out. 01:24:35.260 --> 01:24:41.790 And the console operator in our Control Room said hey, Sieck, I cannot monitor the temperature 01:24:41.790 --> 01:24:42.809 in this tank anymore. 01:24:42.809 --> 01:24:44.750 Well, why is that? 01:24:44.750 --> 01:24:49.980 Well, the range on the temperature is from ambient down to minus 300 degrees because 01:24:49.980 --> 01:24:52.559 it's measured in liquid oxygen. 01:24:52.559 --> 01:24:53.809 And it is upper limits. 01:24:53.809 --> 01:25:00.809 It started heating up, and now I cannot tell you whether it is 50 degrees or 350 degrees. 01:25:01.230 --> 01:25:02.540 I said OK, stop. 01:25:02.540 --> 01:25:07.440 So we stopped the test and got all these managers involved, including the people that built 01:25:07.440 --> 01:25:11.750 the tank and say hey, we've lost visibility. 01:25:11.750 --> 01:25:15.360 We're putting energy into this tank that has liquid oxygen in it. 01:25:15.360 --> 01:25:17.170 We cannot monitor the temperature anymore. 01:25:17.170 --> 01:25:19.400 The pressure seems to be fine. 01:25:19.400 --> 01:25:21.000 They said don't worry about it. 01:25:21.000 --> 01:25:25.790 There is a thermostat in there that is heat sensitive, and it will open up the power to 01:25:25.790 --> 01:25:29.250 the heaters if it gets to some limit in there. 01:25:29.250 --> 01:25:30.400 Just keep your eye on the pressure. 01:25:30.400 --> 01:25:31.820 Make sure the pressure doesn't get too high. 01:25:31.820 --> 01:25:36.510 Well, of course the pressure isn't going to get too high because the vent is open. 01:25:36.510 --> 01:25:37.640 So we said fine. 01:25:37.640 --> 01:25:44.640 We turned the ground power supplies on and let the thing cook for 10 to 12 hours. 01:25:45.390 --> 01:25:51.120 And what we didn't know was that the thermostat wasn't certified to the voltage we were using 01:25:51.120 --> 01:25:56.100 from our ground power supplies because we didn't tell them, although our requirements 01:25:56.100 --> 01:25:59.739 allowed it, that we cranked the power supplies up to 50 volts. 01:25:59.739 --> 01:26:00.770 And why did we do that? 01:26:00.770 --> 01:26:06.670 Well, the more energy you put into the tank the higher the heaters get and the quicker 01:26:06.670 --> 01:26:08.210 the liquid oxygen boils off. 01:26:08.210 --> 01:26:10.800 You know, high school physics. 01:26:10.800 --> 01:26:13.460 But we didn't tell them that. 01:26:13.460 --> 01:26:17.380 And the people that built the tank and built that thermostat had only certified it to the 01:26:17.380 --> 01:26:20.870 voltage of fuel cell supply which is half that value. 01:26:20.870 --> 01:26:25.780 So the thermostat welded together, the points did, and we had continuous power going on 01:26:25.780 --> 01:26:27.860 in there for eight to ten hours. 01:26:27.860 --> 01:26:31.100 It got to 800, 900 degrees in the tank. 01:26:31.100 --> 01:26:35.580 We burned all the insulation off the wires to the fans and the heaters. 01:26:35.580 --> 01:26:41.460 And, from that point on, we were just waiting for something to happen to make those wires 01:26:41.460 --> 01:26:43.000 come together. 01:26:43.000 --> 01:26:48.059 And if you didn't turn the power on you're going to get a spark in an oxygen tank. 01:26:48.059 --> 01:26:49.210 Not a good thing. 01:26:49.210 --> 01:26:56.210 Well, that is what happened a day into the mission when they were heading to the moon. 01:26:57.610 --> 01:27:01.530 And they turned the heaters and the fans on to stir the cryogenics because they were worried 01:27:01.530 --> 01:27:05.130 about stratification and zero gravity. 01:27:05.130 --> 01:27:09.160 And they got the spark and it blew up the service module. 01:27:09.160 --> 01:27:16.160 The point is that communication, we wrote down in our procedures what we did, but we 01:27:16.630 --> 01:27:20.010 didn't communicate that on a real-time basis. 01:27:20.010 --> 01:27:26.090 And, although we reviewed the procedures afterward, as the rest of the team did, the designer 01:27:26.090 --> 01:27:33.090 who was 1500 miles away who had approved what we did over an intercom system didn't review 01:27:33.160 --> 01:27:34.180 our paperwork. 01:27:34.180 --> 01:27:40.210 You hit that thing with 50 volts, it's only certified for 25 volts, even though our requirements 01:27:40.210 --> 01:27:41.790 allowed us to use 50 volts. 01:27:41.790 --> 01:27:48.790 It is a case where requirements didn't preclude us from launching hardware then in hindsight 01:27:49.150 --> 01:27:49.970 was flawed. 01:27:49.970 --> 01:27:54.380 But, on the other hand, communication, we didn't tell them in real-time. 01:27:54.380 --> 01:28:01.380 And, as a result, Apollo 13 happened. 01:28:01.530 --> 01:28:04.970 So I learned that lesson early on. 01:28:04.970 --> 01:28:11.030 I mean even if you're boring them with what appears to be minutia, you're going to tell 01:28:11.030 --> 01:28:15.150 them everything and document everything. 01:28:15.150 --> 01:28:20.510 And, thankfully, they went through our procedures and said well, there it is. 01:28:20.510 --> 01:28:22.260 And I thought we'd get fired. 01:28:22.260 --> 01:28:28.090 And actually we got patted on the back for documenting what we had done so it made it 01:28:28.090 --> 01:28:31.160 easier to zero in on the root cause of the problem. 01:28:31.160 --> 01:28:38.160 And, as a result, we fixed that and we were able to fly again in a few months as opposed 01:28:39.090 --> 01:28:45.570 to having to go through a Challenger or Columbia type of activity. 01:28:45.570 --> 01:28:49.040 Very important. 01:28:49.040 --> 01:28:52.290 Launch fever. 01:28:52.290 --> 01:28:53.809 The human factor. 01:28:53.809 --> 01:29:00.809 It is hard to describe what the environment is in the spacecraft a few minutes before 01:29:03.040 --> 01:29:05.070 launch or in the Control Room. 01:29:05.070 --> 01:29:07.430 But there is a lot of tension and there is a lot of energy. 01:29:07.430 --> 01:29:13.190 And everybody in there, for the most part, has been awake for the last 10 to 12 hours. 01:29:13.190 --> 01:29:20.190 And they came to work that day or that night with all hopes of safely launching the Space 01:29:20.830 --> 01:29:21.680 Shuttle. 01:29:21.680 --> 01:29:27.450 And they really don't want anything to go wrong with their system or somebody else's 01:29:27.450 --> 01:29:27.900 system. 01:29:27.900 --> 01:29:29.760 I mean that's the mood. 01:29:29.760 --> 01:29:34.360 Because, if something goes wrong, you're going to come back tomorrow or the next day or the 01:29:34.360 --> 01:29:35.590 next week. 01:29:35.590 --> 01:29:41.090 So they really want to hear this everybody, you know, when they do the polls they go, 01:29:41.090 --> 01:29:43.190 go, go, go. 01:29:43.190 --> 01:29:48.989 And the hardest thing is saying no when everything sounds like it's go. 01:29:48.989 --> 01:29:55.989 And there are a lot of times when we've had problems with ground support equipment. 01:29:57.230 --> 01:29:58.180 It is old. 01:29:58.180 --> 01:30:00.280 I wish we had all new stuff for Shuttle. 01:30:00.280 --> 01:30:03.110 A lot of this stuff is the same we used on Apollo. 01:30:03.110 --> 01:30:09.450 And, in spite of our efforts to maintain it, it is all out in the corrosive atmosphere 01:30:09.450 --> 01:30:10.940 at the launch pad. 01:30:10.940 --> 01:30:17.120 And that stuff constantly gave us problems. 01:30:17.120 --> 01:30:21.910 And we would lose some of our redundant systems and some of our primary systems. 01:30:21.910 --> 01:30:27.280 And more than once in launch count, when we'd have a problem out there, the team would come 01:30:27.280 --> 01:30:32.210 to the launch director through that organization chart you saw and say we've got an idea. 01:30:32.210 --> 01:30:39.210 We think if we patch around this and then hook this up to this and we throw these switches 01:30:39.220 --> 01:30:46.220 and we get this result that it will be OK and we can go fly without this power supply 01:30:46.770 --> 01:30:51.470 being active or this purge system operating normally and all these other things that we've 01:30:51.470 --> 01:30:52.160 got out there. 01:30:52.160 --> 01:30:58.510 And what you have to do as launch director is say well, just sit back and analyze whether 01:30:58.510 --> 01:31:05.510 or not -- I mean you rely on your engineers to use their Yankee ingenuity to fix a problem, 01:31:06.410 --> 01:31:12.900 but you have to assess whether or not they're literally shot-gunning it and coming up with 01:31:12.900 --> 01:31:19.900 the proverbial quick fix because they want to go home in an hour or so and celebrate 01:31:20.050 --> 01:31:21.090 a good launch. 01:31:21.090 --> 01:31:25.300 Just like these guys want to get out of those uncomfortable suits they have been sitting 01:31:25.300 --> 01:31:29.250 in for the last couple hours and either get out of the spacecraft or get up there in zero 01:31:29.250 --> 01:31:29.500 G. 01:31:29.440 --> 01:31:35.530 As a launch director, you have to assess well, OK, but is this really the right thing to 01:31:35.530 --> 01:31:38.290 do or are they working this too hard? 01:31:38.290 --> 01:31:42.520 If you gave them another 24 hours to look at the data and think about their approach 01:31:42.520 --> 01:31:48.500 to a fix would the answer be any different? 01:31:48.500 --> 01:31:52.390 And there have been a few times when they said well, that sounds pretty good right now 01:31:52.390 --> 01:31:56.930 but I am going to give you another 24 hours to think about it so we're going to scrub 01:31:56.930 --> 01:31:57.470 for the day. 01:31:57.470 --> 01:32:00.510 And you can hear the big groan in the Control Room. 01:32:00.510 --> 01:32:05.390 And you can just see it going through their heads, well, this guy has lost confidence 01:32:05.390 --> 01:32:06.650 in us. 01:32:06.650 --> 01:32:10.809 I mean we all came to work, we get paid to solve problems and get things done, and he 01:32:10.809 --> 01:32:16.500 is telling us that ain't a good answer, that ain't a good fix. 01:32:16.500 --> 01:32:23.500 So you have to balance that when you're in charge, but the real job of the launch director 01:32:23.620 --> 01:32:27.330 is to say no when everybody else wants to go. 01:32:27.330 --> 01:32:29.580 That is really what you are there for. 01:32:29.580 --> 01:32:32.960 Because these guys get tunnel vision. 01:32:32.960 --> 01:32:34.210 They want to go fly. 01:32:34.210 --> 01:32:40.860 The console operators, things are on automatic in that last nine minutes, and they just hope 01:32:40.860 --> 01:32:43.880 they don't get that little red or yellow light on their screen that says hey, you better 01:32:43.880 --> 01:32:46.970 go look at this, it isn't working right. 01:32:46.970 --> 01:32:51.690 The last people you want to ask is it OK to launch is the crew. 01:32:51.690 --> 01:32:54.140 They'll say yes, no matter what is happening. 01:32:54.140 --> 01:32:58.690 And we do ask them, by the way, but it is a formality because we know what the answer 01:32:58.690 --> 01:32:58.940 is. Unless he's got a fire extinguisher up there putting out something in the spacecraft, he 01:33:01.660 --> 01:33:07.450 is going to say we're go. 01:33:07.450 --> 01:33:13.130 And that is also why we put in a rule that says after five minutes, for these critical 01:33:13.130 --> 01:33:18.520 launch commit criteria items, the 500 that you absolutely have to look at and certify, 01:33:18.520 --> 01:33:22.540 you don't proposition us with a change to that after five minutes because we're not 01:33:22.540 --> 01:33:23.300 going to entertain it. 01:33:23.300 --> 01:33:26.710 If they're out of limits we're not going today or tonight. 01:33:26.710 --> 01:33:31.739 It is going to be at least 24 hours. 01:33:31.739 --> 01:33:32.910 A long time. 01:33:32.910 --> 01:33:38.450 But the team that does it, I mean they are good, they are professionals. 01:33:38.450 --> 01:33:43.420 And we talk a lot about the Apollo program and how great things were back then, but I 01:33:43.420 --> 01:33:48.220 just gave you the example of Apollo 13. 01:33:48.220 --> 01:33:55.220 The Shuttle team versus the Apollo team has a much higher degree of difficulty situation 01:33:55.670 --> 01:33:56.400 to deal with. 01:33:56.400 --> 01:34:03.230 There are fewer people on Shuttle, yet it's a more complex vehicle than the whole Apollo 01:34:03.230 --> 01:34:03.480 system. 01:34:03.309 --> 01:34:10.309 The Saturn 5 rocket and the spacecraft were simple compared to the Shuttle system. 01:34:11.450 --> 01:34:18.450 And we had 25,000 people at the Cape in the Apollo program flying two to three times a 01:34:18.660 --> 01:34:20.450 year. 01:34:20.450 --> 01:34:27.450 And in the Shuttle program back in the early '90s we flew seven times a year with 6,000 01:34:28.430 --> 01:34:33.389 people with a vehicle that is more complex, older. 01:34:33.389 --> 01:34:38.090 In the Apollo program our ground equipment was new and all the flight hardware was new. 01:34:38.090 --> 01:34:38.860 It wasn't reused. 01:34:38.860 --> 01:34:43.860 It was fresh out of the box factory pristine stuff. 01:34:43.860 --> 01:34:49.380 And requirements were easy, you know, it had to act and look brand-new or you replaced 01:34:49.380 --> 01:34:50.880 it. 01:34:50.880 --> 01:34:55.800 The Shuttle, because it is 20, 30 years old, depending on which orbiter and the ground 01:34:55.800 --> 01:35:02.800 equipment which is 30 to 40 years old, there are requirements that allow fair wear and 01:35:03.340 --> 01:35:04.989 tear. 01:35:04.989 --> 01:35:09.650 The engineers are constantly pushed with is this good enough? 01:35:09.650 --> 01:35:15.080 These wire bundles are frayed and there are dings in this line and that weld is looking 01:35:15.080 --> 01:35:17.309 like it has corrosion on it, is it good enough? 01:35:17.309 --> 01:35:21.000 Well, they are constantly propositioning where back in the Apollo program you didn't have 01:35:21.000 --> 01:35:23.510 to mess with that gray area stuff. 01:35:23.510 --> 01:35:28.650 It either looked or acted brand-new or you replaced it. 01:35:28.650 --> 01:35:32.809 And replacing it was easy because money was unlimited. 01:35:32.809 --> 01:35:39.809 As a journeyman engineer on Apollo I was told whatever you need you can have. 01:35:39.930 --> 01:35:45.580 System engineers seek more test equipment, you need more technicians to be trained on 01:35:45.580 --> 01:35:48.460 this over here, whatever you need just ask for it. 01:35:48.460 --> 01:35:49.380 Money is not an object. 01:35:49.380 --> 01:35:55.020 As a manager on the Shuttle program when I finally got promoted out of the job I liked 01:35:55.020 --> 01:36:00.160 to launch director, I had to tell the journeymen engineers this is all the money you get for 01:36:00.160 --> 01:36:01.920 next year. 01:36:01.920 --> 01:36:06.180 And be real efficient with this and frugal because next year you're probably going to 01:36:06.180 --> 01:36:08.760 get less. 01:36:08.760 --> 01:36:15.760 And your strategy and approach to issues is much different if you have those two different 01:36:15.800 --> 01:36:18.110 environments to deal with. 01:36:18.110 --> 01:36:23.969 And finally the other thing that Shuttle deals with today versus Apollo is the acceptance 01:36:23.969 --> 01:36:24.780 of risk. 01:36:24.780 --> 01:36:27.219 I mean I already mentioned Apollo 13. 01:36:27.219 --> 01:36:32.020 Back then if you made a mistake you were patted on the back and told hey, nice try. 01:36:32.020 --> 01:36:38.139 Now, is there anything that can be done to better enhance your probability of success? 01:36:38.139 --> 01:36:44.469 Whereas, in the Shuttle program, risk aversion in this country, I don't want to get started 01:36:44.469 --> 01:36:47.040 on that tangent, is becoming more and more a lifestyle. 01:36:47.040 --> 01:36:53.920 We don't want to do things we might lose or we might not win or we may not be successful. 01:36:53.920 --> 01:36:56.610 And risk, you know, there is less tolerance to it. 01:36:56.610 --> 01:37:02.760 And, when you have a problem like Columbia or Challenger, you get half a dozen boarding 01:37:02.760 --> 01:37:07.719 parties coming into NASA saying here is what you need to do differently or this is wrong 01:37:07.719 --> 01:37:11.590 with your agency and this and this and you need to go fix that. 01:37:11.590 --> 01:37:18.590 And, again, back in Apollo, it was what do you need to be successful? 01:37:19.700 --> 01:37:20.510 Much different. 01:37:20.510 --> 01:37:23.210 And it makes it difficult to operate. 01:37:23.210 --> 01:37:30.210 Bob, could you comment upon risk aversion and the launch director and whether there 01:37:30.290 --> 01:37:36.340 were more aggressive and more conservative people who have had your job? 01:37:36.340 --> 01:37:43.340 Well, I would say, before I was launch director, there was one. 01:37:45.719 --> 01:37:49.540 And he was more aggressive than I was. 01:37:49.540 --> 01:37:52.040 He was the console MANOPS person. 01:37:52.040 --> 01:37:57.739 And he would push, and he would push until you would say uncle, I surrender or whatever, 01:37:57.739 --> 01:38:01.760 and then he would make a judgment call. 01:38:01.760 --> 01:38:07.370 I was more conservative than that. 01:38:07.370 --> 01:38:12.950 I trained the one immediately after me. 01:38:12.950 --> 01:38:19.200 And he was pretty much the same but he got the highly visible job, management say that 01:38:19.200 --> 01:38:25.489 this guy was good, we'll take him away from here and go put him over here managing this 01:38:25.489 --> 01:38:27.940 large organization and worrying about budgets and contracts. 01:38:27.940 --> 01:38:30.880 That is the same thing that happened to me. 01:38:30.880 --> 01:38:37.880 And that's unfortunate, but NASA's strongest suit is not succession planning, unfortunately. 01:38:40.130 --> 01:38:40.510 It just isn't. 01:38:40.510 --> 01:38:40.760 Yes? 01:38:40.620 --> 01:38:47.620 Are you saying the Shuttle program is too risk averse? 01:38:49.090 --> 01:38:52.780 Because you also said that, for example, it is your job as launch director to be conservative 01:38:52.780 --> 01:38:57.050 and to say no when everyone else is saying yes. 01:38:57.050 --> 01:39:00.360 No, I wouldn't say that the Shuttle program is risk adverse. 01:39:00.360 --> 01:39:04.400 I would say our society is risk adverse. 01:39:04.400 --> 01:39:11.400 And you see some of that permeating into the Shuttle program, but not to the point where 01:39:13.690 --> 01:39:16.070 I would say it is detrimental. 01:39:16.070 --> 01:39:23.070 I mean asking questions, digging in to understand what your risks are is an important thing 01:39:25.070 --> 01:39:25.430 to do. 01:39:25.430 --> 01:39:27.660 And early in the Shuttle program we didn't do that. 01:39:27.660 --> 01:39:31.239 We had a lot of confidence in hardware after the first few missions. 01:39:31.239 --> 01:39:32.500 It's just like a new car. 01:39:32.500 --> 01:39:37.650 You put 5000 miles on it, you get the bugs out of it and you fully expect it to last 01:39:37.650 --> 01:39:40.530 another so many hundred thousand miles. 01:39:40.530 --> 01:39:43.750 Well, that was the same expectation in the Shuttle program. 01:39:43.750 --> 01:39:50.460 You fly a few flights and you learn that the tiles really stayed glued to the Orbiter and 01:39:50.460 --> 01:39:55.969 the thermal control system really responds as it should on orbit and managing the temperature 01:39:55.969 --> 01:39:57.650 and the coolant leaks and that sort of thing. 01:39:57.650 --> 01:40:03.020 And you build up confidence and you say it should work now. 01:40:03.020 --> 01:40:06.930 We got the bugs out of it and we can go fly this thing as often as those guys at the Cape 01:40:06.930 --> 01:40:09.820 can turn it around. 01:40:09.820 --> 01:40:15.130 But what they didn't consider and what all these engineers, with all due respect that 01:40:15.130 --> 01:40:20.930 you heard from that certify their systems, they didn't totally capture the environment 01:40:20.930 --> 01:40:26.910 that the Shuttle sees over the long period of time in their initial certification. 01:40:26.910 --> 01:40:28.250 They didn't capture it. 01:40:28.250 --> 01:40:33.780 And that environment includes not only what happens in space or the calendar exposure 01:40:33.780 --> 01:40:38.050 to just time on some of these systems that have soft goods in them, for instance, O rings 01:40:38.050 --> 01:40:43.160 and that sort of thing, but it is the environment of the Cape with people constantly removing 01:40:43.160 --> 01:40:47.780 hardware, disconnecting things, moving wire bundles out of the way to get access to this 01:40:47.780 --> 01:40:53.639 or that other component to implement the requirements that were levied on the Cape to do the tests 01:40:53.639 --> 01:40:55.090 and inspections. 01:40:55.090 --> 01:41:00.150 And they are very invasive, and collateral damage is a way of life when you're crawling 01:41:00.150 --> 01:41:04.410 around in the Orbiter. 01:41:04.410 --> 01:41:11.139 To put in policy that tries to compensate for the fact that the certification didn't 01:41:11.139 --> 01:41:18.139 capture that environment that this hardware has seen for the last 20 to 30 years, to reduce 01:41:18.460 --> 01:41:24.469 the unknowns involved in that, that is the right thing to do. 01:41:24.469 --> 01:41:30.580 You're trying to reduce the risk of reflying a very complex vehicle. 01:41:30.580 --> 01:41:35.280 So that is fine, but you take that to a limit. 01:41:35.280 --> 01:41:41.239 I mean you can talk yourself into never flying which would be pretty easy to go do. 01:41:41.239 --> 01:41:48.239 And then this recovery after the Columbia accident, that was starting to happen. 01:41:49.660 --> 01:41:56.660 The managers, because they had this investigation board report that says NASA, you've become 01:41:59.050 --> 01:42:00.050 complacent and overconfident. 01:42:00.050 --> 01:42:05.210 And, by the way, in my opinion that is somewhat of a bum rap to say that NASA in general, 01:42:05.210 --> 01:42:08.489 and particularly the Shuttle program, had fallen into that mode. 01:42:08.489 --> 01:42:13.320 But, to have the pendulum swing the other way to understand what your risks are and 01:42:13.320 --> 01:42:19.920 then you can have knowledge on whether you decide to accept it or not, that is a good 01:42:19.920 --> 01:42:20.860 thing. 01:42:20.860 --> 01:42:25.820 What didn't happen after Columbia, but we did do after Challenger, is after we understood 01:42:25.820 --> 01:42:29.710 the root cause of the accident and some of the other factors like communication that 01:42:29.710 --> 01:42:36.270 we're part of that, reviewed all the systems and all the requirements, the managers said 01:42:36.270 --> 01:42:38.889 look, we're willing to accept some risk. 01:42:38.889 --> 01:42:45.130 You people who are responsible for these systems and these processes at the Cape, you need 01:42:45.130 --> 01:42:48.550 to quantify that for us and bring it to us. 01:42:48.550 --> 01:42:53.440 And we will either say OK, we won't accept that, you go back and change your system or 01:42:53.440 --> 01:42:57.550 change your limits or do more tests or whatever, or we will accept it. 01:42:57.550 --> 01:43:01.770 We will say we'll accept that risk, management will accept some risk. 01:43:01.770 --> 01:43:08.770 That happened after Challenger, and we were able to fly again roughly two years later 01:43:09.680 --> 01:43:13.070 after we recertified the design to the solid rocket motors. 01:43:13.070 --> 01:43:16.880 That didn't happen after Columbia. 01:43:16.880 --> 01:43:23.570 And you can speculate whether or not we could have flown six months ago or a year ago or 01:43:23.570 --> 01:43:26.739 we should have waited longer to fly because we still had a piece of foam come off the 01:43:26.739 --> 01:43:28.530 tank. 01:43:28.530 --> 01:43:29.739 You could debate that. 01:43:29.739 --> 01:43:36.739 But management never acknowledged that they were willing to accept some risk after Columbia. 01:43:37.300 --> 01:43:43.820 They did say tell us what the risk is but we really want you to crank it down to zero. 01:43:43.820 --> 01:43:48.739 We don't want to take any risk, unlike Challenger. 01:43:48.739 --> 01:43:53.410 Now, is that bad? 01:43:53.410 --> 01:44:00.410 See, what really happened with Columbia was the mission management team's discipline had 01:44:01.800 --> 01:44:02.200 eroded. 01:44:02.200 --> 01:44:03.930 There were communication issues. 01:44:03.930 --> 01:44:10.930 And, if you're a student of that investigation, they didn't grade out very well. 01:44:13.250 --> 01:44:19.780 But the investigation said there is complacency and overconfidence in the system. 01:44:19.780 --> 01:44:26.090 Well, having been part of the system prior to my retirement five years ago, you never 01:44:26.090 --> 01:44:31.590 found any complacency or overconfidence with the engineers, technicians, inspectors or 01:44:31.590 --> 01:44:32.730 the managers that I knew. 01:44:32.730 --> 01:44:38.820 Now, they weren't as smart as they thought they were or, in some cases, as smart as they 01:44:38.820 --> 01:44:40.739 needed to be. 01:44:40.739 --> 01:44:44.520 But that is not the same as complacency or overconfidence. 01:44:44.520 --> 01:44:50.200 Because the latter to me implies an attitude problem that I've got it, I know it all, I 01:44:50.200 --> 01:44:52.850 am smart as I need to be. 01:44:52.850 --> 01:44:57.420 And, for the most part, you know, there were some people I didn't like because I thought 01:44:57.420 --> 01:45:02.520 he or she was arrogant or something like that, but I never sensed an attitude problem with 01:45:02.520 --> 01:45:03.590 the Shuttle team. 01:45:03.590 --> 01:45:10.090 From the technicians, many of which I knew and grew up with, to the top managers in the 01:45:10.090 --> 01:45:13.050 Shuttle program, I never sensed that. 01:45:13.050 --> 01:45:17.639 But were we not as smart as we thought we were or as smart as we needed to be? 01:45:17.639 --> 01:45:24.600 Were there signs that there was something going on here that you ought to go fix? 01:45:24.600 --> 01:45:26.510 Yes. 01:45:26.510 --> 01:45:33.510 But, again, they didn't just blow off, so to speak, these problems we were having with 01:45:35.760 --> 01:45:42.760 foam on the tank and these other systems which, to me, would have been complacency or overconfidence. 01:45:42.760 --> 01:45:45.340 Anything else? 01:45:45.340 --> 01:45:50.739 We're just about out of time. 01:45:50.739 --> 01:45:55.520 I've got two announcements. 01:45:55.520 --> 01:45:57.630 I've been working with the Stellar people. 01:45:57.630 --> 01:46:03.410 As you know, some of the pdf files that I've tried to load didn't load. 01:46:03.410 --> 01:46:08.639 They cannot really figure out why, but I have sent them the files, they've loaded most of 01:46:08.639 --> 01:46:11.930 them on so hopefully almost everything is there. 01:46:11.930 --> 01:46:18.430 We're continuing to work at it, but hopefully all the things that you need access to you 01:46:18.430 --> 01:46:20.910 can find. 01:46:20.910 --> 01:46:26.210 I said there were two things, but that's the only one I remember. 01:46:26.210 --> 01:46:30.410 Well, let me close with one note then. 01:46:30.410 --> 01:46:32.550 I am glad you're here. 01:46:32.550 --> 01:46:39.550 Thanks for your choice to pursue an engineering career. 01:46:40.610 --> 01:46:46.730 Doing things that are hard, I have found that in my travels that unfortunately there are 01:46:46.730 --> 01:46:53.139 fewer people deciding to pursue the tough curriculums and the occupations that require 01:46:53.139 --> 01:46:58.570 a lot of work and have some risk associated with them. 01:46:58.570 --> 01:47:05.570 But it is encouraging to see people in graduate school that want to do what I did. 01:47:07.330 --> 01:47:10.580 I am not sure how much engineering I did in my 40 year career. 01:47:10.580 --> 01:47:17.580 I did a lot of managing and a lot of other assignments, but I am sure you can accomplish 01:47:17.850 --> 01:47:18.480 a lot. 01:47:18.480 --> 01:47:25.480 I had a grandmother who was born at the end of the 19th century. 01:47:26.850 --> 01:47:33.850 And, when she was your age, there weren't any computers, airplanes, cars, TV and that 01:47:36.930 --> 01:47:37.830 sort of thing. 01:47:37.830 --> 01:47:44.830 Yet, in her lifetime, she got to see her favorite grandson, Bobby, help put a man on the moon. 01:47:44.960 --> 01:47:51.960 And I don't know what can be done in your lifetime, but you can make great things happen 01:47:52.650 --> 01:47:54.489 with the career you have chosen. 01:47:54.489 --> 01:47:57.250 So thanks for choosing, really. 01:47:57.250 --> 01:48:00.050 Bob, thanks very much. 01:48:00.050 --> 01:48:01.450 A pleasure. 01:48:01.450 --> 01:48:02.139 [APPLAUSE]