I
;
I
I
SAFETY OF THE THERMAL PROTECTION SYSTEM
OF THE SPACE SHU'i'rLE ORBr:IER:
I
QUANTITATIVE ANALYSIS AND ORGANI:7ATIONAL FACTORS
I
:
I
i
I
Phase 1
RISK-BASED PRIORITY SCALE
AN D PR ELIMINARY OBSERVATIONS
•
:h
I
by
"/
,
M. Elisabeth Pate-Cornell
Department of Industrial Engineering _nd Engineering Management
Stanford University
"
..
and
Paul s. Fischbeck
Departmentof Engineeringand Public Po icy
and Department of Decision Sciences
Carnegie.Mellon
University
REPORT TO
THE NATIONAL AERONAUTICS AND SPACE ADMINISTRATION
Cooperative
Research Agreement No. NCC 10-0001
between Stanlord University and NASA-(Kennedy Space Center)
December, 1990
.:... ,-.
.
.....,..-.-
.....
::,i"' :.-S'-,._.
L
I
i
.
j
I'
t
'SAFETY OF THE THERMAL PROTECTION SYSTEM
I
OF THE SPACE SHUTTLE ORBITER:
t
QUANTITATIVE ANALYSIS AND,ORGANIZATIONAL FACTORS
'
Phase
t
1"-'
,
i
RISK-BASED PRIORITY SCALE
AND PRELIMINARY OBSERVATIONS
,
M. El[sabeth
Pat_-Cornell"
I
Department of Inclustdal Engineen.'ng,andEngfneering Management
Stanford'University
and
'.
i
•
I
Paul S,.Fischbeck'*
i
Department of Engineering .and Public Policy
and Department of Decision Sciences'
'Carnegie-Mellon University
,'
REPORTTO THE NATIONAL AERONAUTICS AND SPACE ADMINISTRATION
Cooperative Research Agreement No. NCC 10-0001
'
between Stanford University and NASA (Kennedy Space Center)
" Associate Professor
"" Assistant Professor, Commander USNR. Formerly: Graduate Research Assistant,
[_iepartment of Industrial Engineering and Engineering Management,
Stanfotd .Uhiversity.
.
"_'
"
.
"::
.
.
.
, C'_'J
......:
-!" ':.
."
_',_'OT
""
-
".
.
cnnz
C
n84
.
•
.:" •.,
. •
. .
H/n¢c_:¢ZNZ:Xe4
::
..
.:
........
,
-
"....
_.:.:
U.l£J6OJ,4
,
, .::,: :
...,:.,..-,.;. ........
,..:-
. :.....
.._..
NT[IN
H,RHN
.,
..
,.
,.
.::._.'
'
Pat_-CornellandFischbeck
I
¢
TABLE OF C@NTENT
I
!j'
i
I
i
i
I
i
"
I
Page
t
SIJM'MARY
6
'
i
Section
1:
INTRODUCTION
_
7
]
i
}
'
1.1
Objectives of the overall project
' 1.2
Scope of the work tn Phase 1
1.3
Section
,
9
'
13
Gathering o_igformation and technicat points of contact
1'4
2:
BACKGROUND INFORMATION
16
2.1
System description
2.2
,
Life cycle and maintenance
::
2.3
, . ,.._ :
_
operations
, '*
: ;_. ':._
,_' -.
.,'-...:
2.2.1
Tile manufacturing
2.2.2
Flight profile loading
22.3
Tile maintenance procedures
21
.
and inst_Tlation
21
.24
Failure history: .incident recording and data bases
26
2.3.1
FaiJure history and iocident recordiDg
26
2.3.2
Data bases
_' _: _,
•
_
-;
•
'
...
-
.
,
37
j
DESCRIPTION OF THE PRA MODEL _=ORTHE TILES
39
3.f
Susceptibility
39
3.2
Definition of min-zones
43
3.2.1
Debris classification
44
3.2.2
Burn-thr0ugh
47
3.2.3
Secondary tile Ioss cass fcation
3.2.4
Funct!0nal criticality classification
3.2.5
Deb0nding due to factors other than debris impact
•
and vutnerab!/[ty
classification
49
.
51
51
3.3
PRA model: definition of variables
57
3.4
Initiating event: initial debris impact on one tile only (D=I)
58
3.5
Initiating event: initial debris impact on several tiles (D=d)
61
"•
,
22
. ,
S_:clion 3:
16
"
.. :;-.
-
_,,.
. "
:,i.
$O
600C8S£_0_
6S:_7 _0, SO _B_
I*
i
Pat_-Cornell and F_chbeck
i
I
,
3.6
3.7
Page
Initiatir_gevent: debon_ing,due iq _actorsother than debris
Additional information and data -
63=
64
.'
_"
72
r
I
Section 4:
ILLUSTRATIONOF THE MODEL.,
, I
I
Section 5:
1 t
I
,
I
I
EFFECTS OF ORGANIZATIONAL FACTORS ON TPS
80
5.1
BELIABiLITY: M_IN PRELIMINARYONSERVATIONS
'
Errors'and risks
'
80
5.2
Preliminary observations
82
',
5.2.1
Time pressures
82
5.2.2
Liability concerns and corlflicts among contractors
83
5.2.3
Turnoveramong t}le tec'hnicians and i0w status
I
'1
of tile work
84
5.2.4
5.2.5
Need for more randomtesting ',
Contributionof the management of the ET
and the SRBs to TPSreliability
85
86
Bection 6:
CONCLUSIONS
87
,Section 7:
REFERENCES
89
'k
,t_.
"_.
/
,:.ectton 8:
8.1
APPENDICES
Appendix 1: OrganizationalExtension of PRA Models
And NASA Application(M. E. Patd-C0rnetl, PSA'89)
8.2
Appendix 2: Data bases tor tile performance
A-1
A-11
2
_',
_._T
pnnz c
n=_
JnncRccznz:xe_
weJ6oJN NT_NHSHN
_
Pat_-Cornell
,
FIGURES
• tj
I
Fi:._ure 1
i 2:
Fi::jure
'
and Fischbeck
The Space Shuttle O.rbiter
J
-Page
,
1.7
_,for
The thermal protection
system (TPS)
" :
"
"
18
;
I
I
OV 103 (Discovery) add OV 104 (Atlantis) ..
F[_;ure 3:
The black tiles (all vehicles)
-'
.:
_,
t
.20
Fi!;ure
4:
'
The tile system
Fi!;!ure 5:
Histogram of tile damage due to debMs
:31
Fi!;]ure 6:
Accumulated major debris hits (lower surface).
33
:
for flights
STS-6 through 'STS-32R
,
,
)
I
Fi..3ure7:
•
Fi!;rure 8:
•'
-=.
The
tile..system
problems .,_,• ' .."
;...•
._
..
.. and
• .
, bond
,. ,
Event diag'ram: fairure of the TPS leading
21
:_:.
.
,: .
34
.
41
to LOV
Fi!;ur_ 9:
Event tree of LOV due to TPS failure
Figure 10:
Partition of the orbiter's surface into three types
L
42
45
of debris zones (index: h)
Fi_.;ure11 :
Partition of the orbiter's surface into three types
48
of burn-through zones (index: k)
Figure 12:
Partition of the orbiter's surface into two types
50
of secondary tile loss zones (index: I)
Figure 13: •
Components and systems location
52
Fqure 14:
Hydraulic system components and line locations
53
Fi!;ure 15:
Partition of the orbiters surface into three types
54
of zones of functional criticality (index: j)
Fit_ure 16:
Pour major debond problem types
56
Fi_;ure 17:
Tile workmanship errors
65
Fi!=_ure18:
Ascent debris trajectory simulation (side view)
67
Fi!_"lure19:
Ascent debris trajectory simulation (plan view)
68
Fi.:lure 20:
Thermal measurements of the orbiter's surface
69
(bottom view)
'
NRSR
ODIN ProBram
I,I
Fax:2O_6b_6UUr
r_u
_ zuuJ
_j._j
....
%
f
.
't
I ,
I
I
J
6L.
eOeLuepSclJ.;o sadk_qloq ol enp k01 ;o Hsua^!lelaEI
i
'
',
'
eSemep Sd.L
'.9_ aJnS!=!
I
:_8" 8JnB{:l
SdJ. Pa_e{l!u.l-siJqeP
ol anp AO1 _o:_{J aABeleU
J
eL
:£_ 8Jn8!.4
adX_-BU!puoqep
o;.enp AOq ;o>191!
8^!lelaU
,
,,
eS_we#
6L
r
i
i
I
I
.¢
8L
(! :xopu/)
'
sauoz-u!tu _ olu!,.eoej4nss,Jel!qaoaql 1ouo/lt_ecl
:0_ oJnS!:l
I
l.L
,
..
&!A_O elJl lsol !o s!_)(18u_.l_uJJ@ql/_lus-_EI
I.
:;_
@JnS!-i
. (MaJAWOJJOq)
eoe#n_ s#e;!cpoaq} uo
i
.
J
,
0L
sbJnssaJd'p'ueseJnieJa.dwe;to slueLueJns_alAl
,
:_ eJnS!-!
e8_d
>ls_qqos!..-Ipue llaU_oO-gle¢l
*2
?
._ 81_"3£Ud
L08¢'8S¢'_0_
8£:8; £8, £8 _39
I
Pai_-Cornell and Fischbeck
i
I
t
]
TABLES
'
'
t
i
I
•
Page :
T,_ble 1:
Sum,mary of orbiter flights
and debris damage
I
T;_bte 2:
Probabilities Of debris hits'in different
areas
it
•
-
30
,
shown in Figure "iO
t ,
,
,
I
Probabilities of tile loss due to debris in
T_.ble 3:
differentareas
T_ible 4:
sl_bwn in Figure 10
4,7
'
Probabilities of burn-through due to tile loss in
in areas shown in Figure,11
T:_ble 5:
46
)
',
47
,
Probabilities of losing adjacent tiles due to initial
4§
t;le loss in areas shown in l=igure 12
'.'
I
T_bte 6:
Probability of LOV conditibnal on burn4hrough
1
in
51
functional criticality areas shQWn in Figure 15
T_ble
7:
Structure of the.indices of the min-zones shown
in
i
Figure 22 an d Table 8
Table 8:
72
J
Identification ot min-zones and •their contribution
7,4
{
to the probability of LOV
Table" 9:
Probabilities
of Loss of Vehicle.due
to tile failure
initiated (1) I_y debris damage and (2) debonding
76
caused
by factors other than debds, for each rain-zone,
and each tile n each rain-zone
Table
•:
'
.
10:
Risk-criticality factor for each tile in each min-zone
:"
....
"
.
"
.....
•
.. •._
77
.
• .'..=
i. :.:.i_........
,
.. ,.;-.
.% ...
,
•"
.
,
'
Pat6-Cornell and Fischbeck
SUMMARY
t
'
] i
This report describes the' first phase of a study designed to i.mprove the
I
management and the safety of the black tiles of the 'Space Shuttle orbiter. This study
,
is based on the coup}ing of a probabitistic risk assessment (PRA) model and retevant
i
.
,
I
organtzataonalfactors.
In this first-phase report, a first-order P,RA modet is developed,
I
and used to design a Msk-based criticality scale combining _theprobat_il{ties and the
• consequen£es of tire failures. This scale can then be' Used to set priorities for the
maintenance and gradual replacement of the black tiles.
A risk-criticality index is assessed for each tire,based on its contribution to the
probability of loss of the vehicle. This index reflects the loads to which each tile' is
subjected
(heat,
vibrations, debris impacts etc.) and the dependencies among
failures of adjacent tiles. It also includes the potential decrease of tile capacity,
caused by imperfect processing (e.g., a weak bond), and the criticality of subsystems
exposed to extreme heat loads at re-entry in case of tile failure and burn-through.
Using this model and some preliminary data, it is found that the (mean) probability of
loss of an orbiter due to failure of the black tiles is in the order of 10"8
per flight, with
i
about 15% of the tiles accounting for 80% of the risk. One of the re'port's key findings
is that not all the most risk-critical tiles are in the hottest areas of the orbiter's surface;
scme are in zones of highest functional criticaJity(see Figure 23).
Management factors that can affect tile safety are identified as: (1) time
pr,-_ssuresthat increase the probability of cutting corners in processing;(2)
liability
concerns and conflicts among contractors, which affect the flow of information; (3) the
low status of the tile work and the turnover among t(le technicians, which may
increase the work load and decrease its quality; (4) the need for more random testing
to detect imperfect bonds and to monitor the evolution of the system over time; and
(511
the handling o! the external tank and the solid rocket booster-_ whose insuTations
constitute a major source of the debris that could hit the tiles at take-off.
•
6
_-,-..,
r_.rT
onn7 c
n_,
: ::,_:i::
,_nnc4ccznz:x:e-j
....
"
i,; /
Itl'eJ6OJ_NI(]Ot;ISUN
,
'
X_!lenb pue eJ_o wnw!xaw
'aJnl!_,
;o/(1!l!qeqoJd
aql az!wlu!w ols_ os IOJ_.[JO0
eA]aoaJ Selll leo!1!Jo41_!_SSOLUa41 1_ql 6u!Jnsue sp_ol
s,Je;]qJo aql _o aJnl{et
"Sal!; a4_ _o uo!Io_J_ IleW8 e o_ pelnq!J_4_eq ueo 8cll
aq s/[et_ie II!t_ eJ¢,tll
dais leo[l!J_ lsJ!_ e s! se!l!Jo!._d 8u/wo_ 'SlU!eJ;suoo aamosaJ
asn_oa8
ol enp (AO7) alo!qe^ to SSOl_o/[l!l!qeqoJd eql to a6eluaoJad a6Jei V "aoegns s_attqJo
eq_ uo suo]_eOOl J!eql ol 6u!pJoooe /[laPp^/ue^
(.F_41eo!_,!Jo-_ls!_.
se eJa4 pau!ji_p)
aJnl!e; _o _llllqeqoJd II_Ja^o a41 ol Sal!l _uaJ.atfipto suo!mq[J;uoo
a4]
Ie41 s_o48
uoda_ slq TL-"OiLIdoJ;se;eO
aq PlnO0 al!_ el6U!S e 1o ss01 aq_,"sea_e Jaq_o U!_._..a_.3
eql 1o
$a^!l eq_,6upIs!" Jo e@ewep Jo[ew 6u]sneo mo4;!_ ISOl aq plnoo s8111leJaAaS 'eoe,un8
sje_,!qJ0 841 _0.seaJe ewos Ja^O .aOephs s#al!qJ0aq_ uo uo!leOOl_!eql ol 8U!pJ6oi_'
sape^ Sal!; Ia4 _,1o e0uepodw!
aq_L 'alnpaqos 6_uipuewep. _4;. ,(q paloa_;_ ,{lleU"o!s_o')o"'
"
s!./_l!lenb s!! '_JoM eli1 eqlo_pel_o]pep
si uo!lue#e, lee_6 q6noq11v_ "s_u_e_sU0oaw_l
aJe^as saw!;awos
_
' ]apun 8uop 8q.0_, 88q. _Jo_Aaql 'qoun81 bxau aql o1.q_,edleO!;!.13
• •
,
,.
au.._uo ue_o 8! 1.!8_n_oeq 'pub Bu!wnsuoo ew!_.oue 8^_£Ua_u__oqel 8! 8_u.6!l,_
uae_t._,q
,
.
.,
.
sel!l e4_, _o 6u!ssaooJd
841
;o aldwexa: ue s! (Sal)
aqI
"s.Uo[;el!W!l asaq; 4;pA uo>loaJ ;SnUJ _e4; sub_;e_bco
wa;sX£
uo!1o'e'_oJ_l
lewJaqJ_ sJel!q_o
e41i6 aoueueluir_
I
"o;a 'uo!_,ua_,18sluawa6eUeW,
pus 4euuos_ad 'saoJnose_
U_Lun4 '_aue_#
'ew!l :slu!eJ;suoo aoJnosaJ 146i; Jepun WeJa0Jd Ja;!qJ(_ al_4nqs aoeds e4; ;o moads_
/_UeLUsa6euew
(VSVN)'uo!leJ;s!u!wpv
i
I
aoed£ pue so!;neuo_av leUO!_eN'a41
i
. I
I
4
i
I
,
'
i
N
I
OIIOllC[O
I
I
IdlN
I
! '
uoi oas
I
,
I
: I. eseqcl
_
i
i
SJOlOe_-I
leUO!lez!ueO._O p(Je s!S,_leu,V aA!lel!luepo
:Jal!qlo
alllnqs
aoeds
a41 1o wels/[s
uo!loa_oJcl
lewJaq±'
a41 to _la_e8
I
}
_l_qqos!_-I
pus IlaWOO-.e;ed
t
'
P_t(_-Cornelland Fischbeck
'_
I
I
'=
The level of risk-criticality of a tile depends on several factors and not,
exclusively 0n the maximum heat load (temperature and, cluration) to which it is
,_
subjected. These factors include: (1t the heat loads, (2) the location of lhe tile with
,
respect to possible
trajectories of debris (e:g., pieces of insulation from the external
,}
tr:_nk(ET) and the solid rocket booster,s (SRBs)), (3) the vibr_.tiohs and aerodynamic'
forces, and (4) the criticality of the subsystems located directly under the alominum
_ldn of the orbiter. Failure of a sing)e tile located directly ove_"one of th_ most critical
s_/stems (such as the avionics, fuel cells, or hydraulic line._)is likely to cause a LOV
even though these tiles are not exposed to the maximum heat loads. By contrast,
_.
severe tile damage nexl to the edge of a wing has been survived in past missions. '
Therefore, the loads and consequence factors must be combined to estimate the
probability of failure and to determine the risk-criticalltyof each tile.
,
._.
=
A tile falls because the loads on it reach values that exceed its capacity,
J
LJnd,erstandingboth factors, loadsand capacities, is thus critical to the quantification
of the risk associated with the "rPS. The capacities vary considerably among
("
ind.ividualtiles because of differences in installationconditionsand procedures. For
example, inspectionshave shownthat Severaltiles have been installed with bonding
on 10% only of the contact surfaoe. In addition, the capacities of' some tiles have
decreased over time because of chemical reactions of the bond with some of the
. ,(.
water proofing agents used on the orbiter. Similarly, the loads on the tiles= are. not
uniform. In addition to expected loadsof heat, vibrations,and aerodynamic forces, a
tile may also be subjected to unexpected loads caused by debris impacts. The
f
"
source of most of the debris is poorly-installed and maintained insulation on the E.T
and the SRBs. Therefore, both loads a.nd capacities can be greatly affected by a
variety of possible human errors.
'.
Some of these errors can be traced
baok to weak organizational
communications, misguided incentives, and resource constraints, which in turn, can
.o
I_elinked to the rules, the structures, and the culture of the organization (Pat_-Cornell
8
TT'A
O_-CT cnnz c
aa4
L
)mcRqczNE:X_
w_J6OJ_ NI_D HSbN
"
_ : ':;:
6S:ET EO, $0 E[3_
i
Pat_-Oernell and Fischbeck
I
i
ard Bea 1989; Pat_-Cornell, 1990). Efficiency of the risk management process for
the TPS require s 'a.n integrated approach (National Research Council, 1988:).
C(>ns!deringonly organiza_tion.atsolutions 'or 0nly technTcalsotutions to minimize the:
risR of failure would be Counterproductive and wasteful. Furthermore, each individual
I
•
"•
j
s.ystem cent';or be evaluated•and managed
independently.
The perfqrmance of i the
"
j)
,
,
I
.
E-r and SRBs affects the reliab(]ity of the tJles.wMch, in turn, affects the performance
i
t
I
I
i
of., the subsystems that they
protect
from heat loads. Therefore, w_en setting
•
,
,
priorities,....,
the management.
• teams for the._.ET,
and SRBS must account for tlTepotential
detr}mental side effects of their proce6rures on the orbfter's TPS, By tracing back,
ev8n.FougMy, the Iocati0n 0f the insuJation on the ET.andi SR.Bsthat could hit the
most risk-critical spots on the orbiter's surface, it may be possible to identify the s'pots
_tb_ltshould be given top priority.
'
',
.I
_.'.
i
__tj1;Objectives'of
the overall otoiect
,_ '
The objective of this study is to provide recommendations to improve the tiles
I
mELnagementat Kennedy space Center (KSC),..Flori_a,
based on the development
I
an!_ extension of a ProbabI[istic Risk Analysis model (PRA) for.the TPS of,the Space
Shuttle Orbiter with emphasis on 'the black tiles. The approach is to incllude
in the
I
an_lysis not only technical aspects
that are captured by classical PRA (for example,
1
.re_i.stanceof the tiles to debris i.mpa_), but also the process of tile maintenance (for
Instance, when and how are the tiles tested) and the organizational procedures and
rul,es that determine this process (see Appendix 1: Pat_-Cornell, 1989.) The question
is _ybetherthese organizational factors affect the reliability of the tiles, and if they do,
to what extent.
Linking the PRA inputs to some aspects of the process, and the
'
or¢lanization
allows addressing
the often-raised question
that PRA, although it
,. _..
,
.
.
captures human errors, is of little help when considering • more fundamental
m_inagerial and organizat!0nal,
problems. This
model
is designed
to allow
m8.nagement to set priorities in the allocation of limited resources in a continuous
eff,_rt to improve the reiiability of the Space Shuttle. The method thus allows for a
global approach to risk management, involving technical as well as organizational
•
,.
••
.
"
•,
•
,, ,,
9
. ,
.'
•.
,
• •
.
.
••'•
,-,•.
._'._..'
"
.
"..,•
.
'
J
T
'
,
Pat_-Corneil
andFischbeck
{
m_provemenis while accounting for the uncertainties about the system's properties,
and human performance. In Cases where the problem is sufficiently well defined,
,_
one can then assess (even If only (:o'arsely)the corre_pondng increase of reliability.
{
=
I
Uncertainties about the performance of a complex syste,m'such as the TP8 of
the
Space Shuttle can be first described by its probabiliiy of failure (firSt-level ,
I
Uncertaihties).
,_
I
When computing this probability, one faces'uncertainties about the
probabi{ities,of the basic events including technical failu'resLof individual components
and human errors. These uncertainties can be described by placing probability
distributions on the inputs, then computing the resultir_guncertainty of the overall '
f_.ilure probability (second-level uncertainties). The role and importance of these
second-level uncertainties depend on the intended use of the study. PRA can
ge'neraliy support two types of decisions: (1) whether or not a system is safe enough
..
for operation on the basis of a chosen safety threshold or other acceptance criteria,
aqd (21 (the main objective of this study) how to allot.ate scarce resources among
different subsystems on the basis of risk-based priorities in order to achieve
max/mum Overallsafety. The depth of the supporting dsk analysis must be adapted
to the decislonto be made,
In the first type of decision, where one is trying to decide if a system is safe
enough, it is important to describe the result of the risk assessment not only by a
p_int estimate of the failure pL'obability but by a full distribution of this probability
..
reflecting all the unoertalnties of the input values. Second-order uncertainties, which
are particularly critical for repeated operations, become important because they give
the decision makers an indication of the accuracy of the analysis. A different launch
alternative may be preferred if, for example, the mean probability of miss{on failure is
less than one in a thousand but can take values as high as one In fifty.
'
Note
however that the overall failure probability per operation is the mean of that•
distribution,
r.
10
eT'_
q#:¢[ 9nnz q Qo4
t
LOO£SS£COC:X£_
meJ6°Jd
NIGOUS_N
,
Pat_,-Corne]l
and Flschbeck
i
in the second type of decision,
I
Where the objective is .an optimal allocation
of'
I
resources, the priority ranking has to be based on a single poini estimafe for the
probability of failure.
For optimality reasons,
I
pr()babllity
is " t_qe relevant characteristic.
•
relative values of the probabilities
•component,
l
and second,
the mean of the dist_bution
of the failure
In this case, criticalI factors are, first, the
of mi,ssion fatlure associated with failure of each
the variations of these relative probabilities
..
J
, units Of resources
i
(e.g., .t!me}:
I
The combination
giving priori:ty to the components
with additional '
'1
I
of the,se two factors
for which more resou[ces
then
allows
wiil bring the greatest
, increase of safety.
In this study, we construct
first apriority
sca!e ' for the black tiles based'on
our
current estimates of the means of the partial failure probabilities, i.e, the me_-n
pr:_bability of LOV associated
with the potential
failure of each
tile (first-order
PRA}.
A!_ analysis of the second-order Uncertainties may, change the priorities if they.
change
the means
of these
partial failure probabilities.
versus main engines), the uncertainty
because
the failure modes..in_,olve
are. known
with different
uncertainties
may well
change
subsystem_
of the failure probabilities
.a spectrum
degrees
Across
of basic events
of uncertainty.
' orbiter'._
of
surface.
whose
probabilities
In this case, full analysis
of
!
resource
:i
such as the tiles, the inputs of the analysis for
i
the different elements (e.g., the initiating events) are generally
ex1:reme values
may vary widely
the means them_selves and the optimal
:.:allofiation. Wi_thin a given subsystem,
the variations of uncertainties
(e.g., tiles
of similar nature and
may be less important. Yet, uncertainties about
.!
the heat loads clearly vary •according to the location of a tile on the
_
t
uncertainties) of the subsystems. located" directly under the skin given a loss of tile(s)
_
i
and burn-through vary widely.
'
i
second-order
Furthermore,
the probabilities
of failure • (and
' '
associated
•
Further study should therefore investigate the effect of
uncertainties to determine their impact on the resource allocation.
Our work on this problem
.ph_=.se,which ispresented
is divided into two separate
in this report, involves the development
•phases.
,_
The first
and illustration of
•
-...:..
:.
.:t...."_" 1 1
:,.
":." ''•.i•
: ..":..'i
'
"
.:.
.•
.'
,.
Pai_-Cornell
andFischbeck
I
a first-order PRA model for the black tiles of the TPS based 'on 'a probabilistic
analysis of different failure scenarlo._,In this an_-lysis,we use mean probabilities to
_"
construct a risk-criticality estimate fcr each tile and to establish a scale of priorities for
management purposes. Key features of this model are the dependencies of failures
among adjacent tiles, and between failures of tiles in specific TPS zones and failures
of the subsystems locatedin ihese zones,under the orbiter's aluminum skin. The
analysis thus relies on a partitioning of the orbiter's surface il) amofng zones of,
temperature, ,debris, and aerodynamic toads, a'nd
(2) among critical system
•
locations. For each tile, we compute a risk-criticalit,_ factor that represents its
d
"
contribution to the overall risk of orbiter failure due !,oTPS failure accounting both for
loads (Ioad-criticafity) and failure consequences at the location of the tile (functional
Criticality.)
I
"
t
The second phase of the worl_ will Involve refinement and implementation of
the model, including (1) an analysis of (second-order) uncertainies about
probabilities in order to determine if these uncedainties can affect management
priorities, and (2) organizational extensions. Tl_e organizational extensions i.nvolve
identification and evaluation
of the mechanisms by which po!ential prol_lems
occur,
•
I
are detected, and can be cbrrected. This second phase will thus involve a study of
_
the maintenance process, accounting for its ability to detect and correct past
mistakes (weak tiles), ensuresatisfactoryqualitycontrolof the current work,and track
the possibilityof weakening of the TPS overtime. 'The objective of Phase 2 will be to
,.
identify, with the help of experts, the organizational roots of technical a_ndhuman
problems and to make recommendations for possible improvements. The PRA
model will be used to assess the relevance of these factors to the reliabilityof the
blacktiles and the effectivenessof proposedsolutions.
In this study, the PRA model is not an end in itself, but a tool designed to
assess specific management practices. The level of detail of the analysis is set with
this goal in mind. One key limiting factor in this effort is the unavailability of precise
_
Pat_-Cornell and Fischbeck
i
'
i
J
vaDes for the probabilities of failure of the subsystem s located under the orbiter's
t
skln conditional on .burn-through. SLlch data' would be !the natural results o.f a
complete top-down PRA for the whole orbiter. Because HAS,_ has chosen to do the'
analysis
piecemeal
and only for,selected subsystems, these results have not been
.
.
i
,
generated, Therefore, we use expert
opinions
,ins!ead of analytical results to assess
:
.
)
glcbarly these conditional failure probabilit[es_'
' ]
'
* " .
,
"':
"
J
,
I
I
1._'=ScoDe of the work in Phase 1:
• AS stated in _theproposal, the objectives 'of,this first phase are: (1) to
understand
the basic properties
of the, tiles, (2) to identifythe
main. experts
and
. ,_ =
.
I
.-"
.
i
eslal_lish working relationships with them,.(3) to identify the main data bases'and
sources, (4) to design the Probabilistic Risk Assessment (PRA) model., and(5), to
,...." .t ._..
"
'
i
:.
iclentify some of the retevant organ[zatidnal feature,s that affect the reliability of the
Th_,rmal
Proteciion System (TPS) wiil'i emphasis
on the black tiles and on the
..
._ .
maintenance..
. (Stanford
•
process.
ThisSystems
first phase:.of
the=.project,
, :-was
funded in part
under
SI()RA
Space
Integration,
and
Operations
Resear:ch
I
I
Applications), and in part as a separate research project (both under _,ooperative
agl'eement.
NCC10-O001).
Under
the SIORA
. .
•
funding,
we identified
some
fundamentat issues involved in the linkage between the reliability of the black tiles
and various features of the organizations that participate directly or indirectly in their
maintenance (including, but not exclusively, NASA at the different space centers,
Loiil_heed Corporation, and Rockwell International).
The problem formulation was
,
presented in a paper delivered at a major Probabilistic Safety Analysis conference
(PSA'89) held in Pittsburgh, in 1989, in a session chaired by Mr. B. Buchbinder
(N,_kSA Headquarter, sRM&QA)
on pr0babiristic safety assessment for space
systemS. This paper won the Best Paper Award of the
American Nuc ear Society fo_
:
".PS._,_,89.
It is included in this report as Appendix 1.
This Phase 1 report is organized as follows:
1.
_eckground information:functioning, maintenance, and failure history of the
"
.
. ..
. .13
_
• .
• '
.
".,' . :...
.... .J'..
.. ,,
,_:-:.
..:
!
i
. !
_"
,
¢
.%
Pal_.-ComellandFischbeck
;
i
tiles.
i'
,/
2.
De;_criDfipn _nd illustration of 1he PRA model;., inlSuts, preliminary
(means); sources of expertise and data.
3,
results
'i_
'
Preliminary observations and (QuaNfafive) c'0uolino of oroanizalional factors
_andthe reliability model.
_
,
t
I
I
i
I
'
• t
1,3 Gatherin 9 of inform@tl@n i_n0: t_¢hnl¢@l polr_ts,of contact
I
The data and the relevant information used in this study were gathered
through meetings _,nd informal interviews of tile specialists, tile personnel
(technicians and inspectors), and man_igement at Kennedy Space Center (NASA
and Lockheed Corporation), Johnson Space Center
(NASA),
and in Southern
"
.
California (Rockwell International in Downey)'. "We
'
I
conducted, in parbcular,
_,_
extensive (although informal) interviews of tile technicians Including both old-timers
and newcomers. Several of them Came from Rockwell and had "Participated in the
initial tile installation work. They described to us procedures and problems and
offered suggestions.
The probability estimates were obtained in two ways: frequencies of events
(a.
from official or personal records (e.g., debris hits; frequen'cy of tile damage), and
,,
subiectIve assessments (e.g., probability of failure of the subsystems under the
orbiter skin if subjected to excessive heat Ioacls clue to a hole in the orbite_s Skin).
Note that:
c
1. The data used here for the illustration of the first-order PRA model are
realistic but coarse estimates that can be refined in the implementation part of
the second phase_
2. Second-prder uncertainties about the probability estimates themselves
have not been encoded at this stage, The probability figures that are used
here representimplicitly the means of possible probabilitydistributionsof the
probabilities of events. Assessment of these second-order probabilities or
.'_,
probability distributions for future frequencies of events (Garrick, 1988) will be
I
14
............
It'_Ac_t3("r'Tt%7"¥_a
Itl_ l_J,J
klTCln
I_HI,
J
'
Pat_-Cornelland Fischbeck
I
I"
part o_the implementation phase if it is judged necessary for the relevance of
the results to management.decisions,
i
) i
_
i.
I
i
' For this study, the key technical points of contact were the following:
At KSC:
I
I
I
° David Weber (Lockheed)
I
I
t
,.
°' Frank Jones, Susan Black, Carol Demes and'Jo.Y
Huff (NASA)
i
At JSC (NASA):
.'.
°.James A. Smith
....
,
..
o Robert Maraia
Carlos Ortiz
, ',.,
• ...
?Raymond G0mez
In Southern
California (Rockwell,
Downey):
..... .
' ° B.-4_e._ll
•.
,
4
i
° :Frank
Da.niels
• .,
, ,,
:,
'
_
°, Jack McC!ymo nds
......
]
. .
r
,-/
"_
.
",
.....
i
"
.:
" -:"
i
I
__.
•,
":
15
. ....:
.... . -.... ....;..... :"
_?___:_W":.i.::,_ ......;_
• .":"
"
I
i
!
61;"391_d
600C8_0_
TO:_T ;"0,
£0 E[3J
J
k,
'
Pat_-Cornell and Fischbeck
i
t
I
L
Section 2;
,_
'
BACKGROUND INFORMATION
I
t
2.1 System
descripti0n
i
I
I
I
t
The designers of the thermal prc(ectionsystern
(TPS) fo'r.the space shuttle
had to solve a series of complex problems due to the wide range of environments in
t
•
which the orbiterhas
to operate.
'
t
•
A smgle-component,des=gn
could not meet all the
• t
necessary requirements of withstandin 9 extreme temperatures
=
and vibrations while
remaining light weight and flexible and lasting for 100 miss:ions. Instead, a complete,
integrated system was developed relying on different components
to solve different
.
f
problems (Cooper and Ho!loway, 1981.)
"t
In the highest-temperature
I
areas, reinforced carbon carbon (RCC) is used.
]'his material is extremely heat resistant and i able t.o withstand temperatures
;'.800°F on a reusable basis and up to 3300°F for a single flight.
up to
The:,use of this
material is limited to the leading edges of the wing and the nose cone.
In areas of
tiTe orbiter where heating rates
are lower, a flexible reusable surface
I
insulation
(FRSI) is used.
"
,_
This material is made of a silicon elastomeri¢ coated Nomex felt,
which is heat-treated to allow using it for 100 missions at temperatures up to 700°F.
In areas where surface temperatures are above 700°F but below 15000F, advanc'ed
r
flexible reusable insu]ation (AFRSI) is used. AFRSI is a "blanket" composition with
Qne-inch stitch spacing.
It consists of an outer layer of 27 rail silica "quartz" glass
fabric and of an inner layer of glass fabric ('E" glass) which encompass a silica-glass
felt material (microquartz, commonly called Q-felt).
These materials have replaced
_-,
most of the 5,000 thin white tiles on the upper surface of the orbiters, originally
clesignated low temperature reusable surface insulation (LRSI).
Their replacement
has reduced the complexity of the TPS at the cost of a slight weight increase
(see
Figures 1 and 2.)
6I'd
8V:£_
£00C £
qg_
ZOO£8££COC:XeJ
II
weJ6OJd NIGO _S_N
,.
f
Pat_-Comell
and Fischbeck
I
•_,m
i
I
J
-t
':::
..
:
Illl
..!
.._
•
:
,
.
•:,. ;
•J
! '-
' l
•._:
.',
,.
"
. ::,
,; -
OBSERVATION
.._
•4
ORBITAL
.
.-':::'.".
wINDOwS.
$_tSTEM (RCS)
' :•
•
. _ ".
MANEUVERING
SYSTEM (OM$) AND AFT
•REACTION CONTROL.
"
"_
RUDDER
.'. ".:,_
:
-
;
A.ND
SPEED BRAKE
.-
.
',
":
PAYLOAD
i
_
FOF:WARD REACTION
COfJTROJ. SUBSYSTEM
IRCS) MODULE
CONTROL
SCJBSYSTEM CRCS•I
_
o
" "
U_tt;d
" " "
LJMBILtCAL
]OY FLAP
• . " ":'".
• " -
ELEVONS
"
' ;"" "
•
NOSE
PREFLIGHT
L.ANDINGGEAR"
••
i
": L
:
. "MAfN
UMBILIC,_L ....
ACCESS
SIDE HATCH
.
;i
" LANDING GEAR
i
PANEL
i
MIDFUSELAGE
NAME
MAINTENANCE
ACCESS DOOR
Q
LOCATIONS;
• DISCOVERY
AND ATLANTI.$
Q. cst-.B,,
Figure 1: The .......
spaco _;huttie orbiter
- . .' .',",!?...'::'.'..• .
.
Source: Shuttle Operational Data Book, JSC 08934, Vol. 4
• : , '.
• . .....
I 7
.... •
... !"
•
.....
,.
" '." ::. - .:.-,-:. :_-.: ::.; . .
:.
,^
_-
:'
-
-,..
LE_'T-HAND $_:
tO
LO
__
VIEW IR/GHT-HAND |YPIGAL)
_
Cq
(_
"7
,-_
e
_:
,_o
Figure 2: The thermal protectionsystem (TPS) for
OV 103 (Discovery) and OV 104 (Atlantis)
_- "
m
m
Z
_u_:
ShullleOperat_ral DalaI_
JSC08934 VoL4
.-
,,,'"
Patd-Cornell and Fischbeck
I
The tiles that are of primary interest in this report are 'designated high
temperature reus.4ble surface' insulation (HRSI),(see. Figure 3.) These tiles are.
coated wi_h black reaction cured glass (RCG) arid are certified for 100 misslons pp t.o
a maximum surface temperature
of 2300°F.
i
Approximately 20,000 of these tiles are
i
used to covbr the bottom of the orbiter.. Am0n0 them, approXimately,17,000 have a
,
j_
t
density of 9 pounds per cubic fOot (pcf). The:remaining
t
-I
I
I
.
3,000 tiles are of higher
,
j•
density (12 and 22 pcf). They are,used'in ai'eas where higher S!rengt_ !s needed,,
primarily around do0rs and_hatches_
and where" it is required
by s!ructural
4:
deflections.
Tl_e 22, pcf tiles are cap"ab!e"of wi[bst"anding.surface temperatures as
high
as 2700°F without shi!nkage.
'
:
,j-I
,1
.
I
:
These tiles, being highly brittle,"ha_,,:ea.gtz;a'in-t;;failure performance tha.t is '
cc, nsiderably
less than the } aluminum sk
" n'..'..ofthe
''?'. '.*..":"
orb"ter..
"" in
_'addft_on,,
""
the tiles have a.
•
.
, . . .
.
miJch lower cqefficient of thermal expansion:
" ": Therefooe,
" "" .... if they were bonded directly
:
.2 ." ." •'"
J.2,;
"
.
toi:the aluminum, thermal and mechanica.l,expansion a,is"_l-ebnt_'action
Would cause
lh_, ceramic rgalerial to crack and fail. Foproteot th',eceramic material, the sizes of
....
? .
.:_._-_:.".',:_-.. ..:.."?
th_ individual tiles
were kept small (nominally6inches
•
...
.
•
!
square). Thes_ numerous
J
designed gaps allow for relative motion of th"etii_S..a_!_i_e•aluminum s in expands
•'"
"
""
.... ' 7-q'"''._';/"-
": "
.
af,d conlracts and the substructure deforrns"under !oading.. H0we'ver, this allowance
:
: _
is not sufficient to protect the integrity of the,t(le_:-."l:n".or_ier
to .further isolate the tiles
from. Ioc=_.]force_, a strain isolation pad (SIP) is secured between the tiles and the
skin. "l:he SIP is a felt pad constructed of Nomex iibers and comes in three different
thirknesses (0.09, 0.1i5, and 0.16 inch).
T
The tiles are bonded to the SIP and the SIP to the aluminum skin using a
ro_m temperature
vulcanizing silicon rubber adbesive(RTV-560).
In certain areas
' _
where the aluminum skin is particularly rough:and disjointed, a screed or putty
(RTV-577) is used to smooth the surface.
In order for the SIP and tiles to vent dudng
a,_.centand to protect the aluminum structure from gap heating, filler bar strips
(RTV-560 coated heat-treated Nomex felt materiat) secured only to the aluminum
i'
I
t
.,-,
.
. •
.
..
.
.
..
.:
19. .
•
....
•
_ •
_
.?
:l
I
Pat_-Cornell
and F_chbeck
!
..
.t
skin are plac_d around each piece of SIP. The porods tiles are allowed to vent since
• the RCG coating does not extend to the filler bar.
(E:pproximately
¢.
'
4,500 locations),
Between tiles inthe
gap fillers are used
prev_'ni g_.p heating damage during reentry,
hotter areas
in addition to the filler bars
to
The_gap fillers are secured in place
With R-IV. Figure 4 shows a typical black tile with all t'he related
components.
i
I .
_2
I
Eifb cvcle_l_nd
maintenance
0persti.on_
,
'
'
,
2,2,1 Tile manufacturino and ingialfation
Because of the extreme environment in which The o_iter operates,
must be • made
faBrication
requirement.
' '
of only the purest
materials.
C0ntamination
0f the tiles during
could lead to failure of the TPS well before meeting
Raw material (amorphous
silica fiber)ha£to
lhe TPS
its 100 mission
be 99.7% pure (AW & ST,
•
_?..
.1976).
....
GAP.FILLER
COATING R_.,
r
RTV-560_
•
•
_
_
FILLERBAR
Note_Thickness exaggerated for Clarity; Screed (R'_t-STT) only where needed
-!
Figure 4: The tile system
i
The fabrication process starts with a slurry of water and 1.5 micron diameter
silica.
The water is drained
and binder added.-
This mixture is compressed
into
blocks _lightly smaller than 1 cubic foot. After the binder sets up in 3 hours, the
bh)cks are dried in a microwave oven.
The sintering process which locks the fibers.
...
:....
:.
.,:.-:.
,i
Pat_-Cornell
and Flschbeck
together requires tight heat tolerances., The blocks are baked at' 2,375°F for two
hours. Next,they are"cut into rough tiles !four i i bight per block). Tile density arid..
density gradient are verified usingX-rays. Since each tile is different, the tile_ are'
'
_"
trimmed to specification
using automated
millingmachines, A second quality check
j
I
assures that the tilesare fit for coating. The coat!ng
is sprayed on and then glaz,ed.
(
•_ third quality check verifies the integrity p! the coating. These tiles, are then
interna]ly waterproofed with a silane mate'rial. During original cor_structk_n,
the tiles
were next place,d in arrays thai'matched, their p!ace_nent,on the orbiter's sudace.
Each array consisted of approximately 35 tiles. The bottoms
of the arrays were then
I
shaved to match the shape of the orbiter.
_,
A fourth, quality check verified the
dimensions of randomly selected tiles from each array, All current replacement •tiles
are machined individually.
_,
I
i
i
The original installation of the tiles at tim'e of construction was done an array
at a time. The SIP was first bonded to the tiles using RTV, while a lattice of filler barS
were bonded to the orbtter. After these bonds had sit, the entire array was bonded
to the orbiter. Difficulty arose in aligning the tiles/SIP array wlth the grid ¢_ffiller bars.
If the tile/SIP array is partially ' resting on the filler bars instead of di ctly to the
orbiter's skin, the strength of th,eTPS bond is greatly reduced. The arrays are held
in place with 2-3 psi pressure Whilethe RTV. dries. Bonds are verified using a pull
t(;st on each tile. The strengthof eachtest varies based on the Ior._.atlon
of the tile and
the expected in-flight loading(2 to 13 psi): Once a ti'lehas passed this initial pull test,
_,
it is unlikely that it will be checked again during its life cycle of 100 flights unless an
anomaly is detected,
2.2.2 Fliahtprofile loading
Dudng a typical mission,the tiles are subjected to a wide range of loads and
t_:mperatures. These must be considered in order to determine the limitations and
life cycle of the TPS. The description below summarizes a report by Cooper and
Holloway (1981).
G
22
rT'J
nc.c_
onn7
c
O_J
;NReRCgZNE:×_4
II
WeJ6OJN NI_0
US_N
98"3OL_d
600E8S_0_
b8:£I £8, $8 E[3_
j
J
Pat_-Cornell and Fischbeck
I
Ignition Qf the orbiter's main engines creates an oscillatory pressure wave
I
that loads the tiles _q the aft region of the orbiier:. I Though I strong, this wave should
,
d_Lmpen rapidly. ,In addition, acoustic pressure 'created by the engines can directly,
Ic;adthe tiles and the. aluminum skin. Any motion of the aluminum will, in turn, cause
t
in,-_ial pressure
on the TPS. The amount of i,nerlial pres-_ure depen,ds on the local
I"
•
II
*
r'esponse of the aluminum substructure, but nmse levels up to 165 dB are attained
"
j
,
] I
during liftoff. During ascent, the tiles
experience a wide range Of aerodyhamic
"-I
loads
in_iiuding: pressure gradients and shocks, buffet and gust loads, acoustic pressure
Io_!ds caused by bo!Jndary laxer noise, inertial pressure caused by-substructure
m,_ti0n and deflection, and unsteady loads
coming from
vortex
shedding .from the
I
""
""
!
" : !
connecting structure to the external tank. Almost eye_.tile
will experience
loads of
1E;0dB dudng ihis phase of a mission.
'
t
I
i
Since the tiles are. highly porous (90,% voidi, it is during the asce'nt that any
inlernal pressures
i
must be vented in order to equalize with the external envlronment
Because of this, both the SIP and the t!les may _xperience varying degrees of
internal pressure.
Vent lag can cause tensile forces to build up. In addition, small
re_[dual
[ates of the
,.
. tile stresses are
.. caused 15ydifferences
.. in. thethermal
. . ._.,_.-_. expansion
_
tiies and the coating. Ais0, any water that was absorbed will cause internal pressure
as it expands and contracts with the temperature_
. changes.:,
;
i
During re-entry, a second series of stressesare placed on the TPS including:
substructure
deformation, boundary layer acoustic noise, steady aerodynamic
loads,
unsteady aerodynamic loads caused by boundary layer separation and vortices, and
Io_[,3'sfrom aerodynamic maneuvering.
The boundary layer transition from laminar
to turbulent flow always occurs, but the time of this transition (for the same entry
ii
traiectory) depends primarily on vehicle roughness. This•roughness Is divided into
"i
tw_;_types: discrete (one single large•protuberance)
protuberances.)
Early time of transition
results
or distributed (many small
in Ngher
turbulent
flow. peak
temperatures and Ngher total heat loads that depend on temperature and time of
23
•
_
L
PatE-CarnellandFischbeck
i
I
i
exposure (Smith, 1989}. Nearly one third of the tiles on thei lower surface of the.
i
i
c_rbiter reach temperatures in exc,ess of 1900°F and, are sLJbjected to problems of
LJneven thermal expansion.
•
..
I
,
I
,
i
I
The TPS has been rigorously tested and has withstqod thousands of test
cycles of limit load without failure. The system has then beenJcertified for at least 1O0
.flightsl
However, repeated exposure to the stresses and,'st 'rains that accompany a
•
space
."(,
mission
can affe_
.
,
the integrity of the mdlv_dua
Components.
The tiles can
weaken, for example, above the densification boundary layer, the SIP can stretch as
_"
fibers pull out of the matrix, and the RFV can creep under very high loads. It is only
through rigorous maintenance procedures
and quality-control
verifications
that the
true life cycle of the TPS can be determined and tha{ acceptable system safety c_n
be achieved.
t
2.2-3 Tile maintenance Drocei_ure
L
The maintenance procedure is guided by the Rockwell specifications
(Rockwell
International,
1988, 1989).
It invo'lves (1) a sequence
il:lspections and assessments after landingto
Of tile-damage
decide which ones can be mended
and which ones must be replaced; (2) tile replacement; (3) bond 'verification
using
p:dl tests; (4) step and gap measurement; (5) decision to install or not a gap filler.
The'steps
involved in the replacement of a tile are the following;
¢
= First prefit
o Denslflcation
= Second prefit
° Bonding of the SIP to the tile
"
= Cleaning of the cavity (inspection point)
= Pdming of the cavity
° Mixing (and testing) of the RTV
,"
° Application of the RTV to the tile/SIP system
24
JT"J
TC._T
OC_C_ c
n_J
_:_"
jr_r_¢_£¢7_7:×_4
II
W'eJ6OJ,4
MTnFI
H_FI_
•
....
..
'we_sXs
fuLbl/dlSlel!_
eq_ue>l_aM
Xew se^lesweqlslsel
eqlIgq_s!_e_ aql'puoqeqljo_selg^!snsu!-uou
e I,o
eouesqe
eql Ul "Slepe_w 6u!iooJd_eleM
ol sa_nsodxa1uanbasqnspu_ le!t!u]
Xq pasm;o
pegJo_ I_U!_!Jo eq_ _o 6u!ua_(ea_aXu_ uaaq _gq 8_eq__! au!wJe_ep o_ pallnd e,_
$81!__o Jgqwnu
IlgWS g 8Jg4ta 8ggJg ]oa[g_ u! _! sJnOOo
_e41Du!_sa_uJopugJ _]uO 8qJ.
•puEu_ap uo eou_uelu!Ew _l_SOUJs! eJnpaoo_daoUEUa_U]eW
s!q; _eq| e_ON
,
"$dJ.gql;oeJnI!_,_
jo
_!l!qgqoJd aq_ ol ssauq_noJ s,Jg_tqJopue sdeOpue sda_s 8uoJ_a_ouot_nqp_u@o
I_!;!u!
8ql uo $puedep SdJ. 81oqMaq_Jo,tu!_8 _(_![!q_!leJ [_u!puods@JJO_ gq_ ',(IJ_glO-.'(066
l
'.VEIOI£ :686L 'uols!^!O _,UaLUdOia^aQ.
pue'qoJeasaEl_peaq>lOO-i)elqe!ia_aJow 15L.i;_
Ja_p]nb qic_q 1! 8uPieW 'luewelnseaw de8 pu_ dais alewo;ne o; padola^ap 6u!eq
/_liUeJ_no
s! _uJalsX8JeSelV "sa6n_6 3!lseld eq; to ;u8uJsaelds!uJol anp slueuJaJnsgauJ
ai_:Jnooeu!6u]pnlou! 'XJo_ gq; ;o_Jed s]ql u! papodaJ uaaq e^eq sLuelqOJdl_Je^a,_
"sJall]; deO pJepue;s ile_Su]-d_.uofsjoap e 0; sPeal'UaI;o uo!_adsul s!q_ to lln_e) @qj.
•gel!_uaaMleq aoed¢eql u! q;dep uie_a#,e o_,seSn#8 o!;s_ld ;0 uo!;JaSu./_q,{llenuew
euop 'el!l Jed s_,uaweJnseaw t_" I_O!^io^uheJnpaooJd6u!u_nsuoo-awi_,e Xl:lU#_Jfi5
s!;i "s.seuqSno_alo!qe^ o; anp sp_ol_eaqe^!sseoxe eql p!o^e pug 83ejJns _J:sifqJo
aq_ !o s§auqloows gq;_,eJn_ua o: lueauJ s!lOeu_em_eacu de6 pum dal_ " i .
I
"
..
,'i:
..• '
'
,
I
,
I
.+
:,
,+
" ,
"6uiduJnispue a,w!l Ja^o uo!_eJoJe_ep
o_ alqlldaosn_- e_ow eq o; ,pue_ XaLl_.qse_ lind i _e[_!u! eql ssgd spuoq lg!_Jgd
eseql.qSnot41 'ls8,1aq; ssed ol 418uesIs iua!o!j_ns ap]^gJd/[e,uJ sJell]_dab |ueoe[p#
.eq_ o; 8u]puoq esneoeq papu6q Xll'e!;J_'dXiuo aJe ;eqi Sal!l to uo!loa_ep_aC_lle.
,
l
'
_ou'Xew lsel lind Slq; _eql s] papdde_,ueaq, seq _e;SiUJalqoJde.u0 "q_SueJiSalqe!Je^
Io Isel find e Sa^lO^U! ssaooJd s!q_;o pua aq; ;g_puoq aq; to u,o!ies]_pa_aqj.
,
I
"
,
I
'
' t"
"puoq aql ;p uo_;eoI_ua
Ao
"
","
I
,
_;!^e3.aq;o_ dlS/al!i eql jo 5u!puo_ o
I
,
i
I
_oaqqos!_:tpue IlauJoo-.aled
i
1
FEB 05 ' 83 $3:@5
2823583887
PAGE.28
'
"
5.3
-
Pat6-Cornell
and Rschbeck
Failure history" incident r¢cordlna and 0_t_ bases
2.3,1 F@ilvrehistow and incident recor_ling
A history
J
of the tile proSlems can best be described by grouping the
dffficOlties into three broad categories: (1) designproblems,
(2)processing
and
maintenance induced problems, and (3) damage caused by, external debris. This'
infor_nation
is summarized from data compiled by Carlos O,rtizat Johnson' Space
=
Center (JSC) in Houston, Texas. It should be remembe'reclthat to d'ate, only two
black tiles hpve been lost prior to or during re-entry: one due to RTV failure caused
I._ychemical reaction with a waterproofing agent (Challenger, Flight 41-G) and one
due to debris impact (Atlantis, Flight STS-27R).
Even then, there was some
remaining material in the t!le cavityprior to entry. In both cases, there was neither
catastrophic secondary tile damage, nor burn-through _f the orbiter skin. This good
(
fortune was due in part to the locationof the missing tiles and the structure under the
.,_l<in. Similar losses in different locations could have been far more costly.
l'Jonetheless, the TPS has done very well and proven to be far more robust than
_:
e.ntic[pated.
With any complex system, the design processdoes not stop with the initial
product, improvements occur as the system is used and weaknesses are detected.
The orbiter'sTPS is no different. Revisions to the original design started before the
first launch, and have continued ever since. These properly redesigned components
have greatly increased the reliability and maintainability of the overall system.
Deficiencies that have, as of yet, gone undetectedwill be solved in a similar fashion
i
L
providing that they are uncovered prior to a major system failure.
!
i
During the initial design of the TPS, each component (tile, SIP, and RTV) was
certified individually; but it was not until they were combined during the construction
ot the first orbiter, Columbia, that a "weak link" in the bond between the tile and SIP
C
w_-:sindentified. Tests of the tilelRTV/SIP/Koropon as a system revealed that the
26
i
i
_"
". 0£'39Wa
•"
&OO£BSS_O_
$0:£_ [0, $0 _3_
'
Pat_-Comell and Fischbeck
t
I
J
"
, •
combined tensile strength was weakest at the tile-to-SIP interface. This was causecl
by the RTV,=not impregnating enough the basic tile materal to insure adequate
.
i
i
attacl'_ment. The President of Rock'veil Space Systems Group stated: " I think that it
is a'fair criticism
that we didn't define the problems more clearly as far as tbe
i
tile/strain isolatioh_pad capab[Ries are Concerned. We worked too hard on the
I
, quallty of the material alone and waited too long for the th_t'mal anaiys[s." (AW&ST,,
_5 February 1980.} Because 0f this oversight, many of the _,lrea_dy
insiaiiedtiles had
Io be forested, pulled, densified, and replaced. TOelirnina,te 1he"weak link", the tiles
are densified
by' applying
a mixture
ofDuponfs
Ludox
AS and
silica
siip
to the
:._ndet;side--oi; inner mold line-- Of the tile 'to an .ap_ro×imate thickness of o.010'
il'/ches. The result 0f this procedure is to_move the "we_k link;' up intothe tile material
itself.' Since the minimum strength 0f the b_,sic9 P:t
at rial is13
the majority,of
ll_e tiles now satisfy the maximum induce_l_loadiequirements. M_ny of the installed
tiles were known to havegreaterthan
the minimum 13psi siren_th and could be
.,:hownto have positive margins for flighi loads; The t_lesthat could not be shown to
meet flight loads with a positive margin were replaced wi_h :_2 pcf tiles whose
rninimum strength far exceeds the maximum flight loads. This additional work meant
that the 30 000 tiles on Columbia requi_'edmc_rethan 50,000 tile installations before
t:"Jefirst fligh t. Even so, not.all the tiles were clansifted prior to th_ first launch, but
.were deemed acceptable based on proof load testing to '1.25 times _he limit stress.
For all the orbiters after Cclumbia,. the tiles were densified during installation.
Even though the overall temperatures reached during re-;entrywere less than
the maximum allowable, tiles in three ai'eas were found by flight experience to be
s:Jbjected to local thermal degradation and/or unacceptable thermal gradients
resulting in a negative margin for the mid-fuselage structure.
Three
solutions were used to resol_'e these area-related problems. Tiles
redesign
inboard and
fct"ward of the main landlng-gear doors (denoted as "location A" tiles)
were
kz_owinglymade thinner than the initial thermal design thickness to minimize weight
and to retain the aerodynamic mold line. The thin tiles were able to maintain the
'"
5
" "-
'
27
:
• '
:
"
• ;
.i:
•_
.. , .
PatE-Cornell
andFLschbeck
structural temperature
limits because the initial flights were flown from the Eastern
Test Range at Kennedy Space Cenier, ,whi!e !_e. "thermal" design trajectory .was
based on launches from the Western Test Range, which put a greater heat Io'ad or_
the structure.
However,
extensiye analyses, both thermal and stress, showed
unacceptable negative structural margin:due ) to th,ermal gradients.
These negative
margins were initially resolved by internal st'_ctural modifications and by installing
internal heat sink matedaL Later,
the locatio n A tiles
were replaced with slightly
• I
I
thicker tiles (approximately 0.10 inches thicker) :which
still provided &n _ccept_ble
I
aerodynamic
outer mold line based on flight data evalu.ation.
Tiles between 1he
nose cone and nose landing gear were receiving excess!ve heating, which caused
tile slumping and subsurface flow. TheseD tiles were eventgally replaced with a rnuch
more durable RCC chin panel.
A similar problem
Occurred with the elevon cove
I
tiles, in this case, the size of the tiles _as increased, thus reducing the number of
I !
I
lroublesome gaps. All three modifications have proven successful..
:
I
Processlna and mainten_,nce
The most critical TPS problems related.to processing and maintenance have
occurred with various waterproofing agients that have affected the strength, of the RIV
by reacting chemically with the bond. However, in addition, a significant set of other
problems have arisen because of maintenance errors.
Initial waterproofing was
,done with an external application of Sc0tchgard to the tile surfaces.
_:otally effective because the waterproofing
This was not
degraded with exposure to rain and
._
,_unlight. On the second flight, tiles that had absorbed and trapped water, fractured
when ice formed in orbit. This defined a need for an internal waterproofing agent. In
addition, the $c0tchguard was found to chemically attack the RTV-560. Fortunately,
this was discovered immediately
after an accidental overspray.
The first internal
waterproofing agent, HMD$, was found to react with the screed (RTV-577). slowly
r_.werlingit from solid to liquid. This interaction between waterproofing and screed
was not immediate, and eventually led to the loss of a black tile.
Fortunately, the
cther nearby tiles affeoted by the softened screed did not fail during.reentry.
A
28
"re-4
zc:c'r
cnnz c
aa4
)oog£q£coc:xed
II
weJ6OJdNICO_SUN
"_
'
el alq!ssod sam _! 'sdeB pue '13E1.:1¥'saul 8qi ut peBpol II_]Je$euJs.uqap lemoe
_0FJeAooeJ aql pUe eeeuJep lo uJal;ed aql uo peseE! "(686 _ 'EJZ_-£$£ 'weg.L Ma[A_EI
86euJec] S_IJ. JeT,!qJO)8111Hoelq auo lo uojpod aBJeI e ;0 ssoI eql 6uxPnl3uf 'lq_iflJ
841JO-I "(qou! cue ula41JeleeJ6 sl!q to Jaqwnu 841 to UOllOunt _ se sSqe!Blo jaqu_hu
:
weJr aq ol punot SeM s!Jqep tO aoJnos JO[eW lense eql '(EILZ-SIS
:
eq_ 'ULe-SJ.S
:
£no!AaJd 4ue uo u_wl aeemep spqap ejouJ Xilu_oWuB!s peouapedxa
{
6upno
"(.L3) Huel
Sd.L 9,Jal]qJO
leuJa;x:1 8ql .wOJt uo!lelnsu!
I-lOS1o suo!IJod
IP,un) s146]11lsJ!_.
'qdeJ8 JeMOI 8ql JOt :S1!4s.Uqal_tO JeqLunu level aqi to uo];oun; e se slq6 I; 1o lequJilU
'qdeJ6 Jedcln a41 JOl).eDeuJep s!Jqep eLp, lo SUJ_6OlS/q sA_oqs qo]qA_ '9 8Jn6!4
u! pe_qB'!lqe!q lequn t g[ X1]l]q_p_^ l_!q&
i
"(09 - uo[le]Aep pJepue;s 'LS = ueeua :.1._
Sl!H '.LSL =.uo!lelAap pJepuels '6LL = ueaw :Sl!H: lelO_L) pe_Jnooo seq leql uoBe!_;^
ieeJ6 eql SaleJlsUOUJep sis/iI_U._ leOJlsllei_ oi dWzs
'(4oul. _ ueql Jaieal6) $llLI
i
"'.'"
'
'
""
""
"
•
:
"
"
"
"
JofeuJ pue sliLI tel JequJnu. el_l 6uqsq Xq a6e .Luep.eql sazlJewuJns L elqe[.
:
i
'
-at3euJ_p
spqap I_UJelXe.Ol pasodxa, ueeq s,Ee_le S_q'Jel!quo @ql '_qe!l_..lSJ]Ieql eSU_s.
F
•
)
"
" '
"lueuJeoeideJ pepeeu OSZ qo!_lm
to' Sel!I: 000'_ Je^o
t_Ut_euJ_p.:wJOlsuleJ e .q_noJq! u._olt s_aa e!quJnloo Jm[qJo aq_
{
: .
'Zi_L'e
to>Ioeqeq_,uo ep!Jol4el.1_]uJol]leO
uJaJl_.qe!ll
uJn_,aJ
_ Bupnp '_(lleUt-i
•"eu!Isi!l
,pu_ eua_lele JdoJdde eql JobeJn_ el pet_Olie l_Pue_et_ spuoq eql 'euu_l8u_fup _eI_oqs
e s,_q qolqM o9_-AJ.U se Pel_q_l se_
ggg:A_[U "iu88
e..
.,;..
6u!puoq eql lo JaU./eluoo _ _o
8UtlaCl.els!U_eq_,peAIO^U! _deplou! _m41ouv "luewuo_!^ue e_ueuelu!eu_ J!e_41o1_spupq
j!aql pue saul ` eq_,to /[l]_[l]sues eql eleJlSUOtUep 'JeeUelleqo uo p]nu 3!lneJpXff pije
I
'etquunlo D uo Jez!p!xo u_. 8U[^lO_d] 'Slltds eseqJ. "Sel[l OCJO'
_ /_lJeeu to 8u!13uoqaJ,pue
je^ouJaJ eqI pe;el_ssedeu
e^eq uoqellelSu_
aft; 8uunp
Sll!ds leO[uaeLio le_eaa$
•
'
' I
'
'
•
"
I
_
,
,
"u.teouoo
I
I
__.___:..
.
uaaq .s_q 'S31AICI 'eu!_oo_dJe_ta
ue^oJd pue pedole^ep
eql to sloetta lenp!seJ 'LUJel-eUOI eq$ 'JaAa_AO
N' "lntssao3ns
II!lS ate £C]IAIH paleplno
;o uo!l_ue8
3uooe3
I
I
_aqqo_!4 pu_IlauJoo-9_ecl
_,
i
FE_ 85
'03
•
i3:86
202358308?
PRGE.32
"
Pat6-Cornell and FLschbeck
I
i
I
I
i r
S
equ
'
ence Designation
'
Orbiter
i
.
MaJorDebris
.... Hits > 1"
Toia'l Debri._
..,, Hi!s
'
,
I
1,
I
Columbia
2
2
Columbia
3
3
Columbia
4
4
5
6
5
6
7
8
_7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
Datd
04/12t81
•
•
: 11 _ _12181
•
•
0 3,122182
•
Columbia
0,_/J_7/82 '
•
Columbia
1111 !/82
•
Ch_Jlenger
04104183
36
'Challenger
06/18/83
,
48
Challenger
08130/83
_ 7
Columbia
11128183
=1 4
Challenger , 02103184
34
Challenger
04/06/84
8
Discovery" 08130184
30
Challenger 10/05184
36
Discovery 1 !t08/8'4
20
Discovery 01/24/85
28
Discovery 04/12/85
46
Challenger 04/29/85,
63
Discovery =06,1"_7/B5
144
Challenger 07129185
226
Discovery
08127185
33.
Atlantis
10103185
17
Ch'allenger
10/30/85
" 34
Atlantis
11126185
55
Columbia 01/12/86
39
Challenger 01/28/86
*
Discovery 09/29188
55
Columbia
12/02188
250
41H
41B
410
41D
41G
51A
51C
51D
51B
51G
51F
511
51J
61A •
61B
61C
51 L
26R
27R
29R
Disr.,overy
30R
Atlantis
28R
Columbia
34R
Atlantis
33R
Dl,covery
32R
IColumbia
03/1
;t/89
05104189.
08108189
10/18/89
11]22/8'9
01/09/90
.
!.
•
120
253
56
58
63
36
111
1 54
87
81
152
140
315
5r53
1_ 1
111
183
257
1 93
•
411
707
23
132
56
20
18
21
15
151
76
53
118
120
.'.
'.
Table 1• Summary of orbiterflights and debris damage
30
,.,^ . ,
,-v',. r-'r
r.,_.r_7 t"
.70 J
_'"
J_NC_CC7('_7"
_
J
W_J_0J.q
NT(lr7
HRHN
ii
l
-. :,"
.:
" .."_
;:""" ......
".
"
. .
. ..
":"
.
..-!
L'C
......
.-
:.
7 ....
..
._
,
. T "" .... :
(1 Ls-gJ.s pue suo=ss=uJ
e^zjlsJ=I!6u SS=LU)
Slq_l/.£:£ISJ=I
_ql Jo;
.....
.
.
*
al_p _lq_l]e^e uo paseq ('ola '.sl!q lelOZ0g-09 peq slqO]l; luaJaNp o¢_J,'s_q I_IO109-0PPert Slq6!lt
Jnoj"a't) a6euJ_psyqep to lunouJepailloads e paouatjedxa Isql szqlS!lllo JaqLunugql saleo._PUl
!
"suqap ol enp aBeuJ_p el!l,to LUeJ6OlS!H :_ eJn61J
09g ot,_
0$g 00_
08L
091. 0lrL
0gL 00L
08
09
0tV
0_'
0
UZ_-SJ.S
o
, Sl!H le_Ol
OS/.O0/. 0_;9 O09OSS O(]9.0StpOOt, OS¢ObEOS_ O0_OSL'OOL OS
•
t
•
1
s
.
•
J
•
I
0
_
. g
'1...."1"......I---t '1111iiil°
_
,
IltUtl *
_L_SIS
r
I
__
:D"
......
I
j
9
:
_
.I
Hoaqqos!dpus llgUJOO-_lBcl
FEB 05 '03 t3:07
'
PAGE.34
2023583887
"
S£'_Ua
&00S8££_0_
60:£T EO, $0 u_d
PatE-Cornell and F!schbeck
i
}
(
I
determine that much of the severe damage was caused by insulation from the cone
area of the right SRB. Other 'damage, minor but
more extensive than usual, ,was.
I'
caused by the insulation of the ET. This was similar to the type of damage tha't had
been experienced in previous fl[ghts. In addition, an in-depth analysis done at the
time conclLJdedthat there was no obvious correlation between tile damage and
launch conditions that might affect ice formation, which was considered earlier a .
J
I
I
I
_
"
possible sourde of tile impact d,amage (Orbiter TPS Damage ReView Team,,
STS.27R,1989) .
."
,
I
I
'
I
.
I
Figure 6 displays on one orl_itei surface a' ¢umu!a,tive recording of all
significant tile damage from all flights and all orbiters ithrough STS-32R.)The
damage is obviouslynot uniformlydistril_uted,and certain tires are much more likely '
I
to be damaged than others. ComPUte'rmodels developed by Ray Gomez at JSC
have been ebb to show how insulationfrorn_bcJth
the SRBs and the ET r_,ouldcause
such damage (see Figures 18 and 19 in Section3.i The complexity of the problem
does not currently allow for a direct and focused
backtracking from a tile On the
I
orbiter to a particular spot of insulationI_ecausethe trajectory depends on many
factors (e.g., the velocityof the orbiterand the angle of attack.) It may • possible,
however, to determine rough!ythe initial location and the size of loose insulation
necessary to inflict specificdamage (locationand severity)to the tiles.
Debondino oftiles due to factorsolher_handebrisimoact
To date, as mentionedabove, only one black tile has been lost due to factors
other than debrisimpact (in that_ase, chemical reversionof the screed). There are
',_everalreasons for unsatisfactorybonds: 1) improper alignment during installation,
2) failure to complywith RTV drying limitations,3) chemical reversionof the screedor
R'I'V, and 4) possibleweakeningof variouscomponents in the TPS under repeated
load cycles.An initialinvestigationof a small dlscreteset of tiles showedthat a high
;,ropotlion of the bonds that had pssed the pull test werelater
found to be
..
unsatisfactory(see Figure 7), Sincethen, however,this number has been found to
,o
82
cc'.J
t,c.c-r
cc_n7 c
oa4
)_qC£_qZNZ:X'e4
WeJ60J_4NTt'[I] USUN
t
'
i
,
L_
:
=t "
..
i•
-
•...
. _
,....
.=.
"?"
'•,..
..
..
• ..
..
• L
-..
_
/
,...
L
.
_
....-
•
Figure 6: Accumulated major debris hits (lower surface)
for flights STS-6 through STS-32R
SoL,_rceof data: J. McOlymonds. Rockwell International
"
""
......
33
"
.
_!_
"
J ";
i
i
==L¢: uUN_
VERIFICATION
PROBLEM
OVERVIEW
_'
•
CAP
•
TILE
_-
Loov, =
llif
....
i
""
FILLER
LL
F)
-.
l
,o
El
t13
FI
m
cq
BAR
.FI
J-_e
__"_"
T
R V_
SKINALUMINUM
ALLOY"
r
_'-" STR AIN
15OLATION PAD
I$1P) .
-
r_
PROBABLE
p,_D
O
m
OO
.CAUSE
.
•
OF-BOND
PROBLEMS
•
POOR ADHESION
If')
•BETWEEN
SIP
'
AND
.
RTV
,'
,-
,
_.
".
o
c_
•
POOR ADHESION
•
PHYSICAL
BETWEEN
RTV
, ,
AND
0RBITER-SKIN
.
-
X
"
INTERFERENCE
IN CAVITY;
SIP
RESTS
QN i_D_3E OF_FILLER
BAR
-
-
i
E
?
CURRENT
_'_
z
•
03
CO
BOND
INADEQUATE'.
CERTIFICATiONMETHOD
• 20_ CERTIFIED
BONDS
IS "A PULL
LATER
TEST
FOUND
UNACCEPTABLE-
_
C3
co
(I
z
('C
Figure 7: The tile system and bond verification
E_
_c
Source:Lockheed
Corporation
(1989),R.Welling.Reproduced
bypermission
"
,
"
Pat_-Comelland Fischbeck
I
•
be'much
smaller. A recent and on-going evaluation of all 9,0,45 tiles using the 0.090
I
_nd 0.115 inch SiP has shown that of the 6,517 tiles e'valuated to date, only 8
,,_howed anomaTous conditions (most of which, but not all, were subnom_nal bonds).
13ofar, during,normal maintenance and the replacement of debris-damaged
tiles, 12j
i _
J
tiles have been found to have n.o bond between.the SIP and the orbiter's skin. These
•
J
I
'
• "1tiles were only held in Place by the gap firler's bond to adjacent
tiles.
I
As mentioned earlier, the SIP is bonded to each. ti!e using RTV while th'e filler
bars are bonded to the skin.
After all these bonds have firmed, a layer of RTV is
I
gt.l.acedon the skin. i.nthe hole defined by the filler bars.
The tile/SIP combination
is
t_Tenheld
in place completing the installation. : If,,] the tile/SIp combination' is not
,.• :
_.![gned correctly with the filler bars, the SIP ma) rest on the filler bars and.n'e_er
t!:)uchRTV or skin. Obviously, these tiles will haye very poor.bonds. In,several cases
tlTe tiles were placed correctly between
sensor wires.
These wires prevented
Frl'V and thus made for a weak bond.
the filler bars, but dire_ly
over exposed
complete contact between the SIP and the
It should be noted that even with no primary
bond between the SIP and the skin, tiles
have
still passed the pull tests (because of
t'
"
_.
the gap filler bonds) and that, as of yet; no tile has been lost due to poor installation.
• .
• ..
.,.,:.
...,
..
.
.i.
,
If the RTV is aIIowed to dry before the tile/SIP combinatlon is placed on it, the
bond will not develop to its full potent{al. Th}s can happen when several .tiles are
b_en placed at one time, and a single batch of R'rv is mixed for the several prepared
s'tes.
If the installersare
not careful, the R'IV may exceed its "pot life', i.e., the age
• ..
. .
.
.
.
.
b_:yond its safeiy margin, before the last tile is placed.
The chemical transformation of the RTV is very sensitive to temperature
a_d humidity and must be monitored carefuUy during installation.
In several cases,
tl'e curing time of the R'IV has been reduced by the installers using water (or saliva).
S'!ch a procedure, which is explicitly forbidden, is not believed to affect the
immediate strength of the bond, but may reduce its life. A similar class of problems
:_;,
•
,_.....
,5
•
,
.'
:
;
_
,_OO_8_C_Og
6£"391_a
i
Patd-Comell and Fischbeck
',
|
i
=
I
=
has occurred when the aluminum surfaqe has not been properly p'repared. In this
case, the RTV boncl mayfail at the interfacewith
the orbiter'sskin.
,
I
'l
i
The only black tile that has been lost due to debcndingnot caused by debris
t
occurred when the first internalwaterproofingagent,
HMD8, reacted chemically with
=l
the screed causing it to soften and revert back to itsmore viscousform, The formula
I _
I
of the waterproofing agent has since
been changed 'so that it will no_affect the ,
I
screed. This new
waterproofing agent has completed 50 mission cycles on
I
combined-environment testing, and no weakening 'of.thei TP8 system was found.
Yet: Careful monitoring is required to ensure that no residual amounts of the old
HMDS agent are causing a very slow reversalreactionand, eventually, lossof tiles.
'Thecurrent HMD8 testingproceduresinvolve removingtwo or three tiles after each '.
,
flight to check the chemical composition of'the' screed. To date no additional
l
problem has been found,
r '
In the long term, repeated exposure to Io'ad cycles and environmental
,_:onditionsof heat and humidity on the ground may weaken some ctf the TPS
components and, eventually, cause tile failure. The most vulnerable
those
tile_ are
with no bond or very little bond (e.g., less than 10% of the surface) betweenthe SIP
and the orbiter'sskin, and that are held primarily by the gapfiller's RTV bond to the
adjacent tiles. RTV bonds, so far, have not shown visible signs of deteriorationover
time and load cycles-It is known,based on extensivetesting, that the hundred-flight
....
certificationis Iustifiedfor well-bondedtiles. What will happen In the future, however,
i.,=uncertain,
f
After some flights, .several cases of slumping (sagging) tiles have been
'"
observed. These are easily identifiedvisuallysince they break the smoothsurface of
the orbiters. According to David Weber at KSC, the
most common cause of
slumping is a weakening of the SIP's fibers due to repeated load cycles,
r
Pi;e-densification testing showed that the part of the tile located right above its
36
c_.,
CC-eT
en(_7 C
Oa_
("
9RR¢_qCZPZ:X_4
ii
W_J6OJd NIGO _$UN
i.
0_'39_d
&00S8S£_0_
60:£_ £0, $0 _3_
Pat_-Cornell
and Fischbeck
interface
withthe SiP
was the weakest,pan
and was most likely
tobe affected
by
L
I
repeatedloadcycles:With densification,
thisweake_ zone has moved, on one
hand,, further up into the tile, and on the other hand, down into the SIP Itself. ,_,
problem in either location is difficult to detect if there is not overt visual clue. Yet,
once again, to date no tile has been lost due t_ repeated
load cycles. ,
,J
i
t
I
Three data
bases have. been identified and described by Ellen Baker and
t
lSonny Dunbar as part of their TPS Trend AnaJysisS0rvey (March, 1988). They are:
° PRACA (Problem Reporting and Corrective ._ction)which is managed by
NASA, Tile problems constitute only a subset of these daia. 'The
information regarding the tiles c'anbe accessed at KSC.
•
° TIPS (Tile Information
I
Processing .System)
which is managed by
I
Rockwell • (Downey, California).",Th'e specialist
is MF. B.
bjo
SchePI,
supervisor of the TPS D_ztaSystems at Rockwell International, Downey,
California. The information can be accesse_l
at Downey, JSC, and KSC.
I
• ° PCASS (Program Compliance Assurance and Status System) which iS
part of a NASA {agency'-wide) System lntegrffy Assurance Program Plan.
PRACA and TIPS are described in Appendix 2. The survey conducted in
1988 by Baker and Dunbar showed that a trend analysis was judged highly
desirable:
1. To monitor the performance of the TPS in order to ensure conformance
with design requirements
2. To ascertain long term effects of TPS-related procedures (repairs, etc.).
3. To enable engineering design changes to system failure,
i
The participants to the survey indicated that there was a need for a single
us.-_r-friendlydata base including all useful data and, in particular, results of trend
analysis.
They would want to have routine access to this data vla a local PC or
_.
i
I¢
. ....:..
;
•
".. ": ", .
.
"
" "
•
:_, ".
'
.. _ .
-.
""
_.
•
"". ....... '_: _'
"
"_ .... ""
"
,'."
" -°.'i:..
.__2". ..... '_" '":'"
'
I"
_'39Ud
bOOES_£_O_
BO:ET EO, _0 _3_
Pat_=-CorneUand Fischbeck
I
i
terminal. As we show in section 4, the risk-criticalityindex that we have developed
=
'
l
can be an important part of the record for trend analysis because it represents the
J
,
. +
relative contribution of each tile to the probability ofLOV due to TPS failure. These
probabilities can be updated on the basis of new information and the resultscan be
I
I
encoded for all tiles that share similar, charactedstt_.
1
I
I
1
I
I
I
, k
i
!
,+
't
38
............
_
=_p_*'_.-t._'.VTfh
II
I
11110 1_1"3 I I
klTt'_t7
U("tJbl
.....
-
!
:_,,_
:_
"
:i;
6:8
:
.
.,.
lqSneo _ou spuoq a^!pelep 'A.L8 aq_to uojleJo!Ja]sp wJa$-lSUOlXq pasneo _a_Ol
el!l Jol _.unooo'ewe_.s,tsel!l e41I.o sasseu_l'ee,'__q pasn'eo uo!lonpeJ /[l/oed_O
;(wel_sAsaou'ep!nl5eq_,jo uo!punEew GaG^asol 8np 'aldLUeX8jc),c)
46noaq_.-uJnqJO e.ml!et aH_,o:_6ulpeal 'sal!l eql to sa!_.!l!qedeopeuS!sap a4_.peao:(e
I
[
i
:
_ew aJniPJedwel _luaeJ e41.;'et4_.
elq'e^!aouooOSl'es! 1.1",(Isnoau'e_,lr_W!s
pe6'euJ'_p_q
ueo ¢81iil'eJe^a_
'JeI_o
eql 8u!t414
sl,tqep aql to/(&laue pue 8z_seq;
uo
_ulpuade(3
p
,
q ....
w
•
-.,
,
* . , .
,,
•suqep. .coeds
s! /_o881eo s!ql u! papnlou! OSlV "(ao! pue uo]lelnsU! e^!_oe_ep)
, •
.
..
s._elsooqle_locu PJlOS841,pue. _u'e_.l_walxa e41 _oJt ,(H,sow '$!._qap ,wo# ue_q
se4 sSuioeOl I'eU._e_xe
a^!ssaoxa to ,(l!Jo[emls_^ 841 ',(ll"=o[aolS]H '.,gOl_el.eo
_,sJ!teql
t5 l.a_qns-e .:.se pa_,eeaI
s! es_o
8141,.'Apn_ss!q_,
Ul. , "el!l
peua_ea_
e _.osso eql •sasne,o
. ,
,,
. ,,
:
• ... ,
.
,
. ..
,
*
,-.,
nn_
n
.
':::" .
.- :
• I
".
l
_
'el!l papuoq-Ila_ _ Io 8_ot aql eCneo ol. 4Bnoue a_8^88 lou Speol leWel.xa a_aq,_
,
s, (o_Ie4_Iouoqeu,quaoo
_)Xi,llqissod
P,!ql
V
•
.. "
i_
".
_
•
'(io_dw,
suq_p u_4_,
Jeqlo
:
'
.': ,1, :.
s_oloetol _,np 6utpuoq'ep)we_s_s eUI a4_ u( 8essau_ee_ _q. pasneo speol _ln_,J
'_
[
i.." :'.
-:
"!
"'."." ". '".-'_i
_::_:
"?
• '
""
"
" " "
"
"
:
:
"
"
:"
Jepun.SSOle[[1..(_')
speo!
8^lssaoxa
Xq pasne_ SSOl_l_l
..
.... .. ,; pu_
:
• . , . i_,uJa_x8'
".
.
.-..
• (_):sauo_al_:o
. ...
: _:}:
o_, olu_ PaP!AlP 8q .11t_._8u8_
ueo ewelqoJd aqJ. 'Xl_oedeo e41 paaoxa speo _41
,
ua4_ s_noooa_nlte=l "uJa41PUe_sq!!_o_iql_u_al_)_oed_,o
s_!pue
al!__8ql.uo
_PeOlto
'
'
"
" "
"
:'_" I
" '
"
""
UO]I:eU!qLUO0
eql Xq peu]waalap s! eOewep
o.1wal.s,,(sall; e41,(oXl!l[q?ldaosnS
I
, .
:
: :
"walqoJd aql _o6u_pue_,saepun
aq;.e:re_,H_oe:
gem ;xs].uoo _l#nqs aoed8 #41.u_ash Jla41'./_!l!q,e,'.,i,'uns
_,equ_oo
l.j.e._o,_.ie
t0/_pnls a4;.
ul• pez_p_epue,
X_,q_qeJauln^
pue ,(lIHqfldeo_nssw4al
eqI ""pe.unoooseq
. ._. ,.
. ls ueaq. e^eq ...':
,.
,
' "" " ,i" "
'. -. •
"
"
a6ewep el!l. aouo e ].l.nLl_a41to_X#ffq_euln,_pue e6e.w_p ol Sal!].eql _.oXl!llq!,zdaosns
. .
'
. •
ot,l .,uopassq
s! allinqs aoed8aqljo (8d.£) We:l.8,(suoqoa;.oad18_Je41.
_....
•
.i. I
r
..
•
.
.
,
._."
.'..
eql i ].o s8111No_lq 841.Got laPOW(V_q)
luewssesse _lsu oH,sq_qeqoJd ,toO
I'
'
'
_1=ltqe_autn^..
,
pUe _t.lllq_l
.d'aoenS.
:
I,'E:
I
83711 3H1, 1:10=1
"laqo_
t
V._d =JHI 40 NOIldlEIO$_]CI
:_:UOl_Oe8
"
I
I
i
I
:,(oeq4os!,.H
pueila,U_OO-_ed
i
FEB {aS ' 0.3 13:09
202358300?
PAGE. 42
I
Pat_-Cornell and Fischbeck
4_
,
durlng installation,
and tile bonds Weakened due to imProper maintenance.
procedures, waterproofing, and spills,._These weaknesses
=couldaffect a single tile
I
(tile resting on its filler bar) or a group of tiles (use 'of a weak batch of'RTV). Tile
,
'
susceptibility can therefore be reduced by controlling the external
debris, improving
I. I
tile
installation
I
and maintenance'
procedures
I
'
and developing new tests
I
=
(non-destructive pull tests and other types of tests) to ensure bond verification. ,
4
]
Another approach to reducingthe susceptibility of theI tile system that will not be
considered in this studywould be to harden the iiles so that the impact of e_ernal
debris would not cause any damage. Extensive use of RCC would be one such
1
q
t
solution, but at the cost of a significant ir_creaseof Weightand design complexity,as
well as an enormous additional expense.
,
t
.
The vulnerabilityanalysis starts withthe premise that a tile has.been lost for
whatever reason, then proceeds t0 analyze the effects
of this loss on the shuttle's
i
performance and safe return. Of primary concern in this phase is the layout of the
,,;hurtlesystems immediately belowthe shuttle'sskin.. A heating or burn-throughof
the skin could cause the loss of various hydraulic Jines,computersl fuel tanks, or
even a weakening of the structural integrity of the spacecraft. Also includedin the
vulnerability analysis is the effect of an initial loss on the surroundingtiles. When the
TP_ was developed, it was feared that one hole could lead to adjacent tiles peeling
off because of reentry heating (the so-called zipper effect). This phenomenonhas
riot occurredin the two instanceswhere tiles have actually been lost. Yet the loss of
a. tile clearly causes a local turbulence and exposes directly the side of the next
tile/SIP/R'I-V system to high loads (forces and heat). The probability of loss of a
secondary tile, althoughobviouslynot equal to one, is still higher than the probability
of loss of the first tile in a patch, If not checked, the loss of subsequenttiles could
I
lead to exposureof a muchlargerpatch of the shuttle's skin. The vulnerabilityof the
orbiter could be reduced by moving, hardening, or increasing the redundancy of
v_dous critical control systems. if the tile damage can be discovered priorto reentry,
then, in some cases, the vulnerability of the shuttle could be reduced (either by
:_
{
40
¢tT"A
qq:cI
£00_ £
qg4
•
q
,JOO£SS£_OE:Xe4
w£J6OJd NI(]O USUN
i
"I
Pate-Cornell
andFischbeck
t
i'
I
" ,
protectir_g the exposed patch or by rerouting, draining, or securing exposed lines
and t_nks.) ,In addition, by ch'ang!ng,the reentry flight profile of the sh'uttle, it may be
possible to reduce the temperatuie of some weak, vulnerable areas. The sequence
I
'
of events that is studied in this analysis is shown in Figure 8.I
J
(
DebrisDamage
,
'
I
'
J
ReentryHe_,lin
9
•
Maffun_ion
Lossof_hutt!e
L,.
Debonding
Causedby
Lossof Addillonal
Factors
Otherthari•Debris
Tiles
..
• + ,
,
Figure 8: Event diagram: fa}Jureof tt_eTPS leading to LOV
+
'
,:
J
I
The structure o( the probabilistic model used in the analysis (Figure, 9) fo!!ows
closely that of lhe elements presented in Figure 8. It includes: (1) initiating, events
(probability distributions for the number of tiles initially lost due to debris and to
i
+
l
,_ebondingcaused by other factors), (2)finalpatch size (probabitity distribution of the
i
i_umber;of adjacent _les lost conditional on the loss of the ;}rst tile!t (3) burn-through
(probability of burn-through conditionalon a failure patch Of a:9i_.ensize), (4) system
i
i
loss (prObability of Iallure of systems under the skin conditional on a burn-th?ough),
_Lnd(5) loss of orbiter (probability of LOV, conditional on failure of subsystems due to
burn-through,) The
analysis is thus done using the usual mix Of probabilities
estimated through
frequencies, and of subjective probabilities when needed (e.g., for
J
the probabilities of failure of subsystems under 1he skin for which no formai PRA
studies have been done). Bayesian lormulas were used to compute the probabilities
of different Scenarios as described further in this section.
Note that, in this study, we did not account for excessive heat loads (above
the design criteria) causing the burning of a tile due, for example, to tile design
problems or to a malfunction of the guidance system and/or the control surfaces.
,+
7•
:
,: .
•
-,. :.+..+
•
41
..........
-+_"
._
.-
. ,
.
Pat_-Cornell and Fischbeck
l
i
INITIATING EVENT
©
_
BURN.THROUG H
_
,__._.
.
i
_
I
I
!
2
0
'2_,
n
_
•
",_"
• ,
Q
Discrete random variable: number of initial tile==Io,_tdue to debris
Q
Discrete random variable: number of initial tiles lost due to debonding
®
Discrete random variable: number of s,dditlonaltiles lost given initial tile damage
!
Continuous randomv_iable: sevedty of burn-through given a.patch size el ml$sing tiles
Q
Binary randomv_r_ble: subsystem failure occursgiven level of burn-through
Q
Binary random variable: LOV occurs given loss of subsystems
Figure 9: Event tree of LOV due to TPS failure
42
_.
PatE-Comell and Fischbeck
I
r
I
i
i
Although this •failure' mode may contri_utelto the 9v_rall risk of iallure of the orbiter's
TPS, it was considered here that these initiatinQ events now have a fnuch lower'
probability than
the loss of a tile dueI to debris damage and]or debonding caused by
I
other factors.
,t
:,
I
'
•
-:
1
I"
I
We did got acc0unt'for depender_cies'among the' p.robab[!ities Q_failures of
subsystems under the skin dUe'{o TPS failure; for ex&mple, two redundant elements
of the hydraulic systemcould be cdppled during the _ame flight by loss of tiles in two
different locations. The probability of such simultaneous failures was considered to
be too small.
Finally, we did not account for dependencies among tile faiJures
caused by the repetition of the same mistake
(e.g.,
from the'same technician)which
•
{
,
Uec0mes acommon cause of failure (foJ'example, additi0n of water to the RTV mix
•
,
=
I
_
.
_md treatment oi several tiles.) .This concern' will .be Part of•the second •phase of the
_udy.
, :
(
=
"{
_:2 be_finltion _9f .rnirl-zones
i
' I
-
t
i
':
',
,
Because of the factors described above, t_e black.ti!e system cannot be
treated as a uniform structure. Debris is more likely to hit some parts of.the orbiter
than others, different bonding matedats are. used in different a_'eas,temperatures
va,'y considerably over the surface, and critical subsystems are located only in a few
areas. Therefore, for this analysis,the er_tiretile protectionsystem is subdividedinto
smaller areas, called here min-zones_such that all tiles of a spat/fie m/n-zone have
thd=.same level of susceptibility and vulnerability.
Depending on the .number of
dN_criminating characteristics, the number of tilesin
each m/n-zone could
conceivably vary from a single tile to thousands. (An alternative approach would be
to categorize each tile individually with regard to susceptibility and vulnerability, but
.since most adjoining tiles have identical characteristics, this level of detail is not
ne_,ded.)
'
i
Pat*_-Cornelland Fischbeck
I
t
,i
The definition of min-zones is cl'itical to the analysis. _The number of factors
used t'o delineate the rain-zones determines
the complexity of the problem.
_ I
,
As an
initial cut, we define a rain-zone by four factors: (1) susceptibility to debris impact, (2)
I
'
I
potential for Iqss of additional tiles following the Iols of the I first one (depending on
i
heat and aerodynamic loads), (3} potential for burn-throughgiven
I
I
;
one or more
I
L
missing
tiles (heat loads), and (4) criticality of underlyingsystems. For this study, it is,
I
i
I
assumed that the probability of debondlng caused 'by, factors other than debris
impact ls uniform over the orbiter'ssurface and does nbt require a separate p_rtition
o1this surface. As mentioned above, it is also assumed that flight profiles will not
I
expose the entireTPS to severe tempergtures that would exceed their specifications.
3.21 Debris classification
"
' '
In order to account for the fact that debris damage during ascent is not
uniformly d!stributed across the' underside of the orbiter;, the black tiles are
partitioned into three debris areas such that all tiles in'a particular area have roughly
'the same probability of being initially damaged by external debris. The definitioh of
these debris areas also accounts for thei fact that some areas are more sUSCeptibleto
being hit by large pieces of debris that will damage several adjacent tiles
simultaneously.
To define the debris zones, we plotted all known debds damage from,the first
33 flights on a single shuttlelayout (see Figure 6.) These data came from J. W.
McClymonds (1989) at Rockwell in Downey. Areas with similar damage intensity
were grouped together into high, medium,a.ndlow debris damage areas (see Figure
'10.) An estimated probabilityof tile damage due to debris per flight wasdetermined
by dividingthe number of hits by the number of tiles in each area and by the number
"
of flights. • A similar plot and calculation was done for all damage to black tiles over
c,neinch in size. (Historically about one fourth of the damage has been greater than
one inch in size.) It should be noted that the only missing tile to date caused by
debris is in one of the ,high debris damage areas".
'
f •
44
Jw'J
JC-CT
CN('_7 C
QOJ
'
JNNC_CC_N_:X_
W_JGOJ_
N_QO
_S_N
FEB
_5
'_3
(q:xapu!)
sauozspqep
josedX_aeJq_o_u!go_Nnssja$!_ooq)_ouo!_,!U_d
:01_JnB!=l
13:11
Pat6-Comell
andFischbeck
I
Based o.nthis analysis,the proba,bilities of a specific tile receiving any debris
damage were asse,ssed as shown inTable 2. The probability of multiple tile
damage wa_;calculated using a typical six-inch I_ysix-inch square tile and estimaating
the percentage area within a 1/2rnch border, that would allow for other tiles to be hit
simultaneously witl_sufficient energy to cause ,significantdamage.
•
Debr_sArea
_
High '
I j
"
-
P(Sin91e tile hitl
i
. Medium
Low
'3x'10. 3
5x10 -4
2x10. 4i '
4x10-5
.2x10-6 '
3xl0.&
?
,
10 -z
P(One of two tiles hit)"
8xl 0-4.
P(One of three tiles hit)
7xl 0-5
_
,
|l
:
•
i
i ii
i
Jim
"P(one 0f x tiles hit) = probabilitythat a particulaitile is in a groupof x adjacenthit tiles
Table 2: Probabilities
of debris hiis in th_
dtffer0nt areas shown in Figure 10
i
i
Translating this information into the probability that a specific tile will be
y
knocked off or so signtficantl damaged• as Io .burn.off during reentry is a more
•
'
t
I
difficult task. It is logical to assume that the probability•0f this level of da_nage is the
ratio of the number of destructive hits to the total number of hits in the past, Since
one tile has been lost out o'f roughly two thousand significant debris hits, it is
proposed, in this siudy, to use an Initial e'stimate of 1 in 2,000 (5x10"4) for the
probabilitythat large hits woulddestroya tile's insulatingcapabilityin the high debris
;=.reas. Slightly smaller probabilitieswere used in the medium and low debris areas.
The probabilitiesof tile lossdue to debris hits for each tile in each area of Figure 10
I_avebeen further allocated as shown in Table 3. For example, the probability of a
.,;ingletile loss in "high" debris area is the product of (1) the probabilitythat the tile is
,:.
hit by a debris, (2) the probabilitythat the size of the hit is greater than 1"conditional
c,na hit and (3) the probabilitythat the tile Is knocked-offgiven a large debris hit.
46
C_-_'
I
OC'.('_T cnnx c
oa4
_.
>nncRc;gZ.NT.:xe-I
II
Ill@J_13Jc_
NI_O IdS_N
j
Pat@-Comelland FLschbeck
I
Oebri_Are_ _:.
,
High
•
(
'
Medium
LOw
I J
P(Single tile lost)
1.3 x 1,0-6
1l_-7
P.(Oheof two tiles lost)*
10-7
1C)-8
P(One of three tiles lost)
10"8
_
10 -9
:
,10-9
'
0
I
0
'[
I
=
'
'"
I
' P(or_ of x tiles lost) = proloabil_ that a particulartiie is in'a group ofx Iadjacentlost
' •'
tiles
Table 3: P[obabil}ties of tile.loss due t__e_:is':in the different areas shown in Fig. 10
,
Bu rn-throu0h •Class iflo_ti
on":"_'
; ;)i, "
_,2.2
i
In a similar fashion, the tile_ are Ioartitioned .into three bum-through
(see
areas
Figure 11,1 The piobability 0:ia burn-th/'oug.h
' 'is dependent on two factor, the
temperature that the surface reaches during :i_entry (and for how long), and the
'
.aQ/lityof the unprotected aluminum:skin to dissipate the heat build up. The denser
_and stronger the structure under:the
burn-through.
skin, lthe greater the capacity to resist
In both cases Wher_:t es hare been lost, burn-through has not
I!ke!ihood of burn-through. The:pro:b;'a_ilitiesShOWninTable 4 were estimated from
ii7formation provided
by
Robed
bf NA_\A;:Johnsonapace Center in Houston.
•
• .;
."'i;.::
.Mai'j&_
".:,'_':
:_.-'.:,.c:
Once again, these are O.n!y.cog/see_timatesi:_;:!
%.
.
J_urn-through
Area
High
- ..
P(Single tile lost)
Medium
, . '/,
' 0.2
P(One o1two tiles lost)*
P',One of three tiles lost)
L9 w
,.....
0.7
0.95
0.1
0.001
" 0.25
0.7
0.01
0.1
"P[one of x tiles lost) = probabilitythat a particular tile is in a group of X adjacent lost tiles
Table 4: Probabilities of burn-through due to tile loss in areas shown in Fig, 11
..._......
.
..,
.,'"..
47--__ ;
..;...
.- :
_..'
-
• ":"...
...
.
Pat_-C<_rnelland Fischbeck "
i
I
i
I
J
i
I
I l
i
i
i
r
i
I
I
.I
•
':
' _]
I
High probabilityof burn-through
E
_i
Medium
pri_babil_tyof burn-through
;
•1
..
r-l
.Lowprobabllltyof burn-through
L
i
Figure 11: Partitionof
the orbiter's surface into three types
"
of burn-through zones (index: k)
+,-
t*
....
--:. ....
i
......
+
.,..
" :
. .
..
" : ":
6t+
'
...;.'.:..
•
__
"
. ....:.
:. • .
.-
'
•"Sal!_
_ueo_fp'e
a4__o X_!l!qeJauln^
_uanbasqns
aq_ uo pu_ paSgwep
_oez!s eql
euo woJ_pe_s
_ll_!_]u! sel]_ Jo j_qLunu
aq_ uo spuadep
qo_gd.sJnl!g_
"ez]s wnw!x_w s;! paqo_eJ _eq pu_ (SSOlel!_I_!_lu!)lUeAe 8u!_!l!u!
_q_ Sal!__SOljo dnoJ8 _ se peu}_ap _! qo_ed mnl,leJ V
t
_ _unB!4 u! uMoqs s_e_ ui ss61 el!$ I_!_!u!a1 anp
_-O_.=.(_sol:elI_
guo
1_SOlel!_ I_UO!_!PPV)d. :(sP_oi_ol)
_ euoz
- .
,
.
,
.
,z-Of.
= (ImOl
elIl
auol _,sol
el!$
leuO!1.!PPv),=l
:(_Peol
q{_!q)
I euoz
--
i
l
.
' :".:.,.;i.,C:."...
;- • :
.W...
;
::_:"
-k" "
• :,.
.._;. ".'
_'_'_'"
--.t r
._"
.,, -,
:
J
• " •
,''%,
,
,
•
":
"":"
,
•: .-'.:.,.....:.,.;.;,
-":"
.;
._:';.:
t
..-i
?.
::
;i:-.:
".o_rSeVSVN wo_ epel,9
_eqol:4
Xq
'
I"
.
"
"',':-.
!"..*-'::'.:'-.'.'_{
:.
' ':'".
"'_".'i.":'."
..........
l,
UgOB[pg
_0'X_llIqeqoJd
eq;,(ql_Lhi$pi"8
q I_ _a_ _o I81q/agpuooes
o,_;eq$'Xpn_.
'
:/(!:-.?':_::
i : ' ; ::...-._/.
"
S!ql Ul "aAOqgS_SXI_U_q_noJq_-,uJnqbq_u_pgsnsge_e eJn_eJed_uelaq_o_ pe_elaJ eJt_
sge._e SSOlglq _puooas
eql 's_qi";O esneoa8. "_-hOO9a^oq_ Ue; II!,_ puoq A.LU eqJ_
'
" '.-: . ',"-;'-
'dn-pHnq _gaq eq_ a_dls_lp
_o eseg_ou_ s=ql
" ," ':,.-.i_-
"
o_ ui_g:.a'q_,to _(_il!_ea4_ uo spuadep osie aJn_eJadwa._
"_ol; Jeu!wel @q_io uoqdrusip eq_ o;:anp Bill _u_ss_w e puno;e
,'., v?
JrlO00 I_Lt_ saJn_'e._edwa; /u_uaeJ pesea.,ou!eqkjo uo!_eJnp pue apn_(u6ew aq| uo
pu_ saoJoj o!weuXpo_ae aq_ uo sPluadap ssol ali; leUO]_!ppe_o XIH!qeqoJd aLLL ('_l
seeJe SSOlel!l
,_epu6oe_ o_i Olul pep!Ajp s_
'$81[; luaoerp,
.
. Ja;_qJogql
.. •
.
.., ......
•
.
eJnSl_.4
aes)
•
to Ssol eqi 5u_sneo elq a'lBU}Se i O I'_,_U8;od eql Jol ;unoooe ol JapJo Ul
,
.:.. :!.,.,
", 5ot;eo_yss.e#
s,so I el,l• _epuooa_8_'$
I
I
...
.
"X_o6eleo
4Bno_q_-uJnq
..
I '
I'
qS!_ aq_u! padnoJ5 eJa.,_gee.reo,_1gseq; 'eJnleJedwa:
O_,q!AI)!SUBS
J/By{_oasneoeq
}
'Ja^e_OH
"q6noJqI-uJnq e ;noq;f,,_ ua^a I!'e_ plno,_ pug saoua'._e;#!p eJnlgJadLuai
O_ a^l_lsues, ,{laWaJ_xa s! sea_e .asoq; u! eJnlonJls aql
g 'Supleads Xl$Opls';ou s! slql
"wg!qoJd qOno:ql-u_nq
"ease qSnoaq_-uJnq
qS!q eq$ u!I Ou!aq se pale}ou
#
ugeq aa_q Jg.88 ,6ulpugl u!'eLu aq_ _o pJeoq' u! _sn[ sga._e o_ eq} leq_ a;oN
,
I
I
I
'_
'
_oaqqos'H
pu_ ilawoO-fled
I
FEB 05 '83 13:12
2B2358300?
P_GE.S2
PatE-Cornell and Fischbeck
,ii
!
i
I
I
=
I
J
=
j
I
I
I
P
m
'
high probability of'secondary tile loss
low probabilit 'of secondary tile Iqss
I
Figure12: Partitionof the orbiter'ssurfaceintotwo types of
secondarytlie losszones (index: I)
r
50
_'q'_
_q:gl
gNN_ q
Q_4
)Ang_qg_N_:X_4
I I
_i
W_J_OJ_IklTGAH_HN
I
'_
Pal_-Comell
I
and Fischbeck
:o
i
t
tl
'_
3.2.4 FunctiQn_,t
criticati_'yclassification
The ,varying criticality of the subsystems
,
of the orbiter-located
under the
aluminum skin is handled by partitioning the tiles into.three functional criticality
areas.
:
(Jnce a burn-through has occurred, varieL)s systems would
be exposed to .
!
extreme heat and would fail. If those systems ware essen'li_l for flightl their failure
coul'd lead to the loss of the erbiter.
By examining.the
Io_ation of critical'systems,
(electridal, hydraulic, fuel, etc. as shown in Figures _3, 'an'd 14}, three areas were
identified (Ngure 15). The forJowingprobabilities were' estimated by assuming' that a
•D.urn-thrcughwould cause an area of four square feet around the hole to be exposed
:to hot gases.
.
j ,
,
i
• ':
i.i
Area of high functional cr[tic'ality:
'
P(Loss o! OrbiterI Bum-through) = 0.8
Area of medium functional cfiticali_y: P(LosSI0forbiter I Bum-through) = 0.2.
,
Area of low functional criticality:
P(Loss"of orbiter I Burn-through) = 0.05
Table 6: Probabilities of LOV Conditi0_aJ0n burn-ihr0ugh in functiohal' criticality
•
areas sh0wd'in Figure i.5
3.2.5 Oebon_ina caused bv fac-lor_:other tl'_i:ndebris imoact
In this mode[, it is assumed
that the probabil!ty of debonding
factors other than debris impact is the same for arl tiles,
caused
by
in reality, the location of
,;creed, thin SIP, and gap filler, as well as the age of RTV, and the temperature
and
pressure zones would affect the probability o;f debonding. Short of conducting
considerable additional research, this simpJification should be adequate.
Again, the
..
*
.
,
_
probabilities used for illustration are only coarse estimates that are intended to
'_
i:rovide an idea of the relative magnitude of the debonding problem to the debris
problem.
Another relationship not considered
directly in this analysis is the effect of
weak bonding on the susceptibility of a tile to debris impact. A weakened tile is much
more likely to be dislodged b_ a medium-sized debris hit. For the purposes of this
:,
..
II
51
|
f.
([:xBpuOkkl_ot_,!Jo
118UOl_Ur__0 9_UOZ _0 sBd_ _.OBJq_,O),UlBOI_JJnsS,jB_!qJOeq TM,_0 UO!_!U_cI:_ L eJigS!-I
.)
)_o_qLiosH
pue IIBwQ'3-@ICd
FEB 1_5'03 ,13:15 ....
,:-,: , -
::
2(_23583807
PAGE.1_3 "
Pat_-Cornell
and Fischbeck
I
I
I
]
t
rr_odel,with its •uniform distribution of d,ebonding,this factor i_ included in the debris
J
i
[
analysis
t
i t
l
I
Of the approximately 130 000 black tiles that have been installed at various
I
times on all the orbiters, 12 have been.found during maintenar)ce to have no bond
other than through the gap fillet. A complete..analys{s of tile capacity, as revealed by .ii,
I
I
I
I
I
"_
the maintenance observations, will be i_art of the second phase of t_is work. We,
al;sumed, for the moment, that about half of the unbonded tiles that are held in place
"
t
bi_the gap fillers ha_e been detected: by now, either because of visible slumping or
b=_.cause
they have been replaced for ether
reasons
such
aS' debris damage (about
";'"
t
'
I
"
25% so far have been replaced.) Those with'rio bond tt_a.thave not been detected
s3. far are those that have not yet sho_'n visible s_gnsof wea.kness and ha_e"not '.,
n/Jeded replacement.
-'
,
i
":
'
d_
1
i
i
_
i
David Weber from KSC estlmated that a tile with thls:.weak a bond _vo_ld :
have a probability of failure of*one in a hundre_ (i0 "2) per flight, making the 'o
I:,r_0babilityof debonding of !his kind, for &ny tile', io be appro.x!mately9r0 xlO,7 :p.er
,
f!fg'ht. Estimating the probabilifle_ for the other4ypes of debonding.(exc!uding
1
tho._e .,.
., caused by debris,impact) is'mgre
I
subjective. We used a previous Lockheed study of
: bored verification (see _gUf:e 16) and confirfned the results during discussion8 wi!h "
[)avid Weber,
This study gives relative values of the probabilities of different
debonding modes. Following these results, we assumed that chemical reversion of
the screed and weakening due to repeated exposure to load cycles are less likelyto
rause debonding, and we used a probability of failure of 2 x 10"? per tile and per
flight. As a further simplificatlon,these two probabilities. (weakening due to repeated
,.-'xposureto load cycles and insufficient bonding) are assumed to be.independent
and can thus be added,
In actuality, poorly bonded tiles or tiles resting on soft
_creed are likely to be much more susceptible to this kind of weakening.
Using these
_alues, the probability of losing at least one of the tiles due to debonding cause_ by
other factors than debris impact, on any flight, would be a little more than 0.02, which
• ,:''-,'.
#CI'_I
7.1]:t7"[
_'_f')Z
q
£_4
•
5"5"
'"
:
"',
"I00£8££_0_:X£_
,..:,.
.- ,'" • ." .
".
W_JdOJ,-I
'
,
klTCtm uou,,
":.....
.. c '.',"
/;'U'"
•
TILE
BOND
VERIFICATION
FOUR MAJOR DEBO"n
"nn-_ I,,_,
-rv,=_
I1" m _ e-..',l_,
;'_J'LOCk_
"
-
"
..
_
Ld
I1_
m
DEBOND
GAP BETWEEN
•
•
o_
O_
TYPE
SIP AND
FREQUENCYOF-OCCURRENCE
RISK
FACTOR
FACTOR
(I- liJ)
(1-1D)
PRIORITY
SAMPLE
PREPARED
.
Lr_
RTV
DRIED RTV
SIP RESTS OH EDGE OF
F|LLER BAR
9
Io
ii
IO
_
/
!
X
X
C;AP BETWEEN RTV ,AND
KOROPON/AI SKIN
•
SURFACE
PREPARATION
"FUZZ BOND" -PARTIAL
OF RTV INTO SIP
• . RTV
•
a-9
PENETRATION
.5
7
2
3 "
3 "
_
CURE RATE
MISMATCH
OF SIP
•
X
AND FILLER
BAR
-_
X_-
--
X '
"13
. --r_
O
Cl
,-
~
-
,
RTV
CHEMICALLY
REVERTS
3
B
•
_
q
=.
c_
-_
Figure16: Fourmajordebondproblemtypes
Source:
R.Welling.
Lockheed
Corporation
(19891
Reprocluced
bypermission
--
_"
-
_
,R-
N
lxJ
I
I
j
t
Pal_-Cornell and Fischbeck
1
'
th,_,nimplies t_at over 35 flights, the probabflity of losingat least
one tile on one of the
iI
flil;hts 'iSa I{t_leless than 0.50. This Jappears reasonable based on historical events
,
and the one missing tile.
' '
_
,
,
,
t
I
I
_3
=
"
t
PRA model: definition of vi_rlables
'i
'
' Throughoutthe rest of the analysis, the areas.define_ in the previous'section,
are indexed as follow:
, ' ;:
I
,I
•
i:
=
h:
j:
k:
I:
Index of mEn-zones
Indexof debris areas
Index of functional cr_tlcplityareas
Index of burn-through areas
Index of secondary tile ioss areas
'
,,
7
Note that a double subscript (e.g., jl) represents parameterj
(criticality.in this
C==se)
of mln-zone i and that the term "debonding" refers
to "debonding due to factors
/
oth:erthan debris impact".
:
n:
nl:
N:
Ni:
q:
M:
m:
Ft:
FajFt:
D:
$:
L:
P(X):
P(XIY):
P(X,Y):
EV(Z):
.,.
Total number:ofblack tiies on the orbiter
Number of tiles in rain-zone i.
Total nu'mbef of min-z0hes
Number of failure patches in mEn-zonei.,
.,
Index for the failure patches in any min-zone
Final number of tiles in any failure patch
Index for the number of tiles ina failure patch
Initiatingfailure of a tile
Failure of any adjacent tile given initiating failure
Number of adjacent tiles In initial debris area
Number of adjacent tiles in initial debonding area
• LOSsOfVehicle(LOV}
"
Probabilityof event X
Probabilityof event X conditionalon event Y
Jointprobabilityof event X and event Y
Expected value of random variable Z
This analysis follows closely tits structure of variables described in Figure 9.
Two types of initiating events are considered: those caused by debonding, and those
c:ausedby debris impact. (A third category, failure of the tile itself due to heat loads,
Patd-Cornell and Fischbeck
may be added later.}. It is assumed that the two types of initiating events are
probabilistically independent, Since each rain-zone has its own set of characteristics,
•
:
,.
,
-
,.
they are treated as separate entities. Tiles in ea'chspecific rain-zone have the same
probability of being initially damaged
and of causing a larger failure patch,
t
burn-through, damage to a critical system, and the loss of the vehicle. Because of
these assumptions, the analysis determines first il_e probability of losing the vehicle
I I
I
fcJr each type of initiating 'event and each 'rnin-zone. Tt_eoverall failure i_robability Is
the sum of the failure probabilities for all zones and initiating events. Debris impacts
are considered first. ,
,
,
L
i
:
i
_.4 Initiating event: ip.ltipl debris Impact on one tile only fD=I}
To determine the probability thata specific tile in min-zone i starts a patch
c'ue to debris impact, it is also
necessaryto cbnsicierthe size of the initial damage.
i
We consider-first the case where a Single;tile is'initially damaged,
Throughout
e;ection 3.4, it should be remembered that the probability of initial tile failure in
rrlin-zone i, PI(Ft), should be read as Pi(FtlD=I).
Next sections consider Pi(FtID=2)
I
=lnd Pi(FtlD=3).
These additional levels of initial damage (two and three tiles
.,_lmultaneously)are combined later.
Once the first tile in rain-zone i is lost due to debds, there is the potential for
=adjacenttiles to also fall. The probabilitythat the final patch _lze reaches M depends
Dn the secondary loss index of the rain-zone (lii and is given by the _ollowing
geometric distribution (which means that M-1 additional tiles fail and no adjacent tile.
afterwards:)
Pi(M j Ft) = P_i(Fa]Ft)M-1x [1-Pjl(FaIFt)]
(1)
Note that M must be at least equal to 1. This equation assumes that the
•_ probability that adjacent tiles debond does not change as the patch grows.
58
,L.
-,"
<
.
L_
II
l_PIOt'{ (JfJ.l,l_ r l U_II
.,
;."
.
.
•
mi
_I)I
.
, •.,
- "
.
---
" "" "
6_
, . . _
" k" ::
:sMollo_
s_ (t=O)padua!s!JqeF)
Aq pe%_!_!u!
'!euoz-uFuu!'I_I
ez!__o qo_d e o_ enp eJnH_;Jm!qJo_ose!%Ii!qeqmd
,
e_1 eu!lepeM 'seeJsq6noJql-u_nqeql jo xopu!e4),s!)Ipu_ saeJe. ,&)!I_o!)!;:_
..
eql ;o xapU!eql s! [l_ql 6upaqtueLue_j "XlUOel!l ouo loe'dLull_ql suqap ol anp i!_; Ilia^
Jal!q_o aq_lsql/4!l!q_qo_d eq; elelncl_O ol alq!ssod nou s!_!'_JnsaJs!ql ue^jO
[
/
'
• ' :N iO UOllnq!;ls!Paq_,1oU_SLUeq_Xq Ua^_ s_qolgd qoea to ez!s eql Pue
i
'
(¢)
fl)'d
x
I
,,
,
J
:/;le_ewixo_dda
slsoqoi_d_oJequJhu
pe_edxa eql'SUO!_dLuns_g
. .: : ,'_
",esa.q_'uo peseB
_ ....
:: -. .....!.-..
"selqeug^uaopue_
.
_uepuedepu)paJepl_UOO'
.
.
e_e {saqo_d
Io ez!s)_ pue (_eqo_d1o_equJnu)
!N'oslv.luo)pe_gdLuoo
alq!_!l_eu
peJaplsuc)o
s!euoz-u.)tu
q_ea u) Isolsol!l 1o JeqLunulegal
eql_l_nbeqot_ (_)A_ x (.)N)A=3
_npoJd aql
•
'(!u) euoz-u/m qo_a
u! sel!_ to J'eqLunu eq_ ol.peJ_d_oo
I
, I
IleLU_ g[ (I_}
lue^e6u)le_l)u)
u_ ;o_lI qgqo_deLI1
asneoeqsaL_oled
lo8udcJepa^o
,oueq 11_ a_aq_
l_qlpu_ luapuaaapu! em seJr_[!et'
81!1Igl.l!u!aql lgql seuJnssi_uo!;elnLuJol_!LI.L
]
r
'
'
(_)
t
'
i(!N-!u)i!N
IN-!u[(_-t)!d-l]x !N/I_)-_d-"
i!'u,
•
I
:
= (iN)._=i
!
)
I
)
" )
"
_
:_! I auoz.u!u_u!,!N sa_ea_ _eq_ed
_oJequJnu
aq$ ;eq; _!l!qeqoJd
I
i
Oq.l. "_u!_els,saqoled lgJe^as to _!l!q!ssod a4_ sI aJaql 'eUOZ-U!LU'
qoea Ul
f
I
¢
,-
_1
_oaqqos!jpusilgUJOO.Ole¢l
FEB g5 '03
13:I?
++ BO"3gUW
_O0_BS[_O_
J
+
Pat_-CorneJl and Fischbeck
/
It mustI be remembered that any given rain-zone could
have several patches,
•
i
in ii, and each
patch could be of a different size. To calculate , the probability Of
i:"
_ "
I
oF_iter Jossdue to specific numbe'r of patches (Ni) in rain-zone i, th,e following
u
,_ I
"
d,_.fi.mtlon+
is necessary. Let P'ibe the probability thai an arbitrary patch in rain-zone i '
+
I
c_.usesa failure.
t
' '
" P'i= _ Pj'ki,m x P (patchsize = m)
,
I
(-
(6) '
L
P'i = _ Pj_i,m x Pli (FalFt)rn't x [1-Pli(FalFtl]
..
_
(7)
Therefore,
q being the hum,her of patches in a .given rain-zone, the fai-lure
i:l..'obabilityfor a specific number of patchesin a rain:zone is:
PI(LJNi=q) = P't.x q
,
'
(8)
Once again, this assumes that the probabilities are small and that'the patches
will not. interfere with each other (they are assumed to be separate and
independent). These assumptions are valid providing that each' rain-zone has a
=_ufficientlylarge number of tiles and that the size of the patches is relatively small.
Based on Equation (8), the probability of orbiter failure given all patches that
t)ccur in rain-zoneI becomes:
:
O0
P(Llmin-zone i) = _ Pi(L]Ni=q) x Pi(Ni=q)
ao
= _ P'i x q x Pi(Ni=q)
q-O
= P'lx EV(Ni)
= p'ix nix Pi(R)
(g)
6O
t:
'I
I
Patl}-Cornell and Fischbeek
t
j.
i
i
.'
i_
'This result represents only the cases of debris impact causing the initial
•J
,
i
failure of a single tile. A more complete rewriting of Equation 9 highlights,this fact:
i
J
:
...
(
P(LJmin-zone i, D=I) = p'i(D=_l) x ni x Pi(FtJD=l)
'
(10)
I
I
.I
I
I
3.J;
."
I
Ihitiatinq event: _lnitipl d_bris imDact on severel
" ' ' tiles /D=dl
In order to expand this model to include the pdSs'ibilitythat the initial debris
impact damages
equations.
more than one tile, it is.necessary
to modify some of the above
It is assumed that if a large enough piece of debris hits the orbiter,
several adjacent tiles may be knocked loose at once.. Each of these missing tiles
may in turn cause their adjacent tiles.to fail end _ Specificnumber of additional tiles
'
can fail in maltiple Ways. _Therefore,a.ddiii0nalSurrimat_onsare requirecl in order to
ac:6ount for the increased numbe'r of exposed tile&
requires thatEquation
'
This,c6mpounded problem
(1) be r_written to ia_ccouni'forihis potentially larger patch
g_bwth rate. If the initial damage involvestwo
tiles, the. prcba,
bility that the fir_alpa.tch
..
..
•
reaches sizeM is:
" .....
": ....
_'
J
J
Pi (MIFt,'D=2) = (M_2+1)x Pli (Fa]Ft)M'2 _[i-Pll(galFt)]
2'
(11)
ff three tiles are damaged initially:
M-3+1
Pi (MIFt,D=3) = [ _E_
i ] x PJi(FAIR)M'I x [1- Pli(FaJFt)]
3
i=1
(12)
If four tiles are damaged initially':
M-4-+1 •k
ei (MIFt, D=4) = [_
k=l
_
_ i] x Pll (FalFt)M'4 x [1- Pli(FalFt)]4
(13)
t=1
.___ _ --.
:.:.
61
•
:
%' = "_:
....
.•
:
k.
Pat6-Cornetl and Fischbeck
j
i
I
J
This set of equations can
be extended to include greater initial damage;
i
historical evidence', however, supports limiting'tge,analysis
to this level. It must be
=
I
_'
remembered that the value M of the final patch size must always be at least equal to
the size of the
in.itiatdamage area, O.
Equation (2} In its most general form is wdtten:
I
[
,
Pi(NilD=dl =
_Lnd Equation
,I
Nil
Pi(FtlD---d)NI'
x [1-Pi(FtlO=d)]ni'Ni
I
I "
.nil
(Ni.ni)l
'
(_) becom_G:
(141
I
_'
I
I
I
EV(Ni)_ ni x Pi(FtlO=d)
, ;
=
(151
i
i
Equations (51and (6) do not change
ex,cep,t for the indexing of the summation
I
_.
_ince their results depend only on the final'1 pa,tch,size and the functional criticality
index. Equation (7) would change as Equations (111 to (13) are in!egrated to
account for )he various debris damage areas, The final probability for each initial
damage area and min-zone is computed u,singa variant of Equation 10:
P(Llmin-zone i. D=d)= p'i(D=d) x ni x Pi(FtlD=d)
,(16)
I
Because all the initial damage probabilities are very small, it is possible to
approximate the probability of debris causing loss of an orbiter for all damage areas
In a particularmin-zone by:
Maxd
P(Llmin-zone i, debris) = _E_P(LIrein'zone i, b=d)
o=I
(17)
Once this probability is determined, the probability of orbiter failure for all
min-zones due to debris impact is simply the sum of the probabilities of failure for all
min-zones since all rain-zones and initiating events are assumed to be independent:
62
i
_j
'
Pat&Comel| aridFLschbecl_
I
_
N
:
p(Lldebrls) = _E_P{l'lmin-zone i, debris) •
' ;"
,
I'
_
3.1_ 'lnitimting •event: debondina
,
I
c_used bv f_ctors other _'han debris
•
l
t
.
'
(18)
J=l
i
I
'
I
J
.
•
_
I
I
J
The same procedure and basic formulas are 0sod to determlne the
,
I
probability of orbiter failure due to debonding caused by factors, other than debris
.
irnpacL
Again,
the probabili_tyof orbiter failure due tO f;_ilu,reof the TPS is computed
; .
,
frc,..31
the probability
of tiles spontaneously debonding
of
various sizes in
,.
.
..
.
'
, in groups
''.
.
e_,cl_rain-zone. Tl_eproblem is slightly easier sinceiti; assumed that the ;ikel_hood'
of such debonding is Lmfformacross all tiles. The pro.Dabilityof secondary tile failure
:;'"
..
_
...
-
..._
.
' .
P (FaJFt) is the same as for the d_bris prob!em;
-
,
,The probability of orbiter failure
'!lSE,;edon
all: patches in
rain-zone
i tb.atstarted
from •adamage area of initial size s is
•
., .
,
,
, .
" -. = given by:
.
.
f
I
.
=
]
. ,
i"
•_
P(Llmin-zo.nei,
S=s) = p'i(S-s} x ni.x Pi(Ft[ S=s)
,.
•
=
,
.
:
.." _: :
,
(19)
_"
The other equations follow accordingly. The total probabili_ of shuttle failure
for•damage initiatedby debonding caused.by factors other than debris impact is:
N
"
p(Lldebonding) = _ P(L]min-zone i, debonding)
(20)
I=1
Finally, assuming independence of initiating events (debris and debonding
due to other causes),
the overall probability of shuttle failure per flight due to tile
d;-_mageis:
P(Lltile problem) = P(Lldebonding) + P(LIdebds)
(21)
Pat8-Cornell and Fischbeck
i
i
i
i
I
I
3:7 Additional Information end data
A PRA mode,Ilike the one described
ab'ove,needsto be constantly updated to
i
reflect informatio,nthat may have existed before but had not been uncovered at the
time of this initial study, and ,information from new experience including recent
inspections', tests, evaluations, studies, and in-flight performance, data.
implementation
In this
phase, more t;efined datJ_ may
" thus be used and additional
'
I
t
I
'
,
Information available at NASA can be
introduced in the' analysis. One i_port_.nt part,
i
¢,fthe problem at that stage will be to capture the evolution of the failure probability of
the orbiter. Clearly, ,the system is not in a steady $_ate. On
one hand, the quality of
I
the maintenance work appears to improve (Figure 17).
_'
Initial defects of the
Installation worki that resulted in a decrease of the tile capacity are progressively
being discovered and corrected during successive maintenance operations. Exis_ting'..
,t
l_roblems, such as the impact of chunks of insUlar.ionfrom the ET and theSRBs or the
_.=levon-covedesign problem, are resolved as'they are discovered. Of1 the other
I_and, the. possibility of long-term' deterioration of the= TPS clearly increases the
I:,robabllity of tile failure (even if slowly) and the rpte of deterioration is a major
i
i
'jnknown. Of specific concern are: the possibility of degradation of tha bond over
T_me,of Slow chemical reaction due to water proofing agent, and
t
of weakening of the
SIP/tile system under exposure to repeated load cycles. Additional data regarding
(
the initlal test results used In the certification procedure from JSC and from the
manufacturers of the tiles, the SIPs, and the bond are needed to update the model.
Therefore,' this updating should be based not cnly on statistical data on tile
performance during each flight, but also on basic informationaboutthe components
of the TPS.
A complete analysis of the distributionof tile capacities will require additional
data from maintenance operationsincluding:
= The numbersof tilesreplaced so far on each orbiter;
°
A statistical distribution of the percentage of the surface of the tile/SIP
system that was found to be actually bonded to the orbiter's skin;
64
{,
i
_'3_Ud
_00C8SS_08
8_:£T C0, $0 _Ba
i
i
I
•
Pai_-Cornall and Flschbeck
= Estimates of the probability of failure of a tile of given capacity (e.g., 10%
boi_ded)under different ! kinds
of load (e.g., debris'hit >1").
P!
6
I
-
'
SUCh ae:
f
.
A more refined partition of the orbiter's surface can; be obtained using,data I
J
°
Effect of excessive step and gap on the heat load in different locations;
i
°
_,
i
i
,
I
Possibility of partial failure of the guidance system or control surfaces at
re-entry and corresponding increase in the I_eatload;
= Trajectories of debris from the ET and the SRBs. Computer simulations
I
_
done at JSC (see Figures 18 and 19) could give better information about
the vulnerability of the orbiter's TPS, in particular in the most risk-critical
areas;
°
'
Measurements of temperaturesand aerodynamicforces on the surface of ..
the orbiter (see Figures 20 and 21);
°
_,
_
Effect of tile loss on the orbiter's surface temperature in the cavity {Figu_'e
22).
i
The analysis itself can be refinedin several ways. A maior unknown is the
performance of the subsystems under the orbiter's skin once they are exposed to
_=
excessive heat loads due to TP$ failure. The only alternative, short of a systematic
I-_RAof these individual systems, is to use subjective estimates. Finally, It seems that
the availability of a kit for in-orbit repair of the tiles might provide a significant
_,
i-eliabilitygain. An assessmentof its effectivenesswill be Includedin Phase 2 of this
:study.
-q
66
Ascenf, Debris
Trajectory
Simulation
'
I>
Moch no. 1.05
Alpha
-3.00
-Beta
0.00
_
II
is
i=
)
)
,I
h
)
-
.'
""
'"
-
Roy J Gomez
NASA Johnson Spoce Center
Advonced • Programs.Office
0
o
October
1986
Figure 19: Ascent debris trajectory simulation (plan view)
._
_
"
¢3
"
_
6
G
Source:R.Gomez,NASAJSC(1988)
LI
"-
F..
*t_
_
;r,
r",
r,
_"
r'-.
•,
_
70
_
,_ I.
FEB
g5
I
'03
13:28
1
;
I
i
2823583887
p_
3_
7_'BS_d
&00S8SC_0_
T_:E_ ;'0, S0 _3J
•
i
_
'
Pal6-Cornell
andFischbeck
I
i
t
jF
I
,
i
[
"
' ' Section 4:
-'
,
,
'
ILLUSTRATION OF THE MODEL
I
'
I
,
_
t
The illustration of the model presented here is baaed on coarse n'umbers,
whose relative values are more significant than their abs,Olut'e
values. IBy overlaying
the functionalcriticality,burn-thr0ugh,debrisdamage, _,nd_
secondarytile loss areas,
3,'3rain-zones were established. Of these, 21 are unique zones (i.e., that have
L
c_ifferentsets of indices). Several zones with the same combinations of indices'
_.ppearon different locationson the orbiter. Figure 2_3shows the finai layout of the
r_in-zones and the numerical results Of the model. Each zone is assigned fan
_
i__'tentlfication
number. The lower numbers are generally assigned tot more critical
=Lreas. Each zone is also identified by an index number whose digits relate to the
=
fcur area types shownin Table 7:
,.
,,
1stdigit:
Burn-throughareas (:1high, 2 medium,3 low, probabilities)
2 nddigit:
Functionalcriticalityareas (1 high, 2 medium, 3 low, criticality)
3rddigit:
Debrisdamage areas (1 high, 2 medium,3 Ic_w,probabilities)
4th digit:
Seconda_ tile lossareas (1 high, 2 low, probability)
i
=ll,
Table 7: Structure of the indices of the min-zones shown in Figure 22 and Table 8.
Table 8 lists the rain-zones, and shows the number of tiles in each zone and
the probability of failure of the orbiter attributable to this zone. This value was
determined by calculating this probability for both initiating events and then summing
to obtain the results. The boundaries of the rnin-zones have been simplified: the
number of tiles in each area is only an approximation and is not based on an actual
count. The location description is only intended to provide a rough placement of the
72
(,
Q:2121
7:1311
;3322
2s:ZZ12
33:3332
17:232,
:2321
Figure 23: Partition of the orbiter's surface into 33 rain-zones (index: i)
'_
_-_.'A
:_O:tT"C
COOK S qa__
73
LOO£SS£COC_Xe_
-. , ..._
meJ6oJdNI(]OUSUN....." "
Pati_-Comelland FkchbeCk
:
I
f
'1
1 11i
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
Right side, under crew
156
111=1
1121
1131
1211
1311
1311
1331
2112
2121
2131
2311
2311
2312
2321
2321
2321
1
Right side near main Idggear (aft)
Right side near main ldg gear' (fwd)
Left side near main Idg gear!,
Centerline under crew
' ,
_
Left side, undercrew
Center of rightelevon
'
Center ot left elevon
,
Rightside, fwd mid edge
Center of body flap
Left wing, center
Rightside, midedge
Left side, mid edge
Leftside, fwd mid edge
Rightside, nose
,
Left wing, center
Rightside, body flap
156
676
780
364
3t2
104
104
624
208
468
1664
1196
572
277
832
104
2321
Left side, body flap
2321
2331
2331
2332
3112
3122
3122
3132
3132
3222
3312
3312
3322
3332
3332
Right wing
Left side nose
,
Leftwing, fwd
Rightelevon, outboard
Right wing, center
Left wing, center
Center, payload bay fwd
Center, payload bay aft
Rightwing, center
Center, payload bay, mid
Rightelevon, in board
Rightwing, center
Left elevon in/center body flap
Left elevon, outboard
Center, aft
,
0.87
0.36
0.87 0.36
0.13 1.62
0.00 1.87
,0.51 i 0.22
0.11 0.04
0.04 0.01
0.00 0.00
t.73
0.75
0.02 0.24
0.00 0.56
0.30 0.13 '
0.21 0.08
0.10 0.04
0.01 0.02
0.01 0.06
0.00 0.01
0.01
1.23
1.23
1.75
1.87'
0.73
0.15
0.05
0.00
2.46
0.26'
0.56
0.43
0.29
0.14
0.03
0.07
0.01
104
0.00
2132
312
1768
312
364 :
468
1664
1976
468
520
312
416
728
572
1040
0.16 0.16
0.00 0.02
0.00 _0.13,
0.00 0.02
0.0.1 0.O1
0.00 0.01
0.00 0.02
0.00 0.02
0.00 0.01
0.00 0.00
0.00 O.00
0,00 0.00
0.00 0.00
0.00 0.00
0.00 0.00
0.34
0,02
0.13
0.02
0.02
0.01
0.02
0.02
0.01
0.00
0.00
0.00
0.00
0.00
0,00
5,09
-11.88
6,79
0.01
Table 8. Identificationof the rain-zonesand theircontributionto the probabilityof LOV
74
_,
_,
,L
L
_"
;
¢
Pat_-Comell and Fischbeck
I
I
"_
I
I
I
rain-zone. No attempt
has b_enI made to use orbiter notations. T_e f;nal numerical
I
re'_u)tsof the model are presented in the right-ha,halco)utah,as multiples of 10-4. .The
pr,:,babi_ityvalues are mostly in the order of 10 "4, Again, it is important io rem_mbe'r
th_.t the jrnportance 'of the numbers
is not their magnitude, but their relative values
t
when compared to each ot_er. According to our coarse numerical analysis, the total
pr:,bability of losing the orbiter on any give_, mission, due to TPS failure, is In the
order of 10-3. It is interesting to note th'at approximately 40% of this probability is,
at Lrib'utable to ,debrls_related'lSroblems and that 60% comes from problems of
debonding caused by other factors. B'yscanning the columns, it appe_.rsthat a few
rain-zones contain mostof the risk.
,
',
i
Using a risk-per-tile measure, ttle rain-zones can 'ble ordered according to '
-
"l
'
their criticality with respeci to the twot types of initiating events, and to the total
probability of failure'. The _'esuttsare s'hbwn'in Tables 9 and 10. Table 9 Clisp]aysthe
contribution of each rain-zone and of each tile to ihe prbbabilffy of LOV separated
into debris and debonding due to other factors. Table 10 shows the contribution of
e_ch tile and each rain-zone to the overall probability of• LOV. In this tals,
le, we, show
r
fc,' each tiile,a risk-critica/ity factorthat is prooortionalto the relative,
. co,_tributionof
tl-.istile to the overall failure probab!llty,aecoun{ingnot only for the •loadsapplied to
this tile but also for the consequencesshould it fail. This risk-criticalityfactor is the
point ol reference that will be used in the second phase of the study to set priorities
among different managementmeasures designed to improve tile reliability.
A slightly differentgraphic representatlo'nof this table is displayed in Figures
24, 25, and 26. It is possible from our (esults to identify the mostsensitiva mln-zQnes
"
b_, ranking them by order of individual tile criticality. One can then plot the marginal
increase of the failure probability for each _zdded rain-zone, the slope of each
segment representing the (decreasing) contribution of each tile to the failu_'e
probability. Each black dot represents the addition of the r_ext most critical rain-zone.
"Thegreater the horizontal spacing between the dots, the larger the number of tiles in
i
i
i
Pal_-Cornell and Fls¢hbeck
Debris
'
;
ID#
P(LOV)/zone
O.OOE-4
.L
P(LOV)/tila
O.OOE-8
*
;
Debondin_g ........
ID# P(LOV)Jzone'P(LOV)/tile
O.OOE-_,
O.OOE-8
I '
L
'
i
•
I
1
,2
9
5
6
7
3
12
13
14
10
19
23
17
18
15
16
4
0.870
0.870
I1.730
0.510
0.110
0.040
0,130
0,300
0,210
0,100
0.020
0,185
0,010
0.002
0,002
0.003
0.008
0.000
55,770
55.770
27.720
14.010
3.,365
3.365
1.923
1.785
1.781
1.748
0,961
0.867
0.274
0.192
0.192
'0.108
0.096
0,000
4
1.87'0
3
, 1.620 I
1
0,360 '
2
0.3601 '
9
0.750 '
11
0'.560
'
I
10
0:240
5
0.218
6
0,045
7
0.015
15
0.023
12
0.'130
1 6 = '0.065
21
0.133
14
0.043
20
0.023
Z2
0.02"3
19
0.156
24,000
24.000
23.100
23.100
12.000
12,006
11.500
5.990
1.440
1,440
0.829
0,781
0.781
0.752
0,752'
0.737
0.737
0.673
118
20
21
22
24
25
26
0.000
0,000
0.000
0.000
0.000
0.000
0.000
0.000
0.000
0,000
0.000
0.000
0.000
0.000
17
18
13
23
24
27
26
25
0.007
0.080
.0,005
0.006
0.006
0.024
0.019
0.673
0.66"9
0.137
0.128
0.128
0.121
0.114
0.038
27
28
29
30
31
32
33
0.000
0,000
0.000
0.000,
0.000
0.000
0.000
0,000
0,000
0.000
0.000
0.000
0.000
0.000
28
8
29
30
31
32
33
0.002
0.000
0.000
0.000
0,000
0.000
0,000
0,000
0.000
0.000
0.000
0.000
0.000
0.000
I
,
L
t,
E-
,_
_.
(
Table 9: Probabilitiesof Loss of Vehicle due to tile failure initiated
•
(1) by debris damage and (2) debondin9 caused by factors other than debds,
for each rain-zone, and each tile in each rain-zone
76
i
98"-S,_.
Ud
L,OS_'SSEZE_8
88";'T_0,
St3E[EL_I
i
•_
Pat6-Come'll
and Fischbeck
I
I
i
_, ID #
P(LOV)/zone
O.OOE-4
p(LOV)/tile
O.00E-8
', ! ,
Risk
Criticality
0-100 scale
NUmber of
Tiles
Location
1
1
2
1.2300
1.2300
9
2.4800
3
il , 4
5
1 0,
11
6
7
.
12
14
!"'
;I 3
.
_: 19
.15
"" , i 6 "
_"
1 7 "_.
18
21
20
22
;
23
'
1.7500
1.8700
0.7280
• 0.2600
0.5600
0.1500
0.0500
•0.4270
0.1430•
0.2930
0.3410
0.0260
0.0'330
0.0090
0.0090
0.1330
0.0230
0.0230
78.8"00
• .
78.800
39.70=0
25.900
24.000
100 '
•.
156•
1l under
100
156
rt main gear aft
50
624
rt fwd mid edge
33
30
6i6
,780
20.000
25
12.500
12.000
4.810
16
1.5
6
6
104
2.570
2.500
2.450
"1,600
0,938
0.877
0.865
0.865
0.752
0.737
0.737
3
3
3
2
1
1
1
1
1
1
1
_ .1664
0;412
0.0060
0.0060
0.0240
0.0190
0.128
0.128
0.! 21
0.1
28
0.0020
8
0.0000
29
30
31
32
33
24
27
.26
25
1
,'
'
center crew •
body flap cen'
277,_
832
;104
104
176 B
"'
31i
'"
,
i rt'elevon
midedge
It fwdmidedge•
It middle
rt side
,
rt wlpg
rtnose ....
Itwing..0u_o.ard
bodyflip
rt
body"flapIt
It
nose
d eleven out
364
'rt wing center in
1976
Itwingcenterin
rt Wir;gcanout
center ba)_ aft
<1
1664
center upper bay
0.038
<1
520
0.000
<1
104
0.0000
0.000
<1
312
0:0000
0.0000
0.0000
0.0000
0.000
0,000
0.000
0.000.
<1
<1
416
<1
"14
<1
!
It w!ng Iorward
<!
<1
<1
'
,
can
312
468
468
,
,
w_ w,_ _n o_,,
It crew
572
1196"
2132
i
It main gear
4.6.8
312
4.810
0.0150
n main gea'r
, ' 364
208
.
crew
I center mid bay
It eleven center
It
eleven In
728
It Wingcen
It elev/bodyflap
":
572
It eleven out
_i:i
center aft
i
1040
Table 10: Risk-criticalityfactor ior each tile In each min-zone
.r
t
Pat_-Cornell and Fischbcck
i
I
J
I
the zone.
Several small rain-zones contain
a laroe part of the risk (those with the
i
st_epest slope), whereas severa.lvery,large rain-zones
carry only a small part of the
=
i
risk (those with ,zero slope).
_
Figure 23 Shdws the contribution of incregsing,
percentages of the tiles to the risk for debris-initiated damage. •Note that, for failures
initiated by i:lebris,' 80% of the risk is due to,only 8% of the tiles.
I
For
debonding
'
L
I
pro,blares that are not caused by debris, the cbntr_butionof increasing percentages of
J
I
I
tikes are shown In Figure 24: 80% ofI the risk is due to '13% of the tiles. IFJnally, the
overall result is shown in Figure 25: for the total risk, including both initiating events,
8(_.% of the risk
can b,e attributed
to 14% of, the tilds.
'It is Important
to remember
that
(
th_ same tiles do not necessarily appear in the same order in each graph. Clearly,
some zones pose a much higher risk for one type ot inlt[atir_g,eventthan for the Other.
Ft_r example, rain-zone 4 located near the left main gear has not historically
..-
e:_perienced significant debris damage and'is not on the obvious trajectory of
tractable debds; so, the probabilityof LOV due to TPS debris damage in that zone is
basically zero. There are, however, some critical COmponentsthat are temperature
sensitive under the skin in that area; so, the risk of I LOV due to debonding is non
negligible (1.07 x '10"41.
_
I
<
100
_
..........
80
---
-
.....
.
•
60
_
"
40,
0
0
10
20
30
40
50
60
70
80
90
100
% tiles
I
Figure 24: Relative risk of LOV due to debris-initiated TP$ damage
t
78
8_" 39Wd
600_BS_0_
a
l
Pat&Cornell and F_chbeck
I
I
i
f
8
, ,.,
i
"n '.
_:
I
I
'
I
,
i
'
;>, ; 40
.,_
20,
,
•
'
.
!
. ioq
0
30
J"
,
o
, "
20
70
_"
40
50
,,
% tl
'
i
1
•
60
70
-;'
.
80
90
1(:0
.-. :.._.
..
,
Figure 25; Relative risk of,LOV due to debonding-type TP8 dgmage
.'+
,.
._ ::": :
';_'.
, - :.
J
i
.= i I
.g
i0.1,
01
0
10
20
30
40
50
i"
60
70
80
90
100
% tiles
Figure 26: Re(ativerisk of LOV due to both types
of TPS damage
. .
o
.
.
..
.
",..
.
•
"
":_ •
.,
•
:.:i,.-i .
79
n
p
...::..
_r',t',_._"_t_._'Tt'_.
..',. '.,-'_. ._
YO
I
IIrD
"
IRI-I
:._
IJ
klT_'_l_
" ::' .:,=...,
•
::-:....
I..JQI.Jkl
,.,.
C
Pal_-CorneU and Fisohbeck
i
I
I
i
I
i
_
I
I
f
II
t
Section 5:
EFFECTS OF ORGANIZATIONAL FACTORS ON TP$ RELIABILITY:
MAIN PRELIMINARY OBS'I_RVATIONS
J
=SJ Errors pnd risk _
Well-bonded,tiles
loads.
•)
(
'
<
debris
(2
I
,
are very untikely
lo debondS, even under
moderate
Given th'e temperature gradientsI measured inside
the
tiles during flights, it
. L
.
h_s been determined :thatthe tiles absorb most of the heatI within a fraction oftheir
thickness and that they are very unlikely to burn, even considering a wide range of ,..
r_.=-entry
scenarios. If the tiles are to fa.il, It is likelyto be because they have been
[
weakened and/0r
hit by debris. The
problen_is•that
one does not know Whichones
I
,
I
_re weak. Human
errors (past and present) are at the source of at least three of the
i
fundamental causes of tile failure: (1) decreasef" of tile capacity because of
<
undetected Partial or weakened bonding, (2) increase in the heat loads
due to
t
roughness of the orbiter's sudace (caused, for examp e, by protrudingigap fiilers);
and (3) poorly-installed and maintainedinsulationon the SRB's and ET that flakes
off during ascent, damaging th'eTPS. These human errors are often/he consequences of the way the organizations(NASA and itscontractors)operate.
In the second phase of this work, we will expiore to
;)rganlzationa/
procedures
what extent
(for instance, those that induce time pressure and
'turnover of the personnel) are at the mot of these incidentst
Rules that apply
uniformlyacross tiles of widely variable risk-criticality,and rules that do not account
for the possibilityof system weakeningover time rhay become major contributorsto
the overall risk. Furthermore, the scope of the research cannot be strictly limited to
1heTPS. Proceduresand management decisionsregardingthe maintenanceof the
insulation of the ET and the SRBs also affect the reliability of the tilessince they are a
8O
t
Pat_-Cornell
andFischbeck
i
I
J
1
I
r
source of debris. Finatly,
in'theI long term, weakening
Cf the tiI'e s_'stem due to
I
•
I
repeated
load cycle_, exposure
.
'
i
to envxronmeotal
condLtions on the ground,
b.r
chemical reversion, may become a dominant factor of the failure dsk. The pr_blem
of cletedoration
over'time may not be (and is not likely to be). of immediate concern
I
for well-bonded tiles,but ma'ybecome a Criticalfactor for those tiles whose capac!ties
have been reduced by defective installatio; and maintenance. Therefore, in the
I
I
I
•
second phase, we will examine closely the procedures of the organlzatioLn,using our,
PRA model to s,ee how the rel_t}ve contributions pf e_ch
of these factors affect flight
t
I
,- ,.
"
t
I
J
I
.:
In addition,
the structure of the organiza.tion and its.peripherals (NASAl plus
.,
. ,
Lockheed,
Rockwell etc.) and the nJles that deterred'he the relations among these
or.qanizations (for example, in setting contracts;,
'
' paY scales, and incentives, as well
.as schedule and budget constraints,)may h_ls_affect flight safety,to the extent that
t.h_y determine the occurrence and severity of human errors and their probaSilities of
detec!ion, Some .organiza.t.iq0alimprovements,(whicl_may have been recommended
before and ignored for various reasons) .may' have 0nly. a minor ei,fect.,o,nthe
re:.iabilityof the orbiter; others may be essentlarsoon'.
Ouraoalylical _odel will be
used to determine which of these
factors actually affect the
probability
of failure
of the
:
. • ,
=*.
.
..
. .
t!if_s.(and consequently,
of the orbiter) and by how much.
Finally, the culture of the
o(ganization may also play a role. As we describe below, the low status m' the tile
w_rk may induce
low morale among 'som.e tile technicians.
Furthermoi'e,
.the
be.haviors of other workerstowards the tile
techni.c!ans.maybe a significant source .of
additional work load and rimepressure.
Errors (most of which can be traced back t9 these organizational factors) can
b,s classified using a taxonomy which has been designed to guide the choice of
management improvements (Pate-Cornell, 1990.) Errors are categorized into two
groups: gross errors (uncontroversial mistakes, for example, an unbonded tile) and.
.¢r[ors of judgment under uncertainty
(for instance, the decision :to live with a
"
t
i"
Pat_-Cornell
andFischbeck
i
I:.roblem thati seems minor --but maynot be so-- until the next flight in order to
clecrease the work load.) Gross errors
generally call for Improvements of the hidng
I
r
, (i
and training procedures, inspection and quality control, and information'flow; errors
of judgment generally require modification of incer_t[vesand rewards, improvement
f
.i
3
in the treatment and communication of uncertaintiesl and adaptation of the resource
I
]
i
constraints.
,
,
I
L
i
t
.=.;.2Preliminary
observstion8
In this preliminary phase, we identified the following factors as possibly J
affecting the efficiency of tile risk mahagement: (t) time pressures,
(2) liability
J_.oncernsand conflicts among contractors, (3) turnover among tile technicians and
h_wstatus of tile work, {4) need for more random testing, and (5) contribution of t'he
_,'i
_;_anagementof the ET and the SRBs to TPS reliab!lity problems. The study of these
'factors will be the object of the Phase 2 of this work..The foundation of this analysis
'Will be the dsk-criticafity of each tile so that limited resources --for examl_le, the
limited number of tile inspectors-, can be directed first where the probability andthe
;
I
cehsequences of tile failure could be most sevi_i'e.
5.2,1 Ttrne pressures
Tile maintenance is often on the critical path to the next flight, specially after
missions where tile damage has been extensive. People who find tl_emselvesunder
time pressures sometimes cut corners. For example, it was found in January 1989,
that a tile technician had added water to the RTV mix in order to make it cure faster.
Adding water at that stage (or spitting in the RTV) may decrease the long-term
reliability of the bond: the catalytic reaction, which occurs during the curing, may
reverse earlier and thus increases the probability of debonding under different types
of loads. Time pressureis also probably the cause of more frequent errors,such as
{;
the misalignmentof the tile/SIP system with the filler bar, so that only a fractionof the
i
surface of the SIP is in contact with the orbiter's surface. Time pressures may be
unavoidable, but some organizational improovementsmay attenuate their effects,
82
', "
'
Pat6-Oornell and Fischbeck
t
z
I
"
fir'_l, by reducing them whenever possible and second, by increasing tile quality
control in thej i,'mostrisk-cdtica(zones.
I
. .
I
I
'
.
.
' 'The time
pressure under which the tile , persb,
nnel. operates can be reduced in
)
.
,
I
i
J
•several ways. First, automat/on of step and gap measurement'
(using laser devices
I
at,d
'automatic data recording systems currently under dev_10pment)may r_'sult not,
I
I
I
or_ly in 'a significant reduction of the processing t_me,' but also in a decrease
of the
r0clghness .of the orbiter's surface. Second, simplify[fig the paper work for the tile
te,:hllicians would allow them to spend more time working on the tiles and less time
''
I
st_uffl[ng papers (an apparent source of frustration). Third, it seems desirable to
avoid over monitoring. For example, imposing daily targe:ts(aS opposed to weekly
grtes) lot the number of tiles to be processe_d.m:_y'decreasethe variability and the
fle_!b!lity needed tor optimal performance ,and system reliability. , Fourth, time
'
pressure may be alleviated by reducing the access
time to data bases and
m
iq'_ormationthat is necessary for prompt maintenance decisions. The maintenance at
K;._Cis done by Lockheed, while sor_e of the relevant data bases are Contro)ledby
Rc.ckwei.
want to Jmprbve the
..
. NASA may
.
. • transfer of informatior)
...
. frorn .one to the
oI!ler and/or within these two organizations.
i
•":!: .
'
'
5.2_2 Liabilityconcernsand conflicts amonocontractors
Relatively harmonious relations have been instituted among the people who
w_ on the tileS. They share a common concern for the safety of the system despite
ol_vious sources of conflicts. Flockwel! and Lockheed are In a competitive situation
which does not always provide incentives to make the other's work easier. Among
o':her factors, the liabilities of the main contractors are such thatthey occasionally
have Incentives towithhold technical information (for legal and contractual reasons)
that may be useful (if not essential) for the performance of the other. These•decis!ons
may be justified given the ways the contracts have been set. There are ways of
writing and handling contracts that improve incentives for cooperation
and
encourage the sharing of relevant technical information. This implies .that contracts
83
m
t
Pat(:-Cornelland Fischbeck
=J
I
I
I
that affect the same subsystems (e.g., the tiles) and are signed with different firms
caJ_notbe managecl independe'ntly. ,Thet positive,side
of I this competition amo,ng
t
L.
cow,tractorsis that.there are no incentives for Complacencyand strong motlvatio0s to'
delsct and correct errors made by the otherl There are, however, strong incentives to
bids those made by one's own company.,
,
i
I
•
, I
I
II
I
t
J
t
5.2._ Turnover_monotile technicians
and low_tatusof tile work, t
i
The turnover among the tile maintenance personnel is high. Because tile
technicians are classified in the low-pay category of h_aterial(fiberglass)technicians
•
.
_"
i
(a practice that NASA apparently inherited from the DoD), many of them leave their
tilt.=maintenance jobs shortly after completing the trainingprogram and obtaining
c(_rtification. Organization
experts generally believe
that high turnover is
_':.
incompatible with learning (individual and organizational) and optimal performance.
Therefore, this turnover might affect TPS safety' du6 to inferiorquality work by less
experienced people. Protrudinggap fillers, for •example,are caused by poor quality
L
installation and are a probable cause of early b0qnd_ry layer transition (Smith,
1!389.) This conditionmay not, in itself, threaten flig'htsafety unlessit is coupledwith
olher factors. It does decrease the overail TP8 reliability and may I_e _n adverse
|
result of high turnover and the.corresponding lack of experience of the work force.
.::.
On the other hand, according to some of the technicians, the old-timers may not be
a,_;respectful of "the book" as the newoomers. Assessment of the net result of
inexperience and complacencyrequiresa study of the coupling betweentime on the
i
"E
job and occurrencesof errors.
The low-paying job factor may have other indirect, negative effects on the
reliability of the tiles. Because of the low consideration that other categories of
t_chnicians seem to have for tile Work when doing other types of technical work on
tile orbffer (e.g., mechanical, or electrical) other workers do not pay sufficient
attention to the integrity of the tiles. They damage tiles frequently (if not seriously)
thus adding considerablyto the tile maintenance work. Therefore,'the low status of
84
_
S_:£_ $0, $0 83_
J
Pat_-Cornell and F'_ehbeck
the tile workers, grounded
in the r pay scale, may have several detrimenial effects: (1)
I
a waste of money in training tile technlbians
th_'t leave the job as quickly as possible,
I
,
(2) tow morale forsome of them, which is seldom conducive to high-qualitY workl and
(31 the "no i resp.ect",syndrome onI the part of other technicians who carelessly
dall_age tiles. The result is an increase of time pressure for a system .that is already
"
I
"the tong pole" a large part
of the time. I in_the
, end, these
.... factors may encourage
I
de':rlmental corner-cutting in,tile processing.
!
: ,
•.
t;
I
,
I
{
5.2.4 Need for more randornte_[nn:
•
•
-7
'
-
" I
•The original tile work and sub_;equent mainter)ance,work has not always
been perfect, soma of the tiles have been only partially bonded and, in &'.few
in_;.".ances,not glued at all. For example, 'in November 19891 it was found in that one
tile on orbiter Columbia had been holding fo_"se'veral fli0hts by the friction of (or
i
i
L
perhaps some NTV adherent to) the gap' fille'r_.The fac't that this tile held and did not
.cause an accident was call'ed "a 'mira(;le" .by thepersonnel
who discovered the
pr,._blem. How "miraculous" can be determinedusing
itle risk assessment model. (In
fact, accord!rig,to our estimate,.,the pr0bability of debendingis lO"2 per fhght"for,such
a ,t_le,
making
the probability
of debonding
in five ""flights in
the order
of 5%t)
Because
: '
" :'
,,'
,' , •
"
"7
_
"
of these, hidden weaknesses,. .it :may be desirable, to do more random,
•non-destructive pull tests of the black tiles ,between flights, focusing on the .most
ri,¢;k-crit_cat
,_reas of the orbiter's surface in order to detect and replace the tiles that
are far below the expected capacity.
In addition to the possibilitythat previous work may not have been perfect, the
possibility of long:term deterioration of the room-temperature vulcanized (RTV) bond
should be ackn0wfedged a.ndtaken into account in maintenance procedures, This
calls (1) for additional random testing to monitor the possible chemical degradation
el; the RTV after repeated heat-load cycles, and (2) for the development and
implementation of non-destructive and, if possible, nora-putttesting of the tiles' bond,
to, be applied in priority to the most risk:critical tiles.
'.'
Pat_-Cornell
andFlschbeck
5.2.5 Contribution of the manaaement of t'he ET _nd the SR.Bs to TPR
=
A significant fraction of the dsk of TPS failure is due to debris, in particular,
J
pieces of insulation from the external tank and the nose cone of the solid rocket
b,.'osters. In addition, tiles are much more likely to debor_d under the shock of
ciunks of debris when they are alraady loose or less than _completely bon_led. By,
backtracking the computer-simulated trajectories of p'ieg_s'Of debris irom the most
ri-=;k-critical
parts of the orbiter surface back to the corresponding parts of the surface
of the ET and the SRBs, it may be possib)e to identify whlch parts of the surface of
the
L
L
ET and the SRBs should be given speci_,l attention in the treatment of the insulation.
Additional testing should, therefore, be performed for tiles located in zones that are
n_oStlikely to be hit by SRB and ET.insulation debris_
'
L
i
J
For each of these organizational factors, the analytical procedure Is to identify
the decisions that they affect, the errors that they can cause, the frequency with which
they occur, the nature and the severity of the resulting errors as a function ofthe
.=_everityof the conditions, and their effect on the probability of failure of the system
using our PRA model. The efficiency lot possible management Improvements can
then be roughly assessed s'o that efforts are concentratedwhere they can provide
'._.
the'greatest benefits. This assessment will be the objective of the second phase of
tl_isstudy.
t"
86
Pat_-ComellandFischbeck
i
t
I
t
i
I
J
I
•
J '
i
i
I
J
Section 6:
:
'
'l
CoNcLusIONS
I
D
I
t
The results of our model's 'illustration suggest that the probability of loss of an
:
:
._
I !
: [
"
orbiter duet 0 fai!ure of the •blacktiles is ['nthe order 0_f10-3 w!th' about!15%'of ,the
til(;s accounting for.aboUt
80% of the risk.
If one accepts
the rough NASA estimates
t
•
i
th_.tthe probability of losing an orbiter Is in,the order' of,lO_ per flight (Broad, 1_O)
ard that a significant part of it is attributable to the main,engines, then the proportion
of*,he risk attributable to the TPS (abc)ut10%)
ISn0! alarming, but certainly cannot to
a
be dismissed. (Our
probabilities
are
coarse
numbers
that.can
be• refinedin
the
....
,
.
.
.. -..
• .
.,
,,
.
.
..
s_cond phase of the work, but they are probably,m
' " ' ,the bali park,) A critlcal issue is:
.h(_wwill these .probabil!tiesevolve in the ysa,rs to come? On one hand, the quality
of the tile work and the detection'mechanisms for defective
tiles are expected to
t
improve.
On the other hand; exposure to repeated',load
cycles aria environmental
c_nditions or chemical react on may deteriorate 'the system's,pefofmanCe capacity
"
unless
closely managed,
"""
":"
"
"
" " !
. -
t'
":
li
'
:"":
"
.
""
One of our key findings is that the most risk-crit[ca,I tiles are not all in the
hr.ttest areas of the orbiter's surface. We introduced, In this study, the notion of
ri,_k-critiCaii)y
and the computation of a risk.criticality index to account for the loads to
which the tiles are subjected and the consequences of their failures given their
It_cation with respect to other critical subsystems which they protect (functional
criticality).
This index can serve as a guide to set management priorities, for
example, for the gradual replacement of the tiles,L focusing first where tile failure
could be mostdamaging,
Well-designed. manufactured, bonded, and maintained tiles are extremely
unlikely to fail. A large fraction of the risk seems to be attributable to tiles that are
87
•
QC''.-I
"
7T-D.T
¢n_7
c
oa_
"
'
"" ":"" :'" "
.JnncRqczn_:x_.4
;"
" " ""; "
'
LU_J6OJA NT("IFI
H.C;HN
..:'-i':: "'"
,
Pat_-Corn¢lland Fischbeck
I
cr=_ypartiallybonded, or to those that are not bonded st air and are held in place by'
i
thE=gap fillers. Management assur_es unnecessary dsk by _enyin9 that errors have.
' _-
o(;curred and will occur again and t.hat, consequently, the capacity of 'the TPS is
reduced.
To. assume that all work is perfect leads .toe
}
'
potentially gross I
,
underestimation of the risk, rendering the maintenance proqedures based on this
a,;sumption
of perfection suboptimal. What the actual magnitude of this part of the,
I
_
ri,_kis and which organizational improvements can bring' the' greatest risk-reduction
benefits wi/J be studied further in the second phase 'of this study.
This pai't will
iri,.,olvea systematic analysis of the maintenance Process to Identify' the ¢llfferent I
types of errors (past and present}, their rates of occurrences.,their probabilities of
_-
detection and correction, and their severity levels (i.e,, by how much they decrease
the system's capacity in each case), Relating these errors to the organlzatiOdal
L
factors described in the previous section will allow us to identify .management
improvements, their cosfs, andtheir
expected positive effects on the TPS
performance.
{,_
After the completion of the first of two phases of •research, bur preliminary
c:onclusionsare that it is desirable: (1) to expand the current concept
Of criticality for
t
the tiles (to include functional criticality, as well as the heat loads in a risk-criticality
.C
measure), (2) to adapt the inspection and maintenance procedures to focus in
priority on the most risk-critical tiles, and (3) to modify the existing data bases to
include the risk-criticality factor for each tile.
:.
88
i
I
_ .1
Pal_-Corn¢ll
andFischbeck
f:
f
I
=
iI
I
I
•
I
I
,
Section 7:
•I
/
,
REFERENCES i
/
I ,
I
AviatiOn Week and Soace
r
.
Tg_hngl0gv.
Shuttle Orbiter To,Use Silica Ins,ulation.
,
' Janua.ry 28, 1976..
. .
,
,
Aviation: Week and _o_ee Techno[g_v.•Orbiter Pro.tective Tiles Assume Structural
'Role.
February' 25, 1980.
,
Baker E. aqd B. Dunbar: Thermal Protection System (TPS). Trend Analysis Survey,
• ;_ NASA Lyndon B. Johnson Space Center. Flight Orew Operations Directorate,
• Marc_h2,19881 "
: .
._
:.....
;
,
Brc.ad,W. J. NASA Now Admits It's Worried About Disasters. _SanFrancisco
AP !I0,1989.
8 9
_'T-I._.T
<",q,q7 ¢
n_J
,
....
Cooper, P. A, and P. F. Holloway.The Sl_uttleTile St0_;_Astronauticsan_
AeronautiCs. January, 1981, pp. 24-34.
'
. G_-lrrick,B. J. Quantitative Risk Assessment and the Space Program. Risk Analysis
Seminar Series, Department of Industrial Engineering, Stanford, California,
March, 1988.
Lockheed Research and Devetopment Division. Tile Bond Verification Shuttle
InspectionSystem (Rebecca Welling et aL) Pale Alto California, March, 1989,
Lockheed Space OperationsCompany. Orbiter Thermal Protection System Review.
Part II. Presentation by David Weber, Kennedy Space Center; November 7,
1989.
McClymonds, J. W. Records of Debris Impact and Tile Damage, Rockwell
International, Downey,.California, 1989.
"
National Res'earch Council. Post-Challenger Evaluation of Space Shuttle Risk
' Assessment and Management. (Slay Committee Report) National Academy
Press, Washington D.C. 1988.
Owbiter TPS Damage Review Team, STS-27R, OV-104. Summary Report; Vol. 1,
Feb. 1989.
P_Lt_-Cornell,M. E. Organizational Extension of PRA models and NASA Application.
Proceedings of PSA'89 (ANS Conference on Probabilistio Safety Assessment),
Pittsburgh, Pennsylvania. April, 1989.
Pat_-Cornelll M. E. and R. G. Bea. Organizational Aspects of Engineering Systems
Reliability and Application to Offshore Platforms. Research Report No. 89-1,
Department of Industrial Engineering and Engineering Management, Stanford
University, Stanford, California, April, 1989.
P;_t_-Cornell, M. E. Organizational Aspects of Engineering System Safety: the Case
of Offshore Platforms. _,
Vol. 250, November 30, 1990, pp. 1210-1217.
Presidential commission on the Space Shuttle Challenger Accident. Washington
D.C. June, 1986.
OP,'J
'
JNAC_'CC7A7.X_.I
III_.JI_DJjl
kIT(IN
HqI--,!I'.I
=
,
%J
Pat_-Oornell and Fischbeck
Rockwell International, Shuttle'System Integration. Debris Damage Assessmen
Summary,Downey, California, 1989.
R,:,ckwel}Internatiohal, Thermal' ProtectionSystem. Standard Maintenance
Procedures Specification. Downey, California',September, 1989.
Rockwell International, Thermal Protection System Reusable Surface Insulation
(RSI) Maintenance. Spec!fication.Downey, California, September, 1988.
SIORA. Final Reportfor the SIORA Program--ShuttleTile Automation Project,
Stanford University,April, 1990. '
,,
'
Shuttle Operational Data Book. Vol. 4, Orbiter Landing Emergency Rescue, 13ate
Part
Houston, Texas, January,
1988.1, NASA, Lyndon 8. JohnsonSlbaceCenter,
,
Smith, J. A. STS-3, Structural and Aerodynamic PressUre and Aerothermodynamics
and Thermal Protection _ystem Measurement Location_. NASA, Lyndon B,
Johnson Spac_JCenter, January, 1982.
S:mlth, J. A. STS-28R Early Boundary Layer Transition'. Engineering Directorate,
Johnson Space Center, Houston,Texas, December t 989.
I
i
J
9O
:_,
'
'
Pat_,-Cornell
and Fischbeck
i
I
I
I
I
I
'_
I
'
Oraanlz_tiQn_l
I
i
t
1
I
I
.
Extensions
!:
i
tl
I
I
•
.'
APPENDICES
•
'
I
I
Section 8!
I
I
'
i
of PRA models end NASA Application
I
I
t
i
i
i
i
i
I
i
i
l
Nuclear
.
I
"
_
°°'°°"""°
One Upper
Pond
Parsippany,
New Jersey
Road
201-316-7000
TELE)_
07054
136-482
Writer'sDirectDial Number:
•
)
i
I
May
.1.8, 1990
I
=
L"
[
I
.Prof. Elizabeth Pat_-Corne1_
Oepartmen_ of Industrial Engineering
Stanford University
Stanford, CA 94305
Dear Professor PatE-CornellOn behalf of the American Nu¢lea_ Society Nuclear Reactor
Safety Division, I am pleased to inform you that your paper, ,
"Organizationa] Extension of.PRA Models and NASA Applicatibn"
(which was presented at the PSA '89 Conference in P_ttsbvrgh ,
.Pennsylvania), has been selected for a Best Paper Award. This "
award was determined on the b-=sis-_f.=_evaluation b_ the
Technical Program Committee members for the PSA '89 Conference.
,
As I mentioned to you on the phone, arrangements are being made
to r;ecogntze yOU at the NRSD Annual Luncheon .on Wednesday,
June 13, 1990 in Nashville, Tennessee (in conjunction.with the ..
ANS annual meeting).. At that time you will be presented with a
,certificate. The luncheon will begin at 11:30 a.m..,you will
be seated at the head table, and your luncheon ticket will be
c.amplimentary.
Congratulations again on receivlng.a Best Paper Award.
Yours truly,
Donald N. Grace
Chairman, Honors & Awards Committee, NRSD
co:
Dr. Raymond DiSalvo
.........
--
_
".......
';o*;_
;= = =,bsld=arv
o( Gen(_(.
.........
public
Utrlities Corpo{atlOn
_ .....
_.
. -,,_
.::,..: ...; .. :
"
:.
" ,.. . ;:..
•
-_,.-.--. , :-:,..,.
'J
Procee_ngs of PSA '89
Pittsburgh, P=nn_]vania
Ap_ I989
'
,
I
I
,_
Best Paper Award
Am_c_ NucI_mSociety
Nuclear R_ctor S_rcty Division
PSA '89
,
I
_
,
•*.
;
:
•
•
.
, .
i
l
i
. •
E•
,
_nGAN_ZA'rld_L
ex'reNsaoN
OF PRA MODELS AN_ NASAAPPL CAT ON t
.
, .
: .. '
..
•
j
i
.....
_.
EfisabelhPald.Comell
: . ;..
.-. :'.-'
• _, :,
' Oepanmom _,llnduslrial Engins'etin_
...........
" . .and.EngineeringManegen-,enl :
. • .: •
.... ' . ,, ".........
",
,.Sla_o_Univ_iP/'•
" .."• . ',.
.......
:.,.
•
:.
, "; , ,.. " "'{415)
723-3823":'.
"......
:"-: " "
•r '" ' "
ABS RACT ..
" " :"......:
" .
" _I_:':"
::::
:":::::
' ":! " ' ::
- " 'i:!....:::.::".. ....
,
_
". " " ,
., olassJcalPRA by linking th_.sprobabJ_y to the Jnduslnatpr_ce_s
.... • .....
closet.el PRA I0 iricluds some cha/;ii_e'dstic$of,_'_'_rg_r_z_;llon .' : therefore, alfews_.xler_iottbt I_Hiv_itue.bt_nformafiOn'0f
r.,Chva_.
Ihaf processesOrmanage_ an_ngln_erit_ ;_y_tel_._
Alaxorlomy of ' " • t,_0nelPRA. Bya_'s_ssir:_'e_p!icltl_,
kh,_'_[uzbl|lp/bedqlits
(_forganstrop. Isp_es_,rr,,ed
_hdtrivia'or_n.[z_'ipnal _tsaL_x._ir_._.
_'i
. .'" ._allo.al |_v-_._n_s.'_lo
.._ _:_htoCh_i_e0.es, the fesp_ a|lo:w'
assemb_':rno_l is propofied 10r:_e"_.a_i_'
d. t_ ml_itif_
. " " 'i!tling prioPitie8
a_r_ sile_ i"hsaSutep.thaI_ beyondle_.hnlcal
Tnan_nei
Pmtec_i0n.System _ the .',',',',',',',','_ce
$_u_le _ u_d
6s an
iIJuslral_onl: "I'he
n-_:_el
ailows'a_e_mere of the"be_r;_e
of
organ_.ationai,improverr_ht_ of/,_..o_biteP_p_ce_Jfig. ' " :.....
PROCESS "ANALYSISIN RELIABILI_ MODELS "' " " :
........ .:_.-.:-". --:'- .... - . " -
.....
The _uema'aliveanelyed#oi there,abilityof an er_lneoril'_
system _ch as a nuclearpower plar_or Jhe.spaCps_Alie allows
i_enllroallOn¢1Jl_d_erenl fai_Jrl_n'=des and corhputalJonol theW
probabilil;es, "rhi}relore, _ permhs e dec_ion maker to ch,_e4,
technic4;sol_':_rtsthat rttaxirn_ze_Pfob_'live function{in¢lud_'_
reliability}und,_;resource_Pazr_ints. This mear_, forinternee, the
cl_oice of Orsleo ch_raqzeristic=1_iztminimize the p_bab_l_tyel
tagureduringthe lifetime of shesyslem under o_rztntz of ¢_a_,
time, endpe_loPmance. ' '
. ..
-,......
•
•
Technl_l modlflca|_or_,however, represe_ _ty one_as.s
OfrLskmanag _le_ stra!eg;es. When a _."yste_'_i_ilure i_ s_d_)d
8 posferlo_ el.isorlon _oinlld o_Jl
lhal wtlat resultedIn a Is_Tntcal
failurewL_ aealaflyro_ied in • l_l,<t,uraJOrfuror!oralfailureo(the.
o_an_etion. Thiswas the case, for example, gl the z_=identd the
space _hurtleChalter_l rwhom a numberel Orl_alt=nal _onl
contributed'tO NASA's decision t_' laur,<_ ur.:k/r unacceptable
tom¢_erature_,_nd_ioni.' These organi:zati_r_ltactom in¢,luOl,for
example, ge_f,lrapl',k;Oi_>er_k_n(thus, sometimes,_:or comm_Ncali=n$), lif'ne
,_,r..Slrainta,and Wea_ureest publicreblion*. Motif
fic,atlone and Impn>vetttent.s
OI the org4nlz_ti_n karl! may ado_ss
some of the _iia_lity pmbIerm at _ moref_ndarnent4zllevel than
sireng_henlr_}
the engineerir_ clesi_l__1Ol-4.t _
[1's:_JHJcatiOt"_
include,for exarn¢io, in'_rovingcommunicati_n_,_lng effe_ive
warning Sysljms, and ensuring _or._i_lenC_,el mandar_ acm_
the =rganJzat:_:_n,
_
.- ..
The cb_e_of_ISpipet isIo SL_uSSa qusnt_
a4_:_oacil: "
to me analy=._|of zl_ etlect_of organ_at_nal feature#on sykes '
reliabiE.,),.The iPri.'_clple
is t= coft_.te :he.p...--_ba._lily
el _x=dee,"L-'e
of the basic events II1greater depth Ihal_it iSgen_rMly Oone In
:
7, ._
:"
('__,T
.
'
"
", .
:..
- ' :.......
.
TheN_1_or_'IAeron_u1iesandS_Ic#A_mi_islratlon(NASAi
' " preeeree _orneo_anizational featUrel that,intbence its mode ol
• • 0_et_o_
_ t_us
_.re,._.._/ol
I_spac_
i),mm_.
N._S,
_isa
" '
.
"'. _ig_vLsiblillyorg_niZ_ioH,0_iK._
,
"
i_z_.,_rl lundin;]and,
._ho,=_o,e,
Oe_e_ onO.Sr_'_id_/it_s_._r!_r_._ i_byo.
way'e: geogri_hi_ Ibj _r_.p_ =_::c:ll_erl,..
S.l_ op_.,rat]onally
" ,zmon_ =p_,cep'rt>grame:lnthe early 19_.'q ..NASA_ld eda.g_inst
" pmbabilist_cri_ _ll_,
thuSa.__irlg the _,,$Ueol "hoW_1 e _s
sa_eer,,ough'..in..wha!b .gqr_,ra_ recogn_ed,
a h_h-lLsk
operation.Yet, fo_{_¢.'_ me Chal'ler_er ,ar_enJ in :J_,r_u:,_1986
andfadedwith et0nglistaf potential mrrecd_ns. NASAL_begin_lir_
(o ex:miplemenlil!;qvelhsllvemethodsdldentif_..albnof tl')efaibre
modes by.quamifyl_gpmbabiflt_s end det:_:le_e$
as re_:_m_ndedbythe_laY.Comrr';"sion._Ac_,_n'emabJe¢lt!/e_cteadYtO
Increase iris elteetk,ermsso1ll_eofganizat_n a_ _ efficleficy _!
ieloun_ alk_.stionby Settingprlo_eg among the teohfiicl! sOk_tJon._
Io _xLSllr_probh_rr_.YM as _e Ro,_.Cortt_.
i_r)poi._ed
out: II is clear that :mrrl of NASA'= reliab_];1,/.pIl_klms
ralnr_ _e
•resolved by der.'_gnm0d_K:ati_h! aiqne be¢4uJea_elr ro_s a_'e
org_-_izationaLT_ fragmemalion M theoq_ardza_bn,thei_:_!rent
burlsring betweenengineenl,i r_l men_gen;and the Oiveq_Once
of.
theirrisk peeeption_," (_k_ffios of leami._ giventhe scstCi_yof
usable trend records,I all there facte_ have contnl=utedto the
v_inerab_hyofsp_cesystsn',Sop_ratior_.There rite=Is, however,
yd,'7among the d_lerer'4_l:_ystett_ accordjr_ tO IheJrphys_el
_r_ kmclio_a_d'_arac_e,"_losand to lhe featpres _ Ihe managir_
organizations.
",
."
The Th_m_l Protection System(TPS) g( t.hl sl_ce shuttle
providesan ex_rn_e of the I_o_plingbetweenteeP_nk_lan_ p_genIzationalproblem. It i_ a ¢_rnplex wgem the1b designed,menu.
" mace or l_a_ and wh._.e._a.(_ _4,00o
on me.o:o_er:Di.._.ov;
st,/} re nfonF.
_d.c.a,'_o_rbon.in t_ _ttest zoner the.m_."l_lanke_l in _Iderzones, _md!klsi_:4eII_ukl'Jon._
!gel the,."nse!vs$
ere anachl_:lbya spec[_l bond (RTV} to a flexiblepaddesig_e_to
,
. .i...._
...
,
•
:
. .±
.
"......
.,
.
""
'"i:.::
, •
i
i
i
I
i
I
i
absor_the tending ofthe =_:ita r'__da_. The padsam bondedto
the alumirtJmskin (If=ellc.overeOwitha pr_me_)by lhe same R'r'v.
The TPS ,:in fail in three ways: debonding, bum-through,and
Oamage b)' impacts.II _ subjected toa set o1externalk_a0s,'=dee
OI them rn_==typrec_iclable,(like
vibrationsand heal un¢lernormal
operating ;ondllJor_), some of Ihem mere random l_kedebris.
Impollant features ofthe PRA mo,_ellot the tiles l,reethl, polential
failure de_:¢rclenciestram tile to till,, and the c_up_ngbetween
failure el t "_ TP_ and falkJre of the subsystems locatedd_rectly
under the aluminumsldnof the Qmller.
'
,'
,,
i
i
,
.methode_,lanc[sthe scopeof PRA through a Baye,';iananalysis ¢)!
the sequenCeQf tasks'to be penormed In the 'procesl,Offdesign,
rr_nufactur}ng,inspection,maintenance,andoperations,and the
computationof the probabilitiesof technical as wl³ll a¢ organize.
tionalfailures that can =lieu th.='system'=reliability.The reasoning
, Involve'=on=Fists and e_lenslon o! error= Io Include not o_y the
clas'=lc_tol_ratOr_ stroP=but also ermr_ that are clue to the
p/ocA_duresand =tnJcTureel the org_lnizatlon.At'+essentialdistinc.
lion i_made _ere between gross actors and error= of ju_ment
because remedial =aliensto addras'=the_e hua(_yl_sat problerm
• may be oi Cliflerenln_re.'=
=
,
(,-
Th. managementel the TPS presemsmanycharacteristics
that are typicalof the linkagebetween organizati,',nSand ;'eilebllity. "
II involVe=5everalorganlzatlon-__inO¢¢mra=oP=Inohlen=ntplaeal
{in¢lu¢in_ Rockw011,Lockheed, and NASA. = Kennedy Spice
Center an(_at Johnson_oaca Center} and/_cedures that were
me=fly dev¢lop_ for the _ifial st',u'_leconstr_clioi'_arl_ notfor li
long term _aintenance ptogmnt The TPS inspectiona_l maim.enance pro¢:edure=are e_remoly laborImen_ivean¢ limecon=urning,and ar,_oflenonthe cdlk:alpath tothenext launch.Thetraining,
dedicat;on.sndmet_afionofthepersonnelinvolvedinthisprocese
isc_tlcailo the reliabilityof the system.The o,JrrentproCedutl,retie'=-
Thelirst p_asl, is an analysisof the process,= (e.g., englnearing, maintqnanca, and operation) in order to Iclerlt_fywast
constitutas'nom'talpedc=rmance'andpotentialproblemawithLheir
probabilitiesor base rotes p.=rtimi unit or Per operalion+whioh
depend, among other factors,,on the I_q_anlzallon's cuflure ahd
IreentNl, stP,
JCtUm,6k.en that a basicerroro¢cum, the h_x'lDhase
is an analysis of the organizational proceed,
Jess and irioenfivo
eye;tomto determine the pmbabilb/thai it i_ob_rved, recognized,
'_mmunicated, and corrected fn flee (i,e., beers _t..caul,eat '
syStemlaikJro).The result=of tr_se two p_=e_ isa computationol
the probal;x'litio'=
of the dlfferenl system's states ¢o@e'=_onding
to +
mostlyon=raintl,nanceondemand.Aithoughde'=truc_iviPulftoSts
i posslbl'=typel,ofstP,
JcluruleeteetsanO therelore,to=llfferentleveLS
are pealed'red Iora small sample of tile=, in. mo_l places; tl_
problem= I_Sod by the agin_ el the bonding l,re 11OIad¢lre'=sed ,
ofey:>'ll,n)''=capacity,
Thethl_l phaoe i= aprobal_'l_tloriskanalysia
dire¢lly+ TI_ rel_l_l'_ of OJ>e_lflorl.';
Ii'_lve8 I 1_eSS©| pal_t
" ofthept=ysP...aJsystemff_ataltowsoon'q_.481+onoftheoverallfaiitJre
documenll;. Furlherl,nOrl,,1he proce_Jrl, involves_me i:_odtiza,
pm_abillty(1) under normal¢itcumJ_timces,
and (2) give!lp_tanli=l
tk_namon_;ithe TPS element '_based on qua;'ffativejt_dgments,but
weakne_ea of If_ Oiflorentele_n_ and Ino'eBse oftheir fa_Jre
no system3liCprlotfliesbaSe¢_on a quantit_liveassl,ssmentof tl_
probabtlilles.These thee model=(paces,,, organization,and PRA
risk'=Of failure due IOfiles" ideation w_ respe,._to Other critical
for ditfereh_le_l_, el system's cap,_tty) am Integrat_;t using a_t
sy_lem.s.
"
e_;l,mtr_e (or#n lnfbenc_ diag_m) to _ompulathe overall failure
prob_b;fhy=r_ the re_tve ;on_rlb_ion o( differentleon=rio= (o.g..
A r_iw metho¢lte eulomatize the In'=pe¢lbnel the tile=Is
oo_'rrence and ¢orrecllonat a gben problem).Figure.1I_mv_ee a
currently hi|no lrnplementi_d,r/_ }mlx>_antasl_-1 of th_ method
IK;hematlcillustrationel the structure of thil imi_lralion mo_ef. *
I_ lhat it gr+=l,atl_
simplifies the currant taSkSof oboewIng, op_
•
.
•
• ," .
• I
caling, l,tor..ng,an_ retrieving bdomtlon concerning the cement
PRA FOR THE THERMAL PROTECTION SYSTEM OF THE
elsie Ofth,_tiles ar_ _elr. pall/penormance. _tI_0U_, therefore,
SPACE _HU'I'TLE: Me.gEL STRUCTURE
increase tl_e rel_abilllyOf the inspectiona."¢l rnalnlenan_ opera'•
lions. By l,(;celeratlngthe ?roceu, autonmtionmayal_,in many
, APRAmodelcu_rentlyur_er'emdyforlheTPSofthespacQ
instance'=,lakethe oliosoftIf_ecritical pathto the h_ bunch.The
1,1'_,le relleoI_na partitionofthe I_Jdacealongloverel d|manaiOnS:
gain In shuIflsmliabflltybatween marlualinl_pe¢lionand automitlon
(I).lP+aextemal loads (maln|y heat a_r dsbrle}towhiohthe armor
is a fur'¢'tk,r_(1) of the Inhi_l _0ntn'b_lono| the TPS to the overall
¢4m,be _blected and that vary a_oming t_ 1he locationon the
fallurl, risk and(2) el the gains mllOainTPS reliability.Oral ape¢ifi_
issue that ¢u_nbe adclres=edby the e_lension of PRA de_ttbed
here is the benefdOIac¢ountit_ tarthe relativeorld¢_lltyof _ tile=
m dhlare_ _or..afion,,s
on the oR:_laf'_I_Jrfaoein the managementOf
tl_ TPS. l"i_tsmay re.It In inereasin0 rnainte_me .eflo_ in key
areas _,_¢fLas the '=urfa¢e¢overi_l_the hydrau_c¢_mmandsylr_m,
tx_tal_-,o
,.1:(reaps, =p _¢ialmonlto_ Ofthe Irmlnatlon q_erifle m
for these rnest enlIealarea=./_'lother is=ust'ha'lcainbe ed_essed
byexte asianof PRA a'=daaSr_ed here tl if_ relative Irnl_llanoa oll
the mane|lament of the Tps Itself and Ofthe managementof ot,'_f
=ystl,mslI_atam seu_¢SSof d_bris (e.;I., the extarf_l tank Inlsjlation) in thaioverall reliabilityo_the thermll prol_ctbn lurebon,
INTEGR_TION MODEL
Pl_)bablllsf(Cdsk analysLl (PRA) tar er_ineadng system=
allow= idl,nt_flcmionof their weakl,st pans through quantificationof
Ihe proba:filitleSOfthe ¢iffemrit lailure medea (=,De,for example,
Henleyand Kumammo).,E._ll,r_on ofthe PRA mod,_permit=morn
explicitco '_sldar_ionof major Orilardz_lon_ ¢hertl¢leflatio='(I_,K_furs, procDdums,and ¢_iture_=)that affect the reliabilityOf opelat_n=, =pacia_/J_ _itz._tionaof _ll:,.nl_
Oer..islonmakir,g.,, T_l_
. admirer'ssurlace an¢ (_) the oiti¢411_of the ¢illerem Ig,,Iboy.q,
efr5
located lmmedblte_ undar the aluminumakirt, in Order to allow
reo:)mmBr<laliona regar0ir_ the rmlflagorn=ntof the reiovant
'sub,sy_lemo, the mod_f I=¢l)vkitKIInto_wopsd$:the flr_ j_|l L5a study
o( Oebond!ngand _rn-_h
due to wea_neoael, Ofthe bond,
heat/oadl, vbatk_ns, eir.; the almond i_in b a =ate
=tuo_ at
me iml_ct Of 0abd=. their ImuP.aa. and their elf=etao_ the TPS
re,ability, in thisPa.aer,the=oo_ Ofthe PRA model b limitedIo the
tiles lOCaledon the underneath_udace Ofthl, el_#ef.
•
Rrel pail: Oebondi_l and bum-through(axciJdingtheeffe¢:t
el debtS)
F'_uro 2 j:m_vk:tee
i Ir.,_en_
Ukntrat_onofthe I:_f_itionof
the o¢_ore undeme_ surface lot Ihe firm pan of me ana_,ais
(there la no attempt at this atage tOhr.,aterealiatlca_ the different
zones _mlr,
g to temperature and ¢.dficallty).A m;nlma_ZO_.(or
n'_, zone) Is on e_m_m of the final partitionof the sudaee. Each
rain.zone of Index Iis ftW= r..haractedzedby a heat Inc:k_x
(k(i)) and
a criticall_ Incle= 0(i)).
'The bas_ notationsare the Io,owing:
_
_"
+
t
i
_.
!i
:_
i
:
i
I
t
t
I
I
i
I
I
i
T
,
i
-i
S'l
, ,
" ?
,
""
•
, ..I
"
_:" _
P11SI
'
:_ "
•
-"
" "
Y
"
". 1"'"
1. ,
,
"
•
",
"':
.
"
-:I"
Y
.
.i,_-
'-.
i
'
"'-:
.J Pmblbll|sti¢
. Orglnl_flonal
..:... :.,_.: .: • ....:Arudysls
..i ....
_ ' ' _¢ Risk Analysis
,
,
'
:'_ '*
features and'8_oTd_te_Lon
_¢ :" , "_" "' "" : .
(l: ....
"_," _' ,
• ,
.'r',.
Failul'e.i_f fhe'l_tler:
:,"
.,. -
_
.,
loss of Ttehicle ilnd'_llw
,
, :_-'-._." ': ."(LoVtC)afl_'i_r_tPdn'_ilYcagaa_byl_,i_ufAo!
.'...:_...:i._..'.T.._8...,..:j
....... :':.::., ".
."':
....
:... Zolleili
k:
....
,
' • • .-........
::
Indexof lempera_re area ....
,,
" '1"
"'
,
:" "_: " '" _''""
of ] (the Iocllion
i_111he ol'_eq
whereas
.Fibre
=of
-"- .....
.• Disvltlo_lmliili dNI
"p(Ni)" ,'.'---'
' : " ...
• ""
' ""
"
"
....
" ti i_ i_s_rr_/n
Ih_ p_isi st [he lnalys'/ihat any fallunl
patoh (of si;:eone or morel developsbythe Idea ol i fir_ tile (FI:
inltialir,g IailUrl Ior lhl 'pa!c_); lo.]lowe,,_or nol by the f=Jlu'n),
of
adJa¢l>'nllil_iF'lF1)'ThaPm_abilily°lt°SinglfTafirsillklinal_aleh
depends or, li_ failure mode (dsbondin
9 or bum-throggh):
_ :" "'
I
. ".;"
.':.
"
"i'_tl pri:_iabiliiy daper,_e on me terrlpera_ia oi. the lln,
. 5:
zone (in=It- kli)i.
". •
"' "" : "
" " ""'
'
....
a h_ adjiCanlt iii tllve n i_iilai_'lgl lalll,lt:ll
- -'
""
'
- ..... . -, ...........
_ifl_ul_°alch"
.
.... " "
N,: ..
,m!#nbar.O#la_.palr-I'tS
1. rain,zoneI.
Frill ...:... fi,_i<ii_
Nllrn'_lif'lfllleiinmll_.zmnei,
h.-'..." i_ i "
of ibi _fm ilia" {inlltatirig tililfJr_
faill,iie'_llti:J,i':" " :-".-. """ " ' <::'. ....... :: FilF:i: _
the secoi%d-term
.
. .
.' ..-":':_".......
,
(]:xJm-lhro_gh)deper_= on the temperalurO =omponem.st the,. "
min..zon_=scnpt_rk(_.
'
' "..'.,..
_'
-,
:
.
•
•
F :
j
"
,"
.(.
iI
..Y
....
"PROcess ....
'"'
.... ' . ...:. ' A_;_bJ sIll"
[
I_ltl:Pilll h,l I_ln lomll b
:.
I_FIPI X [l-I_lil(F1)l'Pi
"
. .
•
:""
.....
This equatlonlssurnes that _ha.de_elopme_ of difle£1trlt
- patchss are inaeper)dent ever_t_and thai there is r_ oval
of
• p_,lCneS,Le., t_at.t_e productEV(Nt)x EV(M) iSne_i_gibl=.
" " '
.EVIN) ,. I% x Ill.IF1)
(_,ixp_..ledvilueelthenumber
ot pai_es _n_n, zone i)
" TheprObal=ii_yol debondtr,g isl._U re!cliO beir¢ll_n0erlli
i
i
"
•
t
Min. zones:
Ii=2 cold;cr'lticlil
l
_
i.,,+-,
•_
.
cold;noncritlcal
_
F gure 2: I_ubkl paPJllonol the o_itlfS
r_, i-,t
,
ll.IMii_ it
:
a pRA Dl it)I tiJe!.
" :;'" "" "
.
,.
.
,:
.
'.:
" "":
i
i
EV{_4)- i / [1-p_.)(F'_F_)J (-o!expected
va;ueof thee_ze
a pa;Chcondit'_nalon
its
'
start)
orb_er du_ t_a o_l_h of size M;
,E._I_
pill:] M_,I) • p_,,
Pi(|: I U-2} - I_,=
•"
Pl(F JM=m) ,,.p_...
•
_Lhe
orbiter due N OzLtches
of r_ndom _{z_"
•
A failure el the orbiterdueIo TPS failurein man.zone IoccursIt =ny
(gne orrr,(,e ) o!the patcheso| min. zoneIcausesfailure.Giventidal
failure Webabitities_{F1) andp(F') are assume¢lto be small, one
can wdt$:
p( =.l N_,.g)., _ x p',
,
f
the dependenceOnlime _t the ioss Ofsubsequenttiles aner Io4;,:o1
ihe tire!one.
I
,
.
;
i
Se¢_.nclpnase: dskel {ailure dueto clebds
_,
. "l'_eanalysiebeginswith the =tuftyel the aourcasof ¢Mbris
(e.g.,insulationol the e_e me!t=nk,other part=Ofthe STS. external
obj_e) in o_er 1o obtaio the p4"obabltHy
of ,'_lfferentscenarise
characlerized by the nature and the siZe ol debris
.
. the impact's
('.
iocation on the ol_ltet's !uMace, enclthe time of Ir_
duringthe
fli_hl.This anal/aS leads tOa desc_J:_onol the inifildIle damage'
|;ncludlngprobabtl_ Ofa hit tar ple$ In differentzon4_=,¢fisfrilI_ufion
of nu_r
cdtilesinitials/hit¢,_nclitJonal
on debits Ir'n_aof.seve_y
of the Cad';age_or,_flonal Onirn_ct). In this ae¢ond paR.the start
el a failure patch ischaracleriz_ by _e possI_lity ofmuitfp]et{tltia{
failures with _erent teveC_of sevedty. The studyOf_ur_er _eye{opment of failere patches _r_itlona( on initlat_ l_iflure($)ar¢l
consoquenteffecton the O_ite r issire=letto II_ Inalysle iperton1_a¢l
inthe liml part. Themalndifterence I=that!he _l'_tyaL_el the atilt.-1a
(w
I
MANAGEMENT OF THE TILES AN_)POTENT1N.
ERRORS
..
•
¢
TPS management a_ reliability
.S Pw_.- '_p("iZe m)
m. I to .-
,
_
p_.,
T_o _uallty
O(the pmCer_i,of _s_n,
xp=a(F'_F1)_"x [1.pep)iF'iF1)]
m. I to Ir_inltyiS us_ as ,_ r'.,onvenierK
_ro_i_llon
of' ul;_er
bOul_OS
vthen11"_pmbabiiltyo1sergevalues of Ihe ronOomvariable
i$ suft_lntl/I_rr_ll..
_;z_zJ_y of =_,*r _eBur__
_u, _ 1_s _=nur, _ _,_
I_
p{F for z,l_palchee In ml_. zone Q
.,
=
•,
,.
_ p'_x q x piN=-q)
q. 11_-
•
p; x EV(N_
.=
p'_x n) x p,n(F1)
"
_nulacbJ_ng, tr,slsi-
=tion
inF=pect;on,
andl_wdmellm'w:eofthetllesaflectstheprob(U}itIty of Init_l
ar¢l aub_eq_,lord
tllluroa through t:_w_thmughOr
bonding (p(F1) and p(F'IF1) in the _evioua model). The query of
the management ofOthersy=terrmi,u_hastheext-,maltankthatiUl=
iPotential_ourcesolOebdsafle¢lsthepr_b_lbitityluldth$ eevld_yO!
_mage due W ¢lel:wiS_
in dWerontIOc4diOnlof I)'80ft)ltM. '
Given. eta alru_ure, th_ model ¢lescril_e(:l@l_ve ran be USKI I=
a_se_u_
the gains of Imp_vemenl$ in the n',,imagement.ofI_a lites
a_ In me processing of the=_iter thmugll the _$ses_m
of the
changes in p(F1), p(F'), _,ndsimilarvariablesforIfwicase of =Mbris
1topaz.
"
' "
-m
¢. I to-
FaJJu_e1_
the off,tiert_r aHthe rain+_onos:.
p{F) .
J_,fx(z) p(F I x) rh,
Of_eb_s !nvolves dlflarant le,._o_of damage saveMly.
;n whi¢_I:'_isthe probabi_y liter en arb_lrarypa_chin z_na !causes,
p'=
,,
In the ccmptetean;ly,_isel the axlem_ evafits, itis n_o$sary1olake 1meaccounl the dh'ler_ntphases ofthe lligntin orderlo
obtaina d_stributionovertime _f loss of first tile and a measur,_of
Asl_rt of [ha dale, one nee_athe probabil_ OIfailureof the
o,13tferdue Sothe development of a failure patch o| a given size if_
a zone of G;,roncdtk:_l_. These _ata may be o_a{ned throughan
analysi&of _o re_{ilbilityOf the systems locatedunderthe orbiter
suMa_ an_3their ¢cmdbutionto 1heoverall reliabilityofthe orbiter°
These prohabilillescan be usectIo clefinechtk;alityIlia,. p(F_thus
deper_s or,J(i),tl_ =ntk:aJi_Irtdmx(_ mih. eerieI.
.
failure,
iP'_
-
p(F)
.
_ p', x _ x p_(F1)
i=.11_4
,F..__
The probabilityof failure is Ihe sum over all values of Ille
exlemal io=,_X (e.g,, maximum,temperatare it it lures out to be
critk::at)o1the j_'_ability density lunc-tiol_
.tar X mulllpiled by the
probablJ_ of laiture of the o_oitorcondltiorwdon X.
For exsmp_, i_'e_ _lklzlmoll_ o(the tllee de[_er_l$en
the expecle_ he_ IoaOs(wire empheshion zoHes .s_ aS the
leading _m
of wheel O00111)
the p_¢lull
iSin_per¢_,
_,
_ Ofthe
c_icalitTO_lhe eystemalooatedd_rt(:b_,/unde'r_w)iduf1_lnumskin.
pnor, izatlcn in g_eTPS pm_sslng as W0Ual the processingOf
_jecem =mu_e ©1del_'_ my bedeserts4 m decte_u;elu_'_erIhe
probabilityof initiating file failures In the most ot#lcal zones. TIll
reeul_sr._nthen be meaau_ by 0omgulalbr101thll ovorallrisk I]y
the previous model using _
values of initiatinglidlures. Ahother
example ol Impmvemom that can he as.ses0edthroughthe model
i_ the _evek)pilwInt _ the use of nol_de,slfuctNet_sting OI11"4
RTV.'r_ WObabiiltlet O_failure I_F1) andp(F') i_theI_n;t_h ol the
model lr_maso over lime wire the number of I_nts el the =rbitor.
Non m_sm.v_e tom}rigcan Indicate Oelof_-_tlon el The b©nding
and a.ow I_nely n_ac_mem.
In sOd]lion to =na_i_Ja de¢is_Onasuch as ignoHr_ lifo
aglnO phe_hon
er un_orm inapect_n of me Sites.errata can
occur at every step of the n'_tnufaofuringof the _(fierentelements
ofthe TPS (Ior example, abadbatohol Rl'V),Oltbe.ln=pectionanO
malntert=n_epm¢o$_ (e.g.. wmr_ metsurement ot Sop andgap_,
"
'
-
,f
i
ill
•
CoRCANIZ_AXiO_liAI.ZRRORS)
i
./
1
•
,
"l
'
" Jl_
FLuNAwlLJ
-
'_ :
._<_
•
-
_
i
•
.,..,
_.-
Nz
.
.,...
. . ..
,_:.:.,...
..:
At_xo
..
"
'
-
•
"/
":
'
"
i
' _OODJNDIYIDUIL'_
.,L
.., .
! e_#s in _qla_lzttiohs
Or operal_fil (i.g., _i_ge
of IP_ l_et c_drli Iht pre-llu_ch
processing OIlhe o_ollerJ.In order 1ossse_ the etlecttweneeeof
orgsn_ational measures, II is niicessiry tOrelate ellO_ is Ihliir "
organii,_flonal ro_s.
' ':' '
"'
,
O_aniza'i_nal roots of errors: a general framework of
_.-,a!ys_s ....
.,
""
".
..
" '"
. ,
'
/
INDIVIDUAL]
..:.,....
ure 3:
:
JUDGMENT
.).
t_lORA_l¢_J..< . ."-. ::::. '......
, .
i
.....
';!
"
'
......... . • "....
..... ....."
. :,;.._= :.
,".'""
..
.
i -
were made aware olihem>lofBii_ls._ati!et_
inhlalde_i6n
_'' " :
involvei mlzinierprelallon el lsleval3l (t_l ImpIHec:;1)lnfon_ai!n
an<e'erbecaula liimplieea risk/lllludlllr_ali_/SiXilC_l'r_,:i;,_.._d.lo
the abJe_tveeot i_p management, In addillon, ¢_'mr=of.judgmqr_
also IrlclucleIt.!Ogrr)eri_arid _6Cilli_n,:by t_p n'ian:_Oei_t'hi'ilSltti"I_
they are m_o_t_l=i w_h the van,el Oel_eritllyhii_ by'lo=i_-a!
- " ":
-l_lge,
,
.
..
i': :'.' , .. _,-_:
Eri_ c.ar_result e_her tram pin mlslakis "_rtlhe'pa__t
.' .
A more dais! ..i_.....s_.
dy_l Ihli lixt_nOn_ircf iili _ilil_s
ind_uels,
or tram an inadequacy betwl_n the =q.ianlzation_e
, .isF_esir_de_ewhe_i':_:_'The d_nc=bnbeivVeinimel"ei_'or_'aT_
....
charscle_$ii=,_ (structure arid pro¢_ureel and _ exl!i=lellortl .
errorsoftu_me_.l!M_enlillbi¢i.u_,
!._(!eterfflneet_6
rilee00i .--::
about _umaq a_d system perfol_.n¢i.l, 'Two m,_jorioumee "M
the rem_lal icllonsthit.can., beconsidered,Gro_'en_o_*c_i_'tie' "" :
mismaicrl be_veen the lni_iv_dult.Ind Ihe gmu_ may be (1) tile
" a_dbuted al_ir Io. mgn_ivl pr_em_ or to "mL_0mmuhi=atk_'.. "
"
ina_il_y o! trlt, orlanii_on to make.rob.re.elinlormat_n aveltilble . .-CogniSe erm_ im _u=id .rno_. bY b_o_nat_hp_b_,_l,
l.or . "
intimetoihe.ll_s,i°nmakers=taPpmPHlteh_rarchlcall!lvel$,irld
. whi:h m_'q¢t.1_.ac_._nSirlclucteIdel_alo ,in_ori_elloll _y_(o_,.
(2) an iP,c_n_ii_
of golt_ and _'ele(er_esbt_ee_ _ere_
" ' • _er_-ai_tl_,
_er_vss toaeekldemmali_hwhennel_ld (iP_,-ln •
levels of maqalt er_em end ape¢_tc q=DI3_371edlslinclll_rlbi_len
" i_i_l_,
_/. Ici_l its4 an_ _=
to do so), and a ihom, lg_
ir_on'nitloni_dPrefererlcasii_oo_ar_becauseli¢l_lOetts
rche_lrlg liNiffl
=eoT
Isllrvlrlll ai'i'Oil _ lln_. The
am types of rlmedhlf ac'tk:n_,In the iLl i:_Is, the l_'oblam is i
oi_plmizali¢i li_ci_re mulltIr'¢i._le al_ml:_ate _'Innelli OfIrtlor¢ogniliveone, ealllng 10ran lmpmveme_l st imow_Cgl, In_l_
n_iilon and tul_lohl of i_per_ik_n arid euploit. The qr_an_alesmirlg, afl_ ac_= to ir_0rmalton, in lhe seo_i-_l case, the
li=nalproce_r_ mum p_ovide_i
thiinb_gihd Incenl._es
problem _.V be erie of _ompal_l_# af icml. m_a_l,
aP_
prclererees.'l_e_le_ltoncePlit_nblaltl_reilsdl_nloO_#+P411hl
Incentive !_u_e
a'+we_ el the m_Pilnl'_n_ bytiPd_ tuls aP_
cansllinis are =1 and.n_.
_e
_
IlL mill.iS
direci fesUt nf the I_'l_y of Sheolln
(is !
10 the
individual) to !am wth e_perteri;4. ,"
: :.
A leloi'Ioff_ of ef_i_ INll l
be Uatll_ in lt_s anal#el
assumes a _er_rcllical organ_rl'lon in whtc_ rulee, goals, and
constrair_e('goals'i_ Ftgure3) Im _0mrnuni_atedb#headquaeom
or apliroprila top mar_gemerd 0ownthe hiera_#, This elt61)esM
fOCUSeS
On acltotts t_t may lead1oIslam (tlltt II_,llitlvee),_ _
or1lhe ll_t¢lirAn_I _
Oplior_ (lalse nel_atbe/) ll_il rrla#ralll, lot
exarr_ole,lrolvl ex_e/l_
c_nlervilivenl=3. The prgpoee<lta_l_
amy relies on s diillirlctb, between _
=
on I_ =4
kliowledge ¢i •;k_er_l
slip_, ir¢l _
(see Fllum
3). Gross enc_l_ere de.line_ ii ermrl i_ln wh_.hwert_e wgui_
agree (lrckldir,l) tht peP_n 0r the _r_p who mlide IP4 m_l_keJ
and the de_cislonwoulil bereversed =I we#sreexal_!ell. Errata of
judQrrlent___-._r_ s_ustiort of uneerla_/and b_m_e eilher ari
[_erpretsiio_. of the"exming i_Ue_,_'" or a vaiu_ Judgmeni.Fo_
cerr_'_ Iisk l!kTng 8haUl whk=hSlrlse_suS may riotel ._1..TtleYel
..
• ,
.
:
.
• . +
r_ on_ i_ ded=i_h mlkem _ _
to supsl_tlors "In or_Srto
era_re tl_ Cl'i_nli' llrld i,lai_ COntrol iicliilil_f O¢_lr. A key
. I_s_l_n, Ior eil#r_l_i',
_
thl _em
rliw#l_s or Ouni'_es Ihe
dis¢iolum of pmblenl.
• .. '
"
"
•
. "
. . .
Ermre of _l
In the leca of uiertlimy are open Io
IrnerpreJmlontar tw0Caletode$ el reasor_: unca_linly tLboutfaCtS
and dlvitesllyof pllfererli_ll. Contriu'#i0 llmse em0rll, lhey cannel
bli tailly _
I_f a violali"n of eldeierrninistiCtt_tt__
iS
pies tw_ e_uids four./Lssissmam of i pint.billy or a probability
¢_strl_;tionto deecrt_, lo_ example, ii_stemk: unCertaietiis (tun.
_lrrlemal _
ot k_owto<tgo)_
a vlrtable gerlnilly r_iulrii a .
sub_il:t)ve Ir_ 10lrltel_l
Ihs svida[!cl./_f lot _ tMhul_es led
Ixelirereei In lllt lacl'o/Irl_Hl,
these inplllLiol_oue_ valy
•mona l_tvtduitl. C_ginlzltinaJ l_e_
lt_ atom tim I_ld
iudgmo.I lnl, l_refOre, much I
illf(
ai idenl_f lhlirl gross
ermr_ _.lJ_
lhelr Oqie_o nrnui ni_ on a more pmdsa definite
of whir consttluiae • iood declkin, in reamspilt, It iSalways easy
Isdecide Ihal e bid judgrr_nl / Dee lhl lead to sin liccidenl. Yet,,
gooddecLilP.r!, can lied is bid O_Im.rues.T_l_ra.
appi_pdals
e=cis_e p_
,_t,s .mu.,.lleli'=
is to _ir_
in i sat_icto_
, mlnner unkrlowncv's_saiv_be _il_s .l.nvob_ed
lh tlde._,s, ku/h as
•.
+
.
• < ,
i
i
I
I
I
I
i
i
I
t
in cases where there Is no ,controversyabout va_ueJude.
me_sil_volvedintopJeveldecislons(consk:iedng,torexample,li'_t
theopin;on_;ofCongreS$mustprev=_the (pJestionistoer_ure that
relevant intorrnalionis available to this t(_p managemem w_en
fundament|l]Oecls|onsare i_ade, ar¢l that the organizationalar_l
ir_lv_lual'l riskalliludes eventuallyrefle_ that ofth_ top level,The
objective b; 1odesign an ]ncardive structure ancUcra feedback,
mechanism theeensure:;this adequacy. Th_ implies the u,seof
appropriateinformationthat ksre,_di_ avezlabie:the acquisitionof
addJl/or',aJinlotmation when ]Zhas a nat positive value given the
Organization'spfelerence system,a_l a decision m,ld_ngproceu
that leeds to conslster_t iR H_k attltt_des..The quality ol the "
_eadershipcleady plays ._rt esser4ial Pan in 111oclarity and the
¢ons_slenc:fof standardsacross the organization,
SOME ORGANIZATIONAL PROBLEMS THAT AFFECT SYSTEM
RELiABiLITY
Fro_1t_ analysiso1 errO_ One can _emPly two broad
cmeilorles of orgenizalional problems Ihat relate to the failure
ptobabiJity o! a system because they affe= Ihe probabilJ'P/of
processenor_: information problemsand incentive prObtemswith
Iha possibilityel comblnalionbf I=o_1. ,
. •
'
' .
Inform_ion problemsmay o_.ur within an organization;be
across org_n/zetions manag{ng the same system. They may
inc]uOethe 1elk:awing:
• _,:=uentiaI en_;neerir,__
and lack _f fe_lha_k The enginearing pn_ceS_ may be designed /n a _ineM manner W_hol,_
tear,backloop,=to cn_ that the design Cairo=pondsto the need=,
or thai resoum_e at _llocaledpropertyfor optimal relia.blllty.For
ex ample,t_',oremay no_exist ar_ymechanismIo cheek the sP,adow
price of theoQnstraintsas1bymanagemem, Le.,whatwould betbe
gains (e.g., in reilabilHy)associatedto (IHteremlevels of _la_atloh
of the conslralnts(e.g., of schedule),
• _ss
t_ releva_ tr_rm_on. The o_ganizetlon'sprob.
tern is to _=,mi_yand communicate=igr_ls thai an=relevant an_
rcliabis. OJgen_atlonal IIl_er_may be such t_ some Im!_t_'4.
Signais eric.up _ssing wh_k_
irreJevar_ones ovett=ed M=daonfu_ta
the system, First,tne=lndivl0ualmustbe abteto Identitywhatto took
for ar_ 1o¢_ain I_le informationIn 11me.Commun/cation=m_y tail
Iora vadel_,of reasons.
Al_ropriate oommunicationchannel=may
sirr_p_r_t ji=xll_l,
or existingchanne_ rnayr|otworkdue1oaccident,
or ;mpri_tical procedures, or deliberate retemion of tnformNion:
Also,theei)nalmaybeig_0redbeceu_eofprovlousfalaeelerte(the
cry-wolfeden:Z).
• ._,11i-tlr_un;c
ati_n _ ur_nrt_int_¢ TI_ I/lfOllllalk>flmay also
be distone_. For example,the o_enization may eel be equlR>ed(in
its proee¢lu|,as,itscul_Jre,etc.) 1O¢ommunlcate W_per_/'Imperta¢l
In_ormatiof_
al_ un_rtal_/. Tl_felore, _llt_
('_ I_lt...") rl_y
be eroppe_l_ the pm_as=..
Inc,enftv_prOb/ems
al each level may lead Io the SuppressiQn o! bad ne:_a andl
therefore,able* towardsopt]mlsm.This is tttJe inpazllcular when
the informalionis incompleteand In situationsOf unCertainty(as
oe,;crlbedabove).
'
. "_,_rr,_
_. the c_rlc_ln_h The techn=:al'
" groupswhoso
lack i_ or=the c_ical path to produCtionor operation
may lind
lhem_¢_vasunqer pressure to cut corner. This pressure Increases
wllh 1hed)lfez;ehceot't_tal lime {objectNelurlct4n ) betWeenthem
and the next ¢Hlicaltask.
,
. .
• DlffiL"tJltle_
_f teaminoin a hlon-visihllltyStttlmmq. it may
bedltf;cuhloranqrganlzalionsubJectedtopublic_cnJtinytoasses$
itS,own penormance,and learn tram its mistakes. In situations of
su,c_es$, there may be a tendencyto overlookslgnal_of potential
problem=wheezesin sltuatlor_of difficulties1the organizationmay
be overwhelmed by signals of problems"if _ does not.have _ear
proceduresIO aese_ their relativeseverities M_I to sat priorities
erring remedial a¢_ons. Funhen'nore.organiza_on_l I,,amingand
in panloJ[ar change ed _lee may be dllficuit when it can be
lnterpretedasa¢|mittir_thatprev;ousp_oeeduraswerelnadequate.
t
.
_'.-
,'
'-,'
RETURN ,'r(_TH E PRA MODEL
_embly
mode!
The probabil_ of failurep_Ft) and of subsequentfa_res
p(F" FIt _ be linked to the o_JITof_a 01or/or= ofdiffemm tyPOS
(e,Q., a f,taE"llon
' of 'lhe sumacs only was ¢ovarl_ with RTV} and.
furlherrn0re,to combinalionsof aeons(e,g., insuff;_emquamityof
bondinEortnappmpr_etai_epto next tlisduelo m_Lmeasure'men_),
For each type _ error, the que'3tisn Is to know wl_atIS ks level of
sorely.the numberer tliseth=t it¢_naHecl. and _eirioeationwlth
respect Io the cdt_lity partitionOfthe o_bitarsurface. In a(_llllon,
It may be Importantto consider whetherit isa grosain'or orah an'or
of Judgmenlthat may be bill aastly_antified a_l corrected. An
error havir_ occurred, the Inspo¢llonprocess car, be analyzed as
a sequence of fiitem: = each slap _e ef1_r may be J_'amfffedor
missed. Finally,(liven th= in error hasoccurred an¢ beon IdentF
fie¢l,it may or may not be _rr_'led.
• '.
,
ThisaneP/s_, la described by the InP,uen¢_ _gram shown
in Figure 4, The resultIs a dlmr'_ullonfor the prot_bJlityc_fInitlatlnO
failure p(Ft) given po=ible _orr_netioru| of ermns ir_ their levels
of severityand the distr',bulJonOfthe numberof Ilias affe¢ted. This
¢iitributionof va_ee of _{F1) isthen efltem¢lIn the previous model
Ioobtalna ll;_K:trumotlatlurel;_'of_bliitlea(LOV/C)l_ue tofalluroof
the TPS. The model can then be used to assess the effects el
• orgahiZsttonsttmpmvem_llta ¢leslilnecito _¢reas4 the rellab_ityof
the TPS.
F.=am_ of o,,.g_nl=at_l Im!=m_m_
rr_nl =nd |h=drUtah"e_ mmul_ the m=del
_.
"'-
r"
_.
;
of TP_ mature;!
• _.Poesble
measureslrv:ludetrend
analysis a_ltee_baek mechanisms.Their erie=, Inl_e nlo_el, ksto
decrease the l_doilgy of ocoJrrer_l of errors ih the fir'= peace,
Zncant_eproblems may affa(=the eystam'a J:zerlormance
throughoutthe process erie inCluclethe folloudng:'
Also, lmlprovememoi 1t_etesting (lath as the taStirtOof RTV Ior
aging
irma, selects)whoso orle_ la !o d_reaSe the pmbabil4yof failure
• Ir_:_ive_ t_w_
ontimt'_m Ireorganizatlor_swh©sefinal
gc=et
istop,xx:ucea positiveproduct(asopposedtodetectlr_lfaults)
arid where the dr,ks of visibletailgresare suWic_e_tly
low, ir_nt/ve$
"A t_te f =zll_r_11_n
gf ms_uma_ acc_rdir_ to the criticality
of _e tim t)caUon c4m _ analyzed by the model thmuilh the
i
i L
Errors in
of Tiles; Final State
I
i
i
J
l
.
clecrejse of ltm probability of initiatingto|lurein Ine mos:1
cdt_ca_
oriel,
=
• Be_._:orncPdL_res
|ofIhe |r_sDectJon
Offiles and'_hestor_n_
8.
HENLEY, E.J. and H. KUMAMOTO. RellahitHvF_n_ar_ and Ri_k A_;sP¢_rnPntPrentice HaUInc., Eng_ewood
CliffS,NJ, lgl_l.
_l;L._g.,r,l_
it.creasethe probabilityof observation
of error condiltoflalon occurrenceand #ncreasethe probability0f t
correction¢=r_diflpnalon observation,
9.
MARCH, J. G. and(I-(. A'. SIMON. _.g_ZJI_QZL_ John_
Wiley & ,_ns, New Yod¢, 19:$8.
j
CONCLUSION
;
10.
WEICK, K'.E.Organ[z=llonalCulture =s a Sourcesof High
Reliability,Calilomla Manapemem ReyjlpwWinter, 1987.
The =lXtensiohsel claSSiCalPRA presenle(::lIn tl'ti_paper
increase c_tl_10er_bb,the value el In_ormalion of such =_Jea
because it ;*llows setting ptbdttes among I larger number of
Potential irt_,l:ven_ht_. ,_n anal_lSi$ot the engineering pn>¢l_l
illow,t fogu'¢rigatti_ion andre==ouroes
(lime in patfloJlar)on the
n',©elcriticallasklLG_anizalionalaspeclsofgngineedngreliabllity
ate of Intef(,_ to re_archell in otgani'zalioni' behavior." The
quanlitallve n_ithodoutlit_edhere idlow_ Inclusionof thisbody of
.knowledgeirrlheC_eci=i=nmakingwcx_essbya_essingtherelalive
Impotlince o_'the,_eergan/zallonal e#ec_=Ih,_ugh their ¢.0nlrib_lion to Ihe ouerait syslem reliability.
,
11.
FISCHOFF,,B.anClS.JOHN$ON.._Lp=g_T_¢_'
u_ed De<-+_;onMP.kit_. WoPA_hoI_on Political-Military
becillon Ivlaklng,The Hoover|nstltull0n,Slallford'University, 1986.
;12.
PATE-COR'NELL, M.E. and R. BF..A.Om_n;_af_nal:
As_-_ts of En__ineerir<l
SystemRei"i_J_llllv
ar¢l A,DDI_"=I;_rl
Io Ofls_r_ Pbffnrm_ Depa,C,.nentof Indu_ld,ll Er_lgir_er.
Ing an0 EngineeringManagement, Stanlord University.
1989.
.
ACKNOWI..I_DGEMENT
13.
MILLER,IS.M,and
M. _TRONG.I ¢'u_l
A Modellot
_wl=_tln=n
the
Ped_m,-,an_:eoD.
f C)_t_t_n_
Infnrm_f_n
Hdn_
_g.J_;tJ_t,Jl,_= Proeee¢l!nglof the Seventh I_riia'llO_ll"
Con/erenceon Infom',,lltionSyeleme0,_q Diego. CA. Dim;
1986.
,
*
. :
14.
KAHNEMAN, 0., P, SLOVIC, ar<l A. TVERSIOf. JU._
under Dncsn_In_: Hau_'_
arr_ Bl_._a_ CambfiOge
UnlversllyPro==.Cambridge, U.K., t982.
15.
LA PORT_, T.R., H]ph RPtlahllitv_Pp_r_l_ti_fl
Universityof CaUlomia Be_eley, 19t_.
_.
This wotl_Wasfunded by NSF gra_ SES-8709810 and by
NASA grant NCC 10.0001. The authorthan_s Of M. Wiskemhen
and Mr P. Fil,¢hbed_lot their hel_ in this sludy.
REFERENCES
I.
PR|_SlDENTIAL
COMMISSION
ON
THE
SPACE
SHUI"rLECHALLENGERACCIDENTReportoIIhIPreslden;iaJ Commi$_on on the Spaoe S,'_Ull_eChalk_r_r
Acc_Jent,Wa=t,ni_en, D.¢41_U).
2.
LEWIN, A. Y. and J. W. MINI'ON. Deten'hk',lngOq;lanlzalio_ Ette_=_veneSS:Anolhet look, and ,In Agenda for
Reseereh,Ma_lg_
Vol. 32, NO.E. Re.514538, May. 1986.
3.
PATE-CORNELL, M.E. andJ. P. SEAWELL, EnglneeRng
Re|l_bility:l"_e Ot_an_.allOnalLir_k,._J:_4t,_,,_,_
_=pj _Pc[ai_v Conference or_pmhal_llmLe Mamnel. in
.C.__
Blacl_burg.VA, May, 1988.
4.
PA'rE-CORNELL, M.E. Oq_anlzatlonalFactors In Reralbll.
ily Models, pf_Ca_din_ el the I _9 Meetlrmoftn_ _m_l_tv
E__
Wa,t_,_on D. C., Novemtw, 1_1.
.6.
NA'rlONAL RESEARCH COUNCIL Commltleeon Shutthl
Cr_:al_ly Review and Ha=ar¢lAnal)_i| Audit. p_ Ch,_dle_lU' Evabati_n of _n_ _h_lle _L_kA__ee_menlend
k_a:ag._J_, National.academy Pml_, Januim/, 1988.
6.
FE'¢NMAN, R, P. Per'4_naiOb-,ervalionson R_liab_lityOf
Sh_z_lle,
AppendixF tOthe P_s Hemi;dCommi_t_i_nRe_nR
J_.t_e g_'e _hullle Ch_dhlnoerAcckta_. 1_1_6.
7.
WISKERCHEN, M. J. and C. MOLL.AKARIM|, Tr_bli,_
Sitnul=lion Environment_r ,_)ace Sh,.mle Pmeet_ing,
AIIU_ Fligl'_SimulationTechnologyCONemnce, Septem-
(
•
"
Pml_-_
I
_"
'
DIHbH UUIDI rFOgFr1111
....,
_..:::
...- ,,.-;..
.
..
. ,..
,:
.lJ
rckx.Lu,_-0ooouur
_u
: •-.
.:,....,
....... . .....
_... . . LL-y ;-."'
:: ..
..,z.v...,,.,
.,._......
. ....
,
t
I
ii
,
ii _
i¢
I
'i
o
I
_ouewJotJed
"'
_'l!_JOl _a_;e8
'
el_U'
I
'1
_loaqqosm-1pu_ llaUJOO-_d
_P'R P_
' _N 1._.:3_
2_23583007
PAGE. 58
i
, ,
=
FLIGHT CREW
NASA
THERMAL
PROTECTION
SYSTEM
_OPERATtON$
DIRECrORAI"E
TRENDANALYSISSURVEY
I SUBJECT:
Cg/E,i'nAKER
_
NAME: 2. [(Jig
DAre:
[HARCH
t
!
I
CB/B. DUNBAR
=,
<
_.
:.
=l|
IpA,:.e
, 1_
,
j
; It'
I
i
z
t
I
_
1
:.
I
I
I
,
PRACA
f
i
'
I
I
J
;
I
I
i
I
(PROBLEM REPORTING AND CORRECTIVE
ACTION)
I
•
• "
'"
I _ I
"
I
"
- '
'<°"''J°h''°n_e'''c'"'e'
e_A$A,.
'....
. '...
,,_
•
I
'
i
THERHAL
SYSi'EN
..
'"PROTECTION
_,' .
'_,,JccT:'
"
D,,CtOR,rtO"*"T'ONSl.
: )RE0
'SURVEY.
",LYSlS
;'
'
•",
_._.
::'
'"
' /CB/E.SAFER
]_-M,:: .....
.l,.o,,'.':/
Rc,7'.
PRACA DEFINITION
'
I
'
: I,'o,i
.....
.
i
NSTS 08126C, JUNE 19_7; REV. C
_'.I NASA PROGRAM OFFICE IS RESPONSIBLEFOR:
i
C_ PROVIDING NECESSARY RESOURCESTO SUPPORT THE PRACA SYSTEM,
INCLUDING THE PRACA DATA SYSTEM. COMMUNICATION sERVICES. AND
COMPATIBLE HARDWARE AND SOFTWARE.
E. ASSURING THAT THE DEVELOPMENT OF A PRACA DATA SYSTEM WILL PROVIDE
INFORMATION IN A FORMAT WHICH WILL BE SUPPORTIVE OF A TRENDING
SYSTEM TO BE USED BY ALL ELEMENTS AS SPECIFIEDIN TB[).
5.2 JSC & MSFC ELEMENT PROJECT OFFICES ARE RESPONSIBLEFOR:
8. ASSURING THAT ALL REPORTABLE PROBLEMS, INCLUDING IN-FLIGHT ANOMALIES.
ARE IMMEDIATELY REPORTED INTO THE NSTS PRACA DATA SYSTEM, "
D. ASSURING THAT THE INFORMATION WITHIN THE PRACA SYSTEM IS I_1A
FORMAT WHICH IS COMPATIBLE WITH AND SL_PPORTSTRENDING ANALYSIS.
..
L
• ......
. ....
_;
.
. .
_ ,:
.
.. -. " _
... '.
• ,
..:..........
,
..•.j.
'
"
,...'.
".:
" ES "BgbJd
D_£8S£_0_
FLIGHTCREW
i_l,
THFPJ_L PROTECTION
SYSTEM
ICB/E. I]AKER
[CB/B. DUNBAR.
TREND /W_LYSIS SURVEY
Io.,e:
'
' ,
JHARCH2 r IcJ_B
J_hnt_n SpaceCenl_
'
L"
_ NAME:
DIRECTO_RA
TE
OPERATIONS
KSC
ip_e_ :
( IS
,P,R,ACA
.DATA BASE
INCLUDES; ALL PR'S. IPR'S (RECENT)
SOME DR'S
:
J
FOR TP,S.-TILES. T/B'S, FIB, TCS. SOME GAP FILLERS
]
DOESN'T INCLUDE: VEHICLE CONFIGURATIO'N
F/B, GAP FILLER(IF NO PN)' !.
"
.
SiP (PR WRITTEN AGINST ,TILi: ARRAY)
SCREEDMAP
•
I
CAN SORT BY:
,
,
_.
I
CROSS REFER.ENCE
:TO CONFIGURATION CHANGEs (NEW PN'S)
PR#,, PN, SERIAL#, EICN
,
VEHICLE. FLOW, PART NAME. SYSTEM
FAILURE MODE, FAILURE CAUSE
',
LOCATION(PRE FEB 86.- FWD, MID, AFT, LWNG'...)
(POST FEB 86-. MORE
SPECIFICLOCATIONS)
i
L
1
PRE 41-C DATA IS ON TAPES AND IS MORE DIFFICULT.TO ACCESS
SOME SUBJECTIVITY IN DATA AND PROBLE:M DESCRIPTIONS
NON TECHNICAL OPERATOI_SENTER THE DATA
IJ,
NASA
_ "
LyndOnI. )ohhsonSpaceCmntet
' SUBJECT:
,_,..JJ_._ec...:tr.
I
#_:_[Z$__
r_,_._ ,..c_
I
(._
Oi'EI_,ATaONS I
•
--
O,RECTORATE
"
.
THERICqLPROTEC]'I_ SYSTEH
•
'
,
TRENDANALYSISSURVEY
,
'NAME:
.
' ;CB/E,; BAKER
ICB/B, DUNBAR
"
C
,.=,
•
PRACA MALFUNCTION CODES
:=21 070 900 g10 190 •
84_ .
11_-
BOND FAULTY
BROKEN
BURNED OR OVERHEATED
CHIPPED
CRACKED
DELAMINATEO
DETERIORATED
230 -
DIRTY, CONTAMINATED. OR
SATURATED BY FOREIGN MATERIAL
DISCOLORED._TAINED
GAP FILLER DAMAGED
017223 *
224 206247 730246 BOg -
947
020
20_
220
R78
-
TORN
WORN, CHAFED OR FRAYED
VOIDS
WATERPROOFING FAULTY/MISSING
WEATHER DAMAGE
,.
_-
216 ZIS 217 -
GAP FILLER MISSING
GOUGES
INSTALLED/ASSEMBLEDIMPROPERLY
LOOSE
MAINTENANCE INPROPER OR FAULTY
NO DEFECT• COMPONENT REMOVED OR REINSTALLED TO FACILITATE OTHER
MAINTENANCE
ROUGHNESS/WAVINESS
SIZE IMPROPER
S/G OUT OF TOLERANCE
219 -
THERMAL SURFACE CRACKED
"_"
'
I?._T
P_7
r"
PI=J
JrlAC'QCC'Tr'IT_X_.I
UJEJ_{3JJ
klTr1_
"
LI_LJ_I
i
C
I
do_1.Joh,.o_
sp*_o
c._t°,
FLIGHTCREW
NASA
Su|Jl_C¥:
CB/E. BAEER
N/_.MI_;
CB/B. OUNBAR
THERHAL
PROTECTION
SYSTEH
OPERATIONS
TRI:'_IDANALYSIS SUR_/EY '
t
DIRECTORATE
O,Te:
._
•
,
I
P,G£
I
lit
I
IHARC-H
2, IgOR
.C
I/
I[
I i
u
)
n
I
i
I
("
I
TIPS
:,
'
J
i
I
u
I
I
i
,
(TILE INFORMATION
PROCESSING
S'YSTEM)
(
I
i '
t
(.:
I
i
L
NASA
suIJeCT:
I NAIVE:
FLIGHTCREW
OPERATIONS
Joh.Jo.
sp,,c,_
ce,,,c,
<
TREND
ANALYSIS
SURVEY
THERHAL
PROIECf
1ONSYSTEH
DIRECTORATE
• m
tCB/B" DUNBAR
ID*TE:
I CB/E. BAKER
tHARCH 2_
|9_8
PAOE
C
I 19
DATA BASE
INCLUDES:
VEHICLE CONFIGURATION
(TPS RELEVANT)
{i
TILE AND SIP. FIB, SCREED, PVT, BV
DESIGN GAP FILLERS (NEW)
FIB ANOMALIES
(NEW)
S/G ON ORIGINAL
ENGINEERING
CAN SORT BY:
AT THE END OF A FLOW,
OF TILE
MR. SHAVED
BARRIERS
TPS REPAIRS
MULTIPLE
INCLUDES INFORMATION
FOR LAST FLOW
IN TILE OR FIB REMOVAL,
INCLUDE: TCS, THERMAL
MANY
PLUS ON OCCASION
DATA/REQUIREMENTS
PR'S RESULTING
DOESN'T
BUILD
FIELDS
BACK TO STS-4
FLIGHT
DAMAGE
RECORDS ARE REMOVED
FROM
ACTIVE
DATA
4
BASE
ACTIVE
DATA
BASE FOR TILE REMOVAL
EARLIER DATA CAN BE ACCESSED ON
#c'_
£I:#I
¢_r_, q
GOES BACK THREE FLIGHTS
REQUEST
qa4
ZOO£85£_O_:X£9
17
weJ6Od8 NIQO USUN
Ly.c_b_
a.Joh._o_Sp_
_eCenl©_
R
FUG.rCRE.
OPERATION5
',,.,,_'_
• ,* _
THERM}t
PRO,;ECTI
SYSTE,,
]'RENDANALYSISSURVEY
DIRECTORATE
'
'
i :_
":
'
TiP._S
: I'A_'_
I o,T_:
HARC 2
Ig88
I
20 .
I
,
I
DATA
I
|.
FORMATS
MALFL/NCTION CODES
TILE CHARACTERISTICS
2.
1. DENSIF!CATION REQUIREMENT
ENGINEERING REQUIREMENTS
2. FLIGHT DAMAGE ('BR'OKEN'CHIPPED,
"
I
3.
r
. ,
I
I
TILE LOCATION
.:
i
CRA.CKED, GOUG,E)
I
I
t
'
"4.
PART NUMBER REVISIONS
3. ENG NEERING
EVALUAT ON
I
5.
CARRIER PLATES
4. ENGINEERiNG_CHANGE (MCR, EO, SAR)
6.
INSTALLATION DATA (REMOVAL CODES)
S. CHARRED/DAMAGED
7.
BOND VERIFICATION (3)
6. ACCESS
8.
PULSE VELOCITY TEST/SONIC DATA
7,'BOND VERIFICATION FAILURE
9.
SCREEDIHEATSINK
B. GROU}_D DAMAGE (BROKEN, CHIPPED,'
10. TILE STEP/GAP CORNER STEP
FLLLERBAR
'
3
CRACKED, GOUGE}
11. TILE SIP/FOOTPRINT DATA
,
9. LOST IN FLIGHT
.!
_.=o.m,,o..,o.sp,..==.,.,
j
_>_
" FLtGHTCREW
_;-.,_T_
'OPERATIONS
(
[
ENVIRONMENTAL DAMAGE (WIND, HAIL,
M.
LIGHTNING, RAIN)
,,
N/ApPL!CABLE TRANSFER FROM
PALMDALE
B,
•REMOVED IN ERROR
N.
NOT BUILT TO DRAWING
C.
HEAT DAMAGE (MELT)
O.
SONIC FAILURE
O.
SiP DAMAGE/PROBLEMS
P.
MISLOCATED BOND
E.
STEP AND GAP OT (OUT OF TOLERANCE)
O.
TRANSFER DAMAGE (FROM KSC)
F.
TILE EROSION (THRUSTERS)
R.
RI:V PROBLEMS
G.
FLUID CONTAMINATION
H,
LOOSE TILE
T.
SCREED PROBLEMS
I.
TRANSFER SCRAP (FERRY FLIGHT
U.
TILE "A" MOD
INSTALLATION ONLY)
V.
CANNIBALIZATION
1.
LOST DURING FERRY FLIGHT
W.
tMF_ROPERPROCESSING
K.
TRANSFER DAMAGE (FROM PALM.DALE)
X.
GAP FILLER
L. • MI.SCEL't-ANEOUS
I
r---[MARCH 2. 1988
t_P._j
MALFUNCTION
CODES
¢ONT'D
A.
ICB/E.
BAKER
DUNBAR
LCB/B,
THERMAL PROTECTIONSYSTEM
?REND ANALYSIS SURVEY
(SPILLSOR LEAKS) S,
"•,.......
'
SILTC_RELATED
,
,.
.-
. .....,.;!:_!
. ... ,,.:_-.....
,
9S'3gUd
_Z:[T _0, $0 8B_
_00S8S£_0_
i
,=.,.,oh.,..
s'p.,,
c..l=,
FLIGHTCREW '
ICB/E,
BAKER
ICB/B,
DUNBAR ' •'
THERMALI
PROTECTION
SYSTEM
TREND
_I.YSIS SURVEY
DIRECTORATE
,'
'
.TIPS
L
I
II
ACCESS/ DATA / TRENDING
I
I
I ;!2
IMARCH2,,]gfl_l
,
_
I
• "TERMINALS AVAILAELE AT DOWNEY, KSC,,JSC
,I
(-
•
DATA ENTERED BY VERY' KNOWLEDGEABLE
TPS1OPERATORS
I
•
DATABASE
•
WIDESPREAD USE BY TP$'COMMUNITY
NOT "CONTROLLED"
t
• NO FORMAb TRENDING
_
'
• GRAPHICS CAPABILITY IS AVAILABLE
',
I
i
I
J
•
,
t
I
I
d,.%-Ol.,(',
Uli'. i..li
i_l/|
I'l._l_9 ")
Ill'SlY'4
iiiJ*.'t
C1_.%21i._
Itl .'._;'3_
IdO-*'4_|
l.'l,_ *.1 14.I
=_.."
"pkI It."
_el_._
;oq
O I ".'_tt"1_'.,
@_'#O') '_L'
=_/_'*|_I_4
fllln
_(11
ATilP@i
@/l/L4/g•
I'll.I)
1_'14 I IllA_l.
I_FIJP
II
,_l.*'_ll._li'_
nbll
U[N
Flin/._lq
I I I'pt'."
O,)@P_II
|F,.LI4
_l_tll_._
_lc/_','*
ll_.'.4,'l_)
01 "*'*4/A%
r.%_ltl.'lil
I_./l_tl_;tl
I'%l,._t/tll
u_*.i'lll_ II I
i_l I_ @L'_W(llOl
_i
I1| rl lt¢'ll I_lieN*ll I
IUfl
I MII
Illl)
rilll
LIlIP
_lOi.ltli_
I:lll
i I _
tll_RI
IN (IRI
,l_ltPll'rlt
_iGll
iP)I'_II_I
_4
Ll_i"_ _9_'._. - 4.1', ""'*
I_11.'_ ill'|
|1 (l'; I ¢' "
'#1 P| IW% it,l-.
Mill
....
";"
li
Big'
IP"
_'lll_'l{l|
I_'_',,'11
II
_'
i_
II
_
li
_t_l
nil'
141kl
Ii I Ill_IYlll
I¢'1 ' Ol #lo "¢..1
IJillt kit Ill
*.l _
Olll_|_l II
_,_il_'_
_MI*. II
Io/_il.'rl_
1_%_4""L
II t*l'_*'li_
*
ii
II
MI _
i ,,ifg_l
r_*l
¢*_ _.s
9
II
Il
Iql II
lilbLllll_
..
II
"l
II
II
p
14
14
.I
_ll I
Illl_
#11@
tallU,l
I ,'l Ill|
rltltii
tll
II
l|
II
II
II
II
g
_
'*
".
"
_
_i"
_'
li
ti
II
I¢
It
i+
I_
g
iI
N
/_
II
_
14
fi|b
14111
1411_
I
I_lll
Imllll
_ll I
Illl
Ill
NI_
N
W
II
_
9
_
14
I'
_s
II
tl
J_
ll| l
MIll
M11l
,1
......
,;1_t¢,4,_
.irgj_4_
'_l!4_
t,,elOI @
iqljlli_
_lPl@49
_tl@4'/
,._.
_.*A
_14')
,,*_s
O-I'_"
e"-_
ll4
e.
It
.'." pl
• 14
_. T
Z2 •
_.'_' N
@.
,'
pI
I.
g
I4
_
I._p41
fAl [e_d
liii |ill
_4_,.1l
filL*. |"
kit i_l'
NI I%n
..iI=_ i .,r.....
|;elWt_
Ii4:llllil
P.I_._L', I t tltl
_R_ll'_ejl
I;HIP
|||_
_|l114PI.h
F|@41
llllit
"l_
k
N
i_.lll
_.L/_PLI
.'l!l|lill- _ ._._d,
_l
g
g
t_._O
_71i?1_,
_1_104._
:llle_l
!•114_
_4_4_
'_'P4Pw},
I
I ''_
I07
15 '
""."
;*l e,
0l#_
Iw
IP
14
•
I)
is
II
14
_l
ill
N
14
lel r.Ii
lqLIiO.
fkL
L
I
Pe'
.%t
_
i_l
_'
*
_ltt_-*"
_,ll
fi
_,.I II
_ll_lti_lll I)l*'_
_14tlll
ill"
•t_ln..l. _, . ,
I
I
|
_
"
_
lll,_,
i,#l I
il
ltl.i,
n_4
II
_l+,,'l,u,,'_, I_, "
_141_,_w llll|
'l.4_,@v _*',_
El
i|
II
llli4_lll_
ilI_e.'.*
lll_l+tl_
_P4@?.•
_ll4l_};I
II_ill_. i.+'i
_40_4
i_l_
li'*1
_,|
," I'l
@_'l
Ip.-|
L_6
lll4_4
Ilit@_i
@l_
_11
;_0_:
_,',.
@ml_:.,
,
.
,':T._'r
If.
_,",,g7
,"
i*
fill
*_<I
rr_l)
II I
I"
4n&i
I;.
III
"*+i&lllO
1_l;4 _itl
1_(_'1'_4i'
"il "+_J _111
I 1 I"/IP
_I_It_'+'IPll
I ph I "1' 16_
liV.I'le'i
I
I"
I/ill
fl4_l '. I."i I
I%N_ i'lq*
I_,l ' kkJt | *ll
tqll."
iltfi
1,1
|(ill
| yrl I.'F
OIll_'&_lu
li,.._,
.i
I.I. llll • i
"*"_"_*'1 "
6_i)'_*
.$._.+'/l.J._
L"'_,.',_ I
f'q'a'll_/ltl
*'**
• . i
O| lilac I'*.
r_ie*)_ln|
**'l" ll*'tll
..--.. ,**.lli
@4/|_,*11,'
lib_lPPFO
P/@
I I_*l_@l II I i'll
ill_l_ $..i e
ill@i;@_q
tll?ll_,. "l*#
i_t t2,tt
RI "q,!,'g'_
_1"*/$_'lll
11.111el, _I.4
I.'r
l'l
..............
'r41
l lt_,,
I.'
IIIt*w-.'_._.
I }._._-.
FUll
&u,.
*l ,*_. I"_,
'_ t." $'*..I
bl
_gl,
", -'.
".;'"
i .,:
I _ "',
lgl i'41''@A
II "t.'l|
,,''114
l_ '_l'l I ,,.l'
Ill_
, @gl
I*
(_r14 _je:s,,l'_
i.l|.| 1 111tI i_lli,
I, Ill4
i
'.4 'a
|'1" ,_nil
*# _ • I_q_
"q_l_
¢ •
_l,t
1 t_"
_
..._,
0'
tll
"|_
l II
ftll
Ill I'
J,"I_CQCC7r_7-X'_-I
II
,#.o,.
'ill
| I /I._./t_li
nOJ
¢_t I' I_*'N
iiJIl
'"
qn@_l:'_,
,#&t
lal_
,,I'll
,,J.
UJ"2J6OJ.-.I NTflR
H£FIN
_..
,
@£:£1: £0,
co 83._
a
k
,...
L'-
.
'
p
'::.."
."....-:,;,,,
t_
• •.:::..,
_'.
j
,
:"-_
. •
,: . ,
,
.
'_"
_llL,
NASA Ih lohnJc:,nSpaceCtn',.er
•
:
"
:....
_
:
5UII.llCT:
'.."
.--
N:_M_:
CB/B, DUNBA.R
,oPERATIONS
; FLIGHTCREVV
DIRECTORATE
i
, THERI_AI.
TREND
APNALYSISSURVEY
ROTECTION
sYsTEM _
_1
,
i
o,_¢.
"
.
CB/E, BAKER
MAR H 2 IggR
2LI
j
J
f
I
I
,
I
,
PCASS
I
,
t
I
i
(PROGRAM COMPLIANCE ASSURANCE AND STATUS SYSTEM)
I
I