Conservative Engineering and the State of the Art

MSFC’s conservative tradition of rocket development traced back to von Braun’s work with the German Army in World War II and the U. S. Army thereafter. Step-by-step, precise methods characterized von Braun’s approach to rocketry. Each rocket drew upon the designs and experiences of previous rockets. Engineers made small changes in each successive rocket and tested each change to ensure that it did not compromise the design. They consid­ered flights successful even if they ended in explosion as long as they collected sufficient data to determine the explosion’s cause.31 Once designers found the problem, they modified the design and flew it to test the fix. Based on their many years of experience, they believed it virtually impossible to design an engine or a rocket without significant difficulties.

Although MSC and MSFC engineers differed in a number of ways, one similarity was distrust of contractors. Essentially, both MSFC and MSC engi­neers took apart and rebuilt the stages and capsules that contractors delivered to them. Boeing’s contract for the Saturn S-I first stage was a good example. MSFC’s original contract, awarded after a competition in 1962, gave Boeing partial responsibility for stage design and assembly but little responsibility for booster specifications or testing. Later contracts gave Boeing progressively more responsibility, until it was responsible for all aspects of the stage except for mission operations.32

Borrowing and extending practices from the air force and the navy, NASA closely controlled the contractors. NASA used Resident Manager’s Offices to monitor the contractors. NASA realized that on-site surveillance was “some­what sensitive from the point of view of the contractor’’ but persisted because of its belief in face-to-face communication, its distrust of contractor capabili­ties, and its trust in its own capacities. NASA’s infringement on contractor prerogatives included forced renegotiation of contracts and designs. For ex­ample, Lunar Excursion Module (LEM) contract winner Grumman supposed that it would build the design presented in its bid. Instead, NASA engineers redesigned the LEM and the contract.33

NASA Administrator James Webb expanded contractor penetration to penetration of its own field centers. He wanted a separate information chan­nel to check his own organization, and he hired GE for this purpose. The GE Policy Review Board, established in December 1962, was to provide system­wide coordination and integration. Neither MSC personnel nor MSFC per­sonnel wanted headquarters or GE to integrate them, however. As one GE manager later explained, ‘‘Frankly, they didn’t want us. There were two things against us down there [at MSC]. No. 1, it was a Headquarters contract, and it was decreed that the Centers shall use GE for certain things; and [No. 2] they considered us Headquarters spies.’’34 MSC management hampered GE’s attempts to fulfill its integration role, prohibiting “unannounced visits’’ and forbidding GE from taking any significant action unless approved by MSC. Field center resistance was effective, for in July 1963, Apollo’s new Panel Re­view Board abolished GE’s board. Later, after a long briefing to Administrator Webb, Apollo program director Phillips removed systems integration from GE’s contract.35

Headquarters also contracted with American Telephone and Telegraph (AT&T) to provide technical assistance. AT&T created a separate company called Bellcomm to provide headquarters with technical consultants, whom headquarters used to cross-check the field centers in the way that The Aero­space Corporation checked contractors for the air force. Bellcomm ultimately performed exemplary work in trajectory analysis, but field center engineers and managers avoided Bellcomm representatives because they believed them to be headquarters spies. The use of GE and Bellcomm failed to provide NASA executives with the means to control the field centers, because of the unequal power between the government and industry. NASA provided the funds, and industrial contractors were uncomfortable criticizing their source of funding. They knew better than to bite the hand that fed them.36

Perhaps the greatest challenge to NASA and contractor engineers was to make their new vehicles absolutely reliable so that humans could fly in them. Redundancy was one common technique to improve reliability. For example, MSFC engineers designed each Saturn stage with clusters of engines, so that if one failed, the remaining engines could continue the mission. Man-rating the air force’s Atlas and Titan missiles primarily meant adding redundant elec­tronic circuitry and failure detection circuits to the missile. NASA engineers thought of astronauts as redundant design elements that could improve the chances for mission success by taking over spacecraft functions if components failed.37

Ensuring high quality and safety was as much a function of management and organization as engineering design. Because a number of booster and capsule components were single string-meaning that if they failed, there were no separate backups-STG engineers rigorously verified individual components for high quality. In turn, quality depended upon every worker building each component with the finest workmanship.

The manned programs instituted special methods to make factory workers

aware of the importance of high quality. Taking advantage of the projects’ prestige and visibility, Mercury and Gemini managers distinguished NASA components and workers using special symbols. On the Gemini Titan II pro­gram, Martin management gave special worker certifications to top employ­ees, along with orientations, emblems, labels, badges, and even distinctive toolboxes, ‘‘painted Air Force blue and individualized with each worker’s name.’’ Astronauts visited production lines to encourage high standards and workmanship. Based upon Space Technology Laboratories (STL) recommen­dations, the program adopted strict inspections and random part checking for quality control. Tight control over manufacturing contrasted sharply with MSC’s loose internal structure and processes.38

Worker motivation for Apollo was extraordinary, contributing signifi­cantly to the high quality of components that went into the project. Most of the time, this was a major advantage. However, occasionally, it caused prob­lems. For example, at NAA, the wiring harnesses for the command module occasionally disconnected when the pins broke off in the connectors. They ‘‘found one lady out there who had evidently extremely strong hands, and she knew that she was working on the Apollo Program, so when she crimped, she crimped extremely hard, and she could actually crimp hard enough to de­form the tool and squeeze the wires to where they were almost broken. She was just trying to do her job a little better than normal, but actually she was causing us a lot of trouble. For her, they put a spatial stop on the tool so that she couldn’t crimp it any harder.’’39

Mercury and Gemini engineers created a system to track individual parts with manufacturing and test histories — to ensure that only fully documented, flawless parts became flight components. General Dynamics and Martin man­agers designated Mercury and Gemini launch vehicle components as critical, with special tags, paperwork, and procedures. At Martin, vehicle chaperones accompanied each vehicle through manufacturing, moving the vehicle and its paperwork through the factory. Using Martin’s program as a model, the air force and NASA initiated a similar program at Lockheed for the Agena tar­get vehicle. At the Factory Roll-Out Inspection, NASA thoroughly reviewed records for each vehicle component. Mercury engineers started their quality control program late, resulting in many component replacements when the

capsule or its components failed acceptance tests. Learning from this, Gemini managers began their quality control program right at the start.40

Military models were the basis for most of the STG’s few formal processes early in the program. The Source Evaluation Board was one example, as was the Mock-Up Inspection Board, a formal inspection of a full-scale system model. Another was the Development Engineering Inspection, where STG engineers certified the design to be ready for flight. Hardware qualification was another military import, using rigorous environmental tests to stress components. On the Apollo spacecraft, contractors prepared for the Space­craft Assessment Review, Customer Acceptance Readiness Review, and Flight Readiness Review. Contractors submitted written reports, which NASA com­mittees reviewed. Starting on Mercury, NASA also held flight safety reviews for each spacecraft to review modifications, testing, and preparations for launch and operations.41

Engineers at both centers believed in uncovering design problems through extensive tests and analyses. STG Director Gilruth and MSFC Director von Braun both believed that testing led to better understanding and improved designs. MSFC engineers tested engine stability by exploding small bombs in the rocket’s exhaust path to ensure that unexpected flow variations in the en­gine’s hot gases would not create instabilities that could lead to an explosion. STG engineers injected electrical failures into their designs to ensure that they would survive. Following air force ballistic missile practices, they searched for critical weaknesses in the design, making changes when they found them.42

NASA and its contractors tested components to ensure that they could sur­vive launch vehicle vibrations, the thermal and vacuum environment ofspace, and electromagnetic interference between electronic components. They also performed life tests to see how long components would last. Once compo­nents completed component tests and Preinstallation Acceptance Tests, engi­neers and technicians integrated them into a capsule. Contractors then ran Capsule System Tests, which verified that electronic wiring was working and that mechanical devices were functioning properly.43

One item not easily tested was the performance of the environmental and thermal control system of the entire Mercury capsule. Although vacuum chambers existed, none were large enough to test the whole vehicle. In late 1960, STG and McDonnell engineers developed a large vacuum chamber in which they could test the entire capsule’s environmental and thermal controls. This task, known as Project Orbit, found numerous problems, particularly in the reaction control system used to keep the capsule pointed correctly in space.44

To manage the large number of engineering alterations, the STG estab­lished for Mercury a Change Control Group, whose membership fluctuated based on the nature of the problem. Configuration control crept into the pro­gram through the air force’s supply of launchers for NASA. The air force estab­lished configuration control for Gemini’s Titan II in December 1962. Gemini engineers ‘‘froze’’ portions of the spacecraft design as early as March 1962, and Apollo contractors froze elements of their designs by June 1963.45

Despite these efforts, Mercury’s first test flights suffered their share of fail­ures. The first occurred in July 1960 during the first full-scale test of the Mer­cury capsule mounted on an Atlas booster. About one minute after launch, the booster failed as it accelerated through the period of highest aerodynamic pressure, leaving NASA and the air force to search for debris in the Atlantic off Cape Canaveral. The evidence pointed to a structural failure in the interface between the Atlas and the Mercury capsule, based on mechanical differences between the Mercury capsule and the Atlas’s normal complement of nuclear warheads. Engineers had not found this problem in earlier tests because they could not fully simulate the physical dynamics of the vehicle in flight. Fol­lowing the failure, the Mercury-Atlas coordination panel formed a new com­mittee to find and resolve interface problems. The next successful test flight, in February 1961, featured a structure-stiffening ‘‘belly band.’’ Engineers later included vibration and structural resonance characteristics of the combined launch vehicle-payload system in interface designs and documentation.46

Interface problems also dogged a test flight aboard MSFC’s Redstone booster in November 1960. The launcher lifted off the ground about four inches, then settled back onto the pad while the capsule’s escape rocket launched, dragging erroneously opened parachutes. Subsequent investiga­tions traced the failure to a timing problem between the Redstone electronics and the launch complex, caused by the different weight of the Mercury capsule compared to Atlas’s normal payload ofweapons. The weight difference caused a slightly delayed mechanical disconnection time for a shutoff signal to the

Redstone engines, resulting in the firing of the capsule escape system. MSFC engineers quickly fixed the problem, and the next test flight, in December 1960, was a success.47

These failures caused STG engineers to reevaluate their design philosophy. In a report to headquarters, they stated, ‘‘It has become obvious that the com­plexity of the capsule and the booster automatic system is compounded dur­ing the integration of the systems.’’48 Engineers from the STG, the air force, and the contractors investigated the causes of the numerous failures and fran­tically improved the design of the boosters, the capsules, and the interfaces between them. One important way in which NASA and the air force for­malized these relationships and processes was through the development of interface specifications that defined electrical and mechanical connections be­tween the capsule and the launch vehicle, along with vibration and accelera­tion loads.49

Mercury flight failures led to increased attention to Gemini and Apollo interfaces. In June 1963, the air force, NASA, Martin, and McDonnell initi­ated investigations of the structural and electronic interfaces between Titan and the Gemini spacecraft. Gemini managers created the Systems Integration Office in February 1964 to monitor spacecraft weight and interfaces between the spacecraft, the launch vehicle, and the Agena target vehicle with regular coordination meetings known as Interface Control Panels. Interface Specifi­cation and Control Documents recorded the results of these meetings. Engi­neers developed new tests, including electronic-electrical interference tests, joint combined systems tests, flight configuration mode tests, and wet mock simulated launch tests, all of which verified interfaces and launch procedures on the launch pad. Apollo personnel began to work on interface problems in July 1963, when the Panel Review Board standardized Interface Control Docu­ments and made MSFC the Apollo document repository.50

The STG and its successor, MSC, evolved from NACA’s hands-on research culture. Despite massive growth, the STG maintained informal mechanisms for coordination and control. MSFC too held fast to its discipline-based army heritage. Both organizations benefited from military and industrial processes used by their contractors. Because of their prestige and deep pockets, the manned programs commanded attention from everyone, from the top of the management hierarchy to the shop floor workers at contractor facilities.

Both MSC and MSFC were ultraconservative concerning their own de­signs. They emphasized reliability and safety above cost, allowing costs to in­crease. The exemplary flight records of Mercury and Gemini showed that this conservatism could help ensure that technical objectives were achieved. Con­sidering that the air force was then instituting a program to improve Atlas’s reliability to 75%, achieving a perfect flight record was no easy feat.51 However, the field centers’ proclivity to increase costs was a weakness soon exploited by Congress and NASA headquarters to tighten control.