Structural The Space Shuttle—a mostly reusable, human-rated launch vehicle, spacecraft, space habitat, laboratory, re-entry vehicle, and Design aircraft—was an unprecedented structural engineering challenge. The design had to meet several demands, which resulted in innovative

Introduction solutions. The vehicle needed to be highly reliable for environments Gail Chapline that could not be simulated on Earth or fully modeled analytically Orbiter Structural Design for combined mechanical and thermal loads. It had to accommodate Thomas Moser payloads that were not defined or characterized. It needed to be weight Glenn Miller efficient by employing a greater use of advanced composite materials, Shuttle Wing Loads—Testing and Modification Led to Greater Capacity and it had to rely on fracture mechanics for design with acceptable Tom Modlin life requirements. It also had to be certified to meet strength and life Innovative Concept for Jackscrews requirements by innovative methods. During the Space Shuttle Prevented Catastrophic Failures John Fraley Program, many such structural design innovations were developed Richard Ring and extended to vehicle processing from flight to flight. Charles Stevenson Ivan Velez Orbiter Structure Qualification Thomas Moser Glenn Miller Space Shuttle Pogo— NASA Eliminates “Bad Vibrations” Tom Modlin Pressure Vessel Experience Scott Forth Glenn Ecord Willard Castner Nozzle Flexible Bearing— Steering the Reusable Solid Rocket Motor Coy Jordan Fracture Control Technology Innovations— From the Space Shuttle Program to Worldwide Use Joachim Beek Royce Forman Glenn Ecord Willard Castner Gwyn Faile Space Shuttle Main Engine Fracture Control Gregory Swanson Katherine Van Hooser

270 Engineering Innovations Orbiter Structural beyond the state of the art were needed. the ascent wing loads were greater The crew compartment had to be than predicted because of the effect Design placed into the airframe such that the the rocket exhaust plume had on the pressurized volume would effectively aerodynamic pressure distribution. NASA faced several challenges in “float.” And it was impractical to As a result, early flights were flown the structural design of the Orbiter. test the full airframe under combined within limited flight regimes to assure These challenges were greater mechanical and thermal loads. that the structural capability of the than those of any previous aircraft, wings was not exceeded. The wings Thousands of analytical design loads launch vehicle, or spacecraft, and the were later “strengthened” with minor and conditions were proven acceptable Orbiter was all three. Yet, the space changes in the design and weight. with flight data with one exception: agency proceeded with tenacity and confidence, and ultimately reached its goals. In fact, 30 years of successful shuttle flights validated the agency’s Shuttle Wing Loads—Testing and unique and innovative approaches, processes, and decisions regarding Modification Led to Greater Capacity characteristics of design. Orbiter wing loads demonstrated the importance of anchoring the prediction or A few of the more significant challenges NASA faced in Orbiter grounding the analysis with flight data in assuring a successful flight. The right wing structural design included the evolution of Columbia was instrumented with strain gauges for the test flights and was of design loads. The Orbiter structure load-calibrated to verify the in-flight air load distribution. The wing was also was designed to an early set of loads instrumented with pressure gauges; however, the number was limited due to and conditions and certified to a later on-board recorder space limitations. This resulted in the need to obtain additional set. The shuttle achieved first-flight readiness through a series of localized pressure data. structural modifications and operational Space Transportation System (STS)-1 (1981) data indicated higher shear in the aft flight constraints. During the early design phase, computer analyses using spar web than was predicted. NASA conducted analyses to determine the location and complex calculations like finite-element magnitude of forces causing this condition. The results indicated an additional load models and techniques for combined along the outboard wing leading edge (elevon hinge line). Data obtained on STS-2 thermal and mechanical loads were not (1981) through STS-4 (1982) substantiated these results. This caused concern for the possible. Later advances in analytical operational wing limits that were to be imposed after the flight test period. methods, coupled with test data, allowed significant reductions in both The additional load caused higher bending and torsion on the wing structure, scope and cost of Orbiter structural exceeding design limits. The flight limits, in terms of angle of attack and sideslip, certification. The space agency had to would have to be restricted with an attendant reduction in performance. face other challenges. Structural efficiency had to be compromised The recovery plan resulted in modification to the wing leading edge fittings. The major to assure versatile payload attachment impact was to the structure between the upper and lower wing skins, which were and payload bay door operations. Skin buckling had to be avoided to graphite-epoxy. These required angle stiffeners on each flat to increase the buckling assure compatibility with the stress. The weight of the modifications resulted in a loss of performance. The resulting low-strength Thermal Protection flight envelope was slightly larger than the original when accounting for the negative System tiles. Composite materials angle-of-attack region of the flight regime.

Engineering Innovations 271 Payload Access and Structural Attachments—Mid-Fuselage and Payload Bay Doors Typical Payload Attachment Scheme

NASA designed the mid-fuselage of the Orbiter to be “flexible” so as to Primary Fitting accommodate the closing of payload Latch bay doors in space. The design also had Gear Motor to accommodate a wide range of Bridge Pin payload sizes, weights, and number. 3 Payload Sill Longeron The payload bay doors were an integral part of the fuselage structure. The Bridge classical structural design would have Fitting the doors provide strength when the

fuselage encountered loads from Primary bending, twisting, shear, internal Fittings X and Z Loads pressure, and thermal gradients. The Stabilizer doors also had to open in space to Fitting Z Loads provide access to the payload and Main Frame enable the radiators to radiate heat to space. Equally important, the doors had Payload Bay Doors to close prior to re-entry into Earth’s atmosphere to provide aerodynamic shape and thermal protection. Keel Fitting To balance the functional and strength Y Loads requirements, engineers designed the doors to be flexible. The flexibility Sets of moveable attachment fittings on the longerons and frames accommodated and zipper-like closing ensured that multiple payloads. The Monte Carlo analyses of the full spectrum of payload quantities, the doors would close in orbit even if distorted thermally or by changes in sizes, mass properties, and locations determined the mid-fuselage design loads. the gravity environment (from Earth These design loads were enveloped based on a combination of 10 million load cases. gravity to microgravity). If the latches Decoupling the design of the mid-fuselage and payloads enabled a timely design of both. did not fully engage, the doors could not be relied on to provide strength during re-entry for fuselage bending, torsion, and aerodynamic pressure. The mid-fuselage had to accommodate Designing to Minimize Thus, the classical design approach the quantity, size, weight, location, Local Deflections for ascent was not possible for re-entry. stiffness, and limitations of known and The Orbiter skin was covered with more The bulkheads at each end of the unknown payloads. An innovative than 30,000 silica tiles to withstand the payload section and the longerons on design approach needed to provide a heat of re-entry. These tiles had a each side required additional strength. statically determinant attachment system limited capacity to accommodate To reduce weight and thermal distortion, between the payloads and mid-fuselage. structural deflections from thermal engineers designed the doors using This would decouple the bending, gradients. The European supersonic graphite epoxy. This was the largest twisting, and shear loads between the Concorde passenger aircraft (first flown composite structure on any aircraft or two structures, thus enabling engineers in 1969 and in service from 1976 to spacecraft at the time. to design both without knowing the stiffness characteristic of each. 2003) and the SR- 71 US military

272 Engineering Innovations aircraft encountered significant thermal protected the attached silica tile as as at several times during re-entry. gradients during flight. The design well as simplified the design and Engineers generated 120 thermal approach in each was to reduce stresses manufacture of the Orbiter airframe. math models for specific regions of induced by the thermal gradients by the Orbiter. Temperatures were NASA developed these design enabling expansion of selected regions extrapolated and interpolated to nodes criteria so that if the thermal stresses of the structure; e.g., corrugated within these thermal math models. reduced the mechanical stresses, the wing skins for the SR- 71 and “slots” reductions would not be considered in in the Concorde fuselage. After the combined stress calculations. consulting with the designers of both Use of Unique aircraft, NASA concluded that the To determine the thermally induced Advanced Materials Orbiter design should account for stresses, NASA established Even though the Orbiter was a unique thermally induced stresses but resist deterministic temperatures for eight aircraft and spacecraft, NASA selected a large expansions and associated skin initial temperature conditions on the conventional aircraft skin/stringer/frame buckling. This brute-force approach Orbiter at the time of re-entry as well design approach. The space agency also used conventional aircraft material

(i.e., aluminum) for the primary structure, with exceptions in selected Orbiter Thermal Stress Analysis Modeling regions where the use of advanced state-of-the-art composites increased efficiency due to their lower density, minimum thermal expansion, or higher modulus of elasticity. Other exceptions to the highly reliable conventional structures were the graphite-epoxy Orbital Course Grid Element Maneuvering System skins, which Computer-derived Model were part of a honeycomb sandwich structure. These graphite honeycomb structures had a vented core to relieve pressure differentials across the face sheets during flight. They also required a humidity-controlled Upper environment while on the ground Aluminum Skin to prevent moisture buildup in the core. Such a buildup could become a Plate source of steam during the higher temperature regimes of flight. Finally, during the weight-savings program instituted on Discovery, Atlantis, and Endeavour, engineers replaced the aluminum spar webs in the wing with a graphite/epoxy laminate. Lower Plate Aluminum Large doors, located on the bottom of Skin the Orbiter, were made out of beryllium. Rib Cap These doors closed over the External Structural Element with Localized Thermal Math Model Tank umbilical cavity once the vehicle Considerably Fewer Nodes

Engineering Innovations 273 environment generated by ascent heating. The beryllium material Early Trade Studies Showed Cost allowed the doors to be relatively lightweight and very stiff, and to Benefits That Guided Materials Selection perform well at elevated temperatures. The superior thermal performance Titanium offered advantages for the primary structure because of higher temperature allowed the door, which measured capability—315°C vs. 177°C (600°F vs. 350°F). When engineers considered the 25.4 mm (1 in.) in thickness, to fly combined mass of the structure and Thermal Protection System, however, they noted a without internal insulation during less than 10% difference. The titanium design cost was 2.5 times greater. The schedule launch. Since beryllium can be extremely toxic, special procedures risk was also greater. NASA considered other combinations of materials for the primary applied to those working in its vicinity. structure and Thermal Protection System and conducted a unit cost comparison. This study help ed guide the final selectio ns and areas for future d evelop ment. The truss structure that supported the three Space Shuttle Main Engines Orbiter Structure/Thermal Protection System First Unit Cost Comparison was stiff and capable of reacting to over a million pounds of thrust. Weight The 28 members that made up the (kg x 103) (lb x 103) thrust structure were machined from Cost 36 ($M) diffusion-bonded titanium. Titanium Weights 80 32 strips were placed in an inert 60 70 environment and bonded together 27 60 under heat, pressure, and time. This 50 23 fused the titanium strips into a single, 50 hollow, homogeneous mass. To increase 40 the stiffness, engineers bonded layers of boron/epoxy to the outer surface 30 of the titanium beams. The titanium Costs construction was reinforced in select 20 areas with boron/epoxy tubular struts to minimize weight and add stiffness. 10 Overall, the integrated metallic 1 23456789 composite construction reduced the Thermal Protection System Structure Weight of Structure + thrust structure weight by 21%, or Thermal Protection System approximately 409 kg (900 pounds). 1—Aluminum Alloy 7075-T6 Structure, Ablator Thermal Protection System 2—Aluminum Alloy 7075-T6 Structure, Reusable Thermal Protection System LI-1500 (Lockheed-produced tiles) NASA used approximately 168 boron 3—Aluminum Alloy 2024-T81 Structure, Reusable Thermal Protection System LI-1500 aluminum tubes in the mid-fuselage 4—Aluminum Alloy 7075-T6, Reusable Thermal Protection System on Beryllium Panels frames as stabilizing elements. 5—Magnesium Alloy HM21A-T8 Structure, Reusable Thermal Protection System LI-1500 6—Aluminum Alloy 7075-T6, Metallic Inconel® Thermal Protection System Technicians bonded these composite 7—Combination Aluminum and Titanium Alloys Structure, Reusable Thermal tubes to titanium end fittings and saved Protection System LI-1500 approximately 139 kg (305 pounds) 8—Beryllium and Titanium Alloys Structure, Reusable Thermal Protection System LI-1500 9—Titanium Alloy 6Al-4V Structure, Reusable Thermal Protection System LI-1500 over a conventional aluminum tube design. During ground operations, however, composite tubes in high traffic areas were repeatedly damaged was on orbit. These approximately 20 mm (0.8 in.) to avoid contact with and were eventually replaced with an 1.3-m (50-in.) square doors maintained adjacent tiles. They also had the ability aluminum design to increase robustness the out-of-plane deflection to less than to withstand a 260°C (500°F) during vehicle turnaround.

274 Engineering Innovations

Orbiter Structure—Structural Arrangement and Location of Composite Materials

Conventional Aluminum Structure .JE'VTFMBHF Maximum Temperature 177°C (350°F) r
"MVNJOVN
4LJO4USVDUVSF
Protected by Reusable Surface Insulation r
"MVNJOVN
)POFZDPNC
4LJO
1BOFMT
1BZMPBE
#BZ
%PPST Vertical Tail "GU
'VTFMBHF r
#PSPO
"MVNJOVN
5VCFT
r
(SBQIJUF&QPYZ
'PSXBSE
'VTFMBHF
BOE
$SFX
$BCJO r
"MVNJOVN
.BDIJOFE
4LJOT r
"MVNJOVN
4LJO4USVDUVSF
4LJO
1BOFMT r
"MVNJOVN
4LJO4USVDUVSF
r
"MVNJOVN
)POFZDPNC
4IFMM r
(SBQIJUF&QPYZ
3VEEFS
4LJOT r
5JUBOJVN#PSPO
5ISVTU
'SBNF 4USVDUVSF r
(SBQIJUF&QPYZ
"GU
1SPQVMTJPO
4ZTUFN
4LJO
1BOFMT 3FVTBCMF
4VSGBDF
*OTVMBUJPO

8JOH r
"MVNJOVN
4LJO4USVDUVSF
BOE
)POFZDPNC
4LJOT r
"MVNJOVN
8FC
BOE
5SVTT
4QBST r
"MVNJOVN
)POFZDPNC
&MFWPO
4LJOT

#PEZ
'MBQ r
"MVNJOVN
)POFZDPNC
4LJOT

After the initial design of Challenger to the forward fuselage at four and Columbia, NASA initiated a discrete points, thus enabling a weight-savings program for the simpler design (for pressure and follow-on vehicles—Discovery, inertia loads only) and greater thermal Atlantis, and Endeavour. The space isolation. The crew compartment . d agency achieved weight savings through was essentially a pressure vessel and e v r e s

optimization of aluminum structures and the only pressurized compartment e r

s t replaced the aluminum spar webs in the in the Orbiter. To help assure h g i r

l l A

wing with a graphite/epoxy laminate. pressure integrity, the aluminum . l a n

design withstood a large noncritical o i t a n r

crack while maintaining cabin e t n I

“Floating” Crew Compartment l pressure. The “floating” crew l e w k

compartment reduced weight over c The crew compartment structure o R

“floated” inside the forward fuselage. an integrated forward fuselage © The crew compartment was attached design and simplified manufacturing. The crew cabin being installed in the forward fuselage.

Engineering Innovations 275 Orbiter Structure Innovative Concept for Jackscrews Qualification

Prevented Catastrophic Failures The conventional strength and life certification approach for a commercial or military aircraft is to demonstrate the ultimate strength and fatigue (life) capacities with a dedicated airframe for each. Similarly, NASA planned two full-scale test articles at the outset of the Orbiter design, development, test, and evaluation program. Ultimately, the Orbiter structure was certified with an airframe that became a flight vehicle and a series of smaller component test articles that comprised about 30% of the flight hardware. The space agency did not take additional risks, and the program costs for ground tests were reduced by several hundred million dollars.

Ultimate Strength Integrity Follower Nut Primary Nut Virtually all of the Orbiter’s primary structure had significant thermal stress More than 4,000 jackscrews were in use around Kennedy Space Center (KSC) during components. Therefore, thermal stress the Space Shuttle era. NASA used some of these jackscrews on critical hardware. had to be accounted for when certifying Thus, a fail-safe, continue-to-operate design was needed to mitigate the possibility of the design for ultimate strength. Yet, it was impractical—if not impossible—to a catastrophic event in case of failure. simulate the correct combination of A conventional jackscrew contained only one nut made of a material softer than that temperatures and mechanical loads for of the threaded shaft. With prolonged use, the threads in the nut would wear away. the numerous conditions associated If not inspected and replaced after excessive wear, the nut eventually failed. KSC’s with ascent, spaceflight, and re-entry fail-safe concept for machine jackscrews incorporated a redundant follower nut that into Earth’s atmosphere, especially for would begin to bear the axial jack load on the failure of the primary nut. transient cases of interest. NASA reached this conclusion after consulting Unlike the case of a conventional jackscrew, it was not necessary to relieve the load with the Concorde aircraft structural to measure axial play or disassemble the nut from the threaded shaft to inspect the experts who conducted multiyear, nut for wear. Instead, wear could be determined by measuring the axial gap between expensive combined environment tests. the primary nut and the follower nut. Orbiter strength integrity would be Additionally, electronic and mechanical wear indicators were used to monitor the certified in a bold and unconventional gap during operation or assist during inspection. These devices would be designed to approach that used the Challenger (Orbiter) as the structural test article. generate a warning when the thread was worn to a predetermined thickness. Rather than testing the ultimate load The fail-safe, continue-to-operate design concept offered an alternative for preventing (140% of maximum expected load s), catastrophic failures in jackscrews, which were used widely in aeronautical, NASA would test to 120% of limit aerospace, and industrial applications.

276 Engineering Innovations mechanical load, use the test data to conditions as point loads on the vehicle. consisted of a matrix of 30 test cases verify the analytical stress models, and These unit load cases exercised the representative of critical phases analytically prove that the structure structure at the main engine gimbal and (boost, re-entry, terminal area energy could withstand 140% of the combined actuator attachments, payload fittings, management, and landing) to simulate mechanical and thermal stresses. and interfaces on the wing, tail, body design mechanical loads plus six thrust flap, and Orbital Maneuvering System vector-only conditions. These tests The structural test article was mounted pods. Engineers measured load vs. strain verified analytically predicted internal in a horizontal position at the External at numerous locations and then used Tank reaction points and subjected to a load distributions. In conjunction with those measurements for math model ground test program at the Lockheed analysis, the tests also confirmed the correlation. They also used deflection test facility in Palmdale, California. The structural integrity of the Orbiter measurements to substantiate analytical 390,900-kg (430-ton) test rig contained airframe for critical design limit loads. stiffness matrices. 256 hydraulic jacks that distributed Engineers used these data to support loads across 836 application points to The Orbiter airframe was subjected to a evaluation of the ultimate factor of simulate various stress levels. Initial series of static test conditions carried to safety by analysis. Finally, they used the influence coefficient tests involved the limit plus load levels (approximately test series to evaluate strains from the application of approximately 150 load 120% of limit). These conditions developmental flight instrumentation.

Space Shuttle Pogo—NASA Eliminates “BadP Vi brations” Launch vehicles powered by liquid-fueled, thrust oscillation. This sequence can lead to Vibration pump-fed rocket engines frequently Pogo instability, with the possible result in causes uid oscillation in the experience a dynamic instability that an unprogrammed engine shutdown and/or External Tank. caused structural vibrations along the structural failure—both of which would

vehicle’s longitudinal axis. These vibrations result in loss of mission. Fuel line uid gains are referred to as “Pogo.” the oscillation. Most NASA launch vehicles experienced As Astronaut Michael Collins stated, “The Pogo problems. Unfortunately, the problem first stage of Titan II vibrated longitudinally manifested itself in flight and resulted in so that someone riding on it would be additional testing and analytical work late in The bounced up and down as if on a pogo stick.” the development program. The solution was accumulator dampens to put an accumulator in the propellant the oscillation In technical terms, Pogo is a coupled before the feedline to reduce propellant oscillations. uid reaches structure/propulsion system instability the engines. caused by oscillations in the propellant flow The Space Shuttle Program took a proactive rate that feeds the engines. The propellant approach with a “Pogo Prevention Plan” flow rate oscillations can result in drafted in the early 1970s. The plan called oscillations in engine thrust. If a frequency for comprehensive stability analysis and band of the thrust oscillations is in phase testing programs. Testing consisted of with the natural frequency of engine modal tests to verify the structural dynamic structure and is of sufficient magnitude to characteristics, hydroelastic tests of External a feature. The space agency selected and overcome structural damping, the Tank and propellant lines, and pulse testing included an accumulator in the design amplitude of the propellant flow rate of the Space Shuttle Main Engines. The plan of the main engines. This approach proved oscillation will increase. Subsequently, this baselined a Pogo suppression system— successful. Flight data demonstrated that event will increase the amplitude of the the first NASA launch vehicle to have such the Space Shuttle was free of Pogo.

Engineering Innovations 277 Acoustic Fatigue Integrity Commercial and military aircraft commonly have a design life of 20,000 hours of flight composed of thousands of take offs and landings. As a result, the fatigue life is a design factor. The Orbiter, on the other hand, had a design life of 100 missions and a few hundred hours of flight in the atmosphere, but the acoustic environment during ascent was very high. Certification of acoustic fatigue life had to be accomplished. The challenge was to certify this large, complex structure for a substantial number of combined Test rig surrounds the Orbiter structural test article, Challenger, at the Lockheed Test Facility in acoustic, mechanical, and thermal Palmdale, California. conditions. No existing test facilities could accommodate a test article After the limit plus tests, the forward to fatigue testing and analysis to verify the size of the Orbiter or simulate all fuselage of the structural test article the 100-mission life requirement. of the loads and environments. was subjected to a thermal environment Finally, NASA tested all components gradient test. This testing entailed to ultimate load and gathered data to The acoustic fatigue certification selective heating of the external skin compare predictions. program was as innovative as that of regions with 25 zones. Gaseous the ultimate strength certification. The This unprecedented approach was nitrogen provided cooling. NASA approach was to test a representative challenged by NASA Headquarters used the data to assess the effects of structure of various forms, materials, and reviewed by an outside committee thermal gradients and assist in the and types of construction in of experts from the “wide body” certification of thermal stresses by representative acoustic environments commercial aircraft industry. The analysis techniques. Finally, the aft until the structure failed. This experts concurred with the approach. fuselage of the structural test article O was subjected to internal/external pressures to provide strain and deflection data to verify the structural Orbiter Acoustic Fatigue Test Articles adequacy of the aft bulkhead and engine heat shield structures. These acoustic fatigue test articles The structural test article subjected (shaded in blue) are representative of the Orbiter airframe to approximately structure and environment. 120% of limit load. To address ultimate load (1 40%) in critical areas, NASA conducted a series of supplemental tests on two major interfaces and Wing Shadow Wing Carry 34 component specimens. The agency ((internal)internal) ThroughThrough Rib ForwardForward Fuselage (internal)(internal) chose these specimens based on (under body) criticality of failure, uncertainty in analysis, and minimum fatigue margin. Designated specimens were subjected

278 Engineering Innovations Nozzle Flexible FlexFlex Bearing Bearing—Steering the Reusable Solid Rocket Motor Propellant

At Space Shuttle liftoff, initial steering was ActuatorActuator Aft controlled in large part by the reusable Skirt solid rocket motors’ movable nozzles. Large hydraulic actuators were attached to

each nozzle. On command, these actuators Thrust Vector mechanically vectored the nozzle, thereby Control Pivots the Nozzle redirecting the supersonic flow of hot gases from the motor.

A flexible bearing allowed the nozzle to be During the first minutes of flight, a Thrust Vector Control System housed at the base of each vectored. At about 2.5 m (8 ft) in diameter solid rocket motor provided a majority of the steering capability for the shuttle. A flexible and 3,200 kg (7,000 pounds), this bearing bearing enabled nozzle movement. Two hydraulic actuators generated the mechanical force was the largest flexible bearing in needed to move the nozzle. existence. The component had to vector up allowing the nozzle to pivot in any Fabrication involved laying up the natural to 8 degrees while maintaining a direction. Forces from the actuators rubber by hand between the spherically pressure-tight seal against the combustive induced a torque load on the bearing that shaped shims. Vulcanization was gases within the rocket, withstand high strained the rubber layers in shear, with accomplished by applying pressure while loads imparted at splashdown, and fit each layer rotating a proportional part of controlling an elevated temperature within the constraints of the solid rocket the total vector angle. This resulted in a gradient through the flexible bearing core. motor case segments. It also had to be change in nozzle angular direction relative This process cured the rubber and reusable up to nine times. to the rocket motor centerline. vulcanized it to the shims in one step. The structure consisted of alternating The completed bearing underwent The most significant manufacturing layers of natural rubber (for flexibility) and rigorous stretching and vectoring tests, challenge was producing a vulcanization steel shims (for strength and stiffness). including testing after each flight, as part bond between the rubber and the shims. The layers were spherically shaped, of the refurbishment process. established the level of damage that Because of the high fatigue Summary would be allowed for each type of durability of the graphite-epoxy structure. NASA selected 14 areas construction of the payload bay doors The unique approaches taken during of the Orbiter to represent the various and Orbital Maneuvering System the Space Shuttle Program in validating structural configurations. pods, these structures were not the structural integrity of the Orbiter tested to failure. Instead, the strains airframe set a precedent in the NASA The allowable damage was reduced measured during the acoustic tests programs that followed. Even as more analytically to account for the were correlated with mathematical accurate analysis software and faster damage induced by the flight loads models and adequate fatigue life was computers are developed, the need for and temperature cycles for all regions demonstrated analytically. These test anchoring predictions in the reality of of the vehicle. articles were subsequently used as testing remains a cornerstone in the safe flight hardware. flight of all space vehicles.

Engineering Innovations 279 Pressure Vessel pressure vessel for high-pressure that the composite could fail when oxygen, nitrogen, and helium storage. under a sustained stress, less than its Experience The metallic liners were made of ultimate capability, and could fail titanium (Inconel ® for the oxygen without indication. This failure mode In the 1970s, NASA made an important systems) overwrapped with DuPont ™ of the composite was called “stress decision—one based on previous Kevlar ® in an epoxy matrix. Switching rupture” and could lead to a catastrophic experience and emerging technology— from solid titanium tanks to composite burst of the pressure vessel since the that would result in significant weight overwrapped pressure vessels reduced metallic liner could not carry the savings for shuttle. The agency the Space Shuttle tank mass by pressure stress alone. implemented the Composite approximately 209 kg (460 pounds). In the late 1970s, engineers observed Overwrapped Pressure Vessels Program Since the shuttle was reusable and unexpectedly poor stress rupture over the use of all-metal designs for composite overwrapped pressure vessels performance in the testing of Kevlar ® storing high-pressure gases, 2,068 – were a new technology, the baseline strands at the Lawrence Livermore 3,36 1 N/cm 2 (3,000 – 4,875 psi) factor of safety was 2.0. As development Nationale Laboratory in Livermore, oxygen, nitrogen, and helium. The progressed, NASA introduced and California. As a result, NASA agency used 22 such vessels in the instituted a formal fracture control plan contracted with that laboratory to study Environmental Control and Life Support based on lessons learned in the Apollo the failure modes of the Kevlar ® fiber System, Reaction Control System, Program. As the composite overwrapped for application in the shuttle tanks. Main Propulsion System, and Orbital pressure vessels were fracture-critical Technicians conducted hundreds of tests Maneuvering System. The basic new items—e.g., their failure would lead to on individual Kevlar ® fibers, fiber/epoxy design consisted of a gas or liquid loss of vehicle and crew—fracture strands, and subscale vessels. impermeable, thin-walled metal liner control required extensive lifetime wrapped with a composite overwrap for The development program to testing of the vessels to quantify all primary pressure containment strength. characterize all the failure modes of failure modes. The failure mechanisms the composite overwrapped pressure of the composite were just beginning to vessels set the standard for all Safety—Always a Factor be understood. Kevlar ® is very durable, spaceflight programs. Therefore, as so minor damage to the overwrap was The Space Shuttle Program built on tank development proceeded, NASA not critical. NASA, however, discovered the lessons learned from the Apollo used the fracture control test program to Program. The pressure vessels were constructed of titanium and designed such that the burst pressure was only 1.5 times the operating pressure Composite Overwrapped Pressure Vessels (safety factor). This safety factor was unprecedented at the time. To assure Orbital the safety of tanks with such a low Maneuvering System Pod margin of safety, NASA developed Two 101.6 cm (40 in.) Aft Reaction Helium Control System a robust qualification and acceptance Four 48.3 cm (19 in.) Main Propulsion Helium program. The technical knowledge Environmental System Control and Life Seven 66 cm (26 in.) gained during the Apollo Program Support System Helium Six 66 cm (26 in.) Three 101.6 cm (40 in.) was leveraged by the shuttle, with the Nitrogen Helium added introduction of a new type of Forward Reaction Control System pressure vessel to further reduce mass. Two 48.3 cm (19 in.) Helium The Brunswick Corporation, Lake Forest, Illinois, developed, for the shuttle, a composite overwrapped

280 Engineering Innovations NASA Puts Vessels to the “Stress Test”

In 1978, NASA developed and implemented a “fleet leader” test program to provide Orbiter subscale vessel stress rupture data for comparison to existing strand and subscale vessel data. Vessels in the test program were subscale in size and used aluminum liners instead of titanium, yet they were built by the same company manufacturing the Orbiter composite overwrapped pressure vessels using the same materials, equipment, and processes/procedures. These vessels were put to test at Johnson Space Center in Houston, Texas. chosen as the test temperature for both mission, so the ground tests led the The test program consisted of two groups. Engineers performed periodic fleet by a significant margin. groups of vessels—15 vessels tested at depressurizations/repressurizations to ambient temperature conditions and For the accelerated 79°C (175°F) simulate Orbiter usage and any an approximate stress level of 50% of temperature testing, the first failure potential effects. ultimate strength; and 10 vessels occurred after approximately 12 years tested at approximately 50% of average The ambient temperature vessels were and the second at 15 years of pressure. strength and an elevated temperature pressurized for nearly 25 years without These stress rupture failures indicated in an attempt to accelerate stress failure before NASA stopped testing. that the original stress rupture life rupture failure. For the elevated The flight vessels only accumulated a predictions for composite overwrapped temperature testing, 79°C (175°F) was week or two worth of pressure per pressure vessels were conservative.

justify a safe reduction in the factor of pressure vessel, two titanium Space Transportation System (STS)-43. safety on burst from 2.0 to 1.5, resulting hemispheres had to be welded together NASA removed these vessels from in an additional 546 kg (1 ,203 pounds) to form the liner. Welding titanium is the Orbiter. of mass saved from the Orbiter. difficult and unintentional voids are The subsequent failure investigation sometimes created. Voids in the welds Even with all of the development found that, during manufacture, 89 of two Main Propulsion System testing, two non-stress rupture pores formed in the weld whereas the vessels had been missed during the composite overwrapped pressure typical number for other Orbiter vessels acceptance inspection. In May 1991 , vessels failures occurred on shuttle. was 15. Radiographic inspection of the a Main Propulsion System helium The complexity of the welding process welds showed that the pores had pressurization vessel started leaking on certain materials contributed to initiated fatigue cracks that eventually on the Atlantis prior to the launch of these failures. To build a spherical broke through the liner, thereby causing

Engineering Innovations 281 the leak. While this inspection was Fracture Control The application of proof test logic ongoing, the other Main Propulsion required the determination of System vessel on Atlantis started Technology environmental crack growth leaking helium—once again due to Innovations— thresholds for all environments to weld porosity. NASA reviewed all other which the pressure vessels were vessels in service, but none had weld From the Space exposed while pressurized as well as porosity levels comparable to the two Shuttle Program to development of fracture toughness vessels that had leaked. Worldwide Use values and cyclic crack growth rates for materials used in the pressure vessels. The thresholds resulted in Space Shuttle Experiences A fundamental assumption in structural Influence Future Endeavors pressurization restrictions and engineering is that all components have environmental control of all Apollo small flaws or crack-like defects that NASA’s Orbiter Project pushed the pressure vessels. In effect, proof test are introduced during manufacturing technology envelope for pressure logic formed the first implementation or service. Growth of such cracks vessel design. Lessons learned from of a rigorous fracture control during service can lead to reduced development, qualification, and program in NASA. service life and even catastrophic in-service failures prompted the structural failure. Fracture control International Space Station (ISS) and methodology and fracture mechanics Fracture Control Comes of Age future space and science missions to tools are important means for develop more robust requirements and The legacy of the Apollo pressure preventing or mitigating the adverse verification programs. The ISS Program vessel failure experience was that effects of such cracks. This is important instituted structure controls based on the NASA, through the Space Shuttle for industries where structural integrity shuttle investigation of pressure vessels. Program, became an industry leader is of paramount importance. No other leaks in pressure vessel tanks in the development and application occurred through 2 01 0—STS- 132. For Prior to the Space Shuttle, NASA of fracture mechanics technology instance, the factor of safety on burst did not develop or implement many and fracture control methodology. pressure was 1.5; damage tolerance of fracture mechanics and fracture control Although proof test logic worked the composite and metallic liner was applications during the design and successfully for the Apollo pressure clearly addressed through qualification build phases of space vehicles. The vessels, the Space Shuttle Program testing and operational damage control prevailing design philosophy at the brought with it a wide variety of plans; radiographic inspection of liner time was that safety factors on static safety-critical, structurally complex welds was mandatory with acceptable strength provided a margin against components (not just pressure levels of porosity defined; and material fracture and that simple proof tests of vessels), materials with a wide range controls were in place to mitigate tanks (pressure vessels) were sufficient of fracture properties, and an failure from corrosion, propellant spills, to demonstrate the margin of safety. aircraft-like fatigue environment— and stress rupture. These industry In practice, however, the Apollo all conditions for which proof test standard design requirements for Program experienced a number of logic methodology could not be used composite overwrapped pressure premature test failures of pressure for flaw screening purposes. The vessels are directly attributable to the vessels that resulted in NASA shuttle’s reusable structure demanded shuttle experience as well as its positive implementing a version of fracture a more comprehensive fracture influence on future spaceflight. control referred to as “pro of test logi c.” control methodology. In 1973, the It was not until the early 1960s that Orbiter Project released its fracture proof tests were sufficiently understood control plan that set the requirements from a fracture mechanics point of for and helped guide the Orbiter view—that proof tests could actually be hardware through the design and build used, in some cases, to ensure the phases of the project. absence of initial flaws of a size that could cause failure within a pressure vessel’s operating conditions.

282 Engineering Innovations n Refining the loading based on actual measurements from the full-scale How NASA Determined What Parts Required Attention structural test articles In addition to being a fundamental part Complete normal of the structural design process, fracture static and fatigue analyses mechanics became a useful tool in failure analysis throughout the Space Shuttle Program.

Is the Will loss part a Noof the part No pressure cause loss of the Fracture Control Evolves vessel? vehicle? with Payloads

Yes Yes Yes fewer fewer The shuttle payload community further than 4 than 4 refined the Orbiter fracture control service Analyze using service Analyze using Fracture lives limits of special lives limits of standard requirements to ensure that a structural Control Board: nondestructive nondestructive redesign? evaluation evaluation failure in a payload would not more than more than compromise the Space Shuttle or its No 4 service lives 4 service lives Orbiter. NASA classified payloads by the nature of their safety criticality. Fracture Control Fracture-critical Standard part process Board: apply part, identify and inspect using Typically, a standard fracture criticality disposition options and control standard methods classification process started by removing all exempt parts that were nonstructural items—i.e., items not Early Shuttle Fracture Control required knowledge of the applied stress, susceptible to crack propagation such as load spectrum, environment, assumed Fracture control, as practiced early in insulation blankets or certain common initial crack size, materials fracture the Space Shuttle Program, was a small parts with well-developed quality- toughness, and materials fatigue and three-step process: select the candidate control programs and use history. environmental crack growth properties. fracture critical components, perform Fracture analysis was required to show All remaining parts were then assessed fracture mechanics analyses of the a service life of four times the shuttle’s as to whether they could be classified candidates, and disposition the 100-mission design life. as non-fracture critical. This category components that had insufficient life. included the following classifications: There were a number of options for Design and stress engineers selected n dispositioning components that had Low-released mass—parts with the candidate fracture critical insufficient life. These options included a mass low enough that, if released components. The selection was based the following: during a launch or landing, would on whether failure of the component cause no damage to other components from crack propagation could lead n Redesigning the component when weight and cost permitted n Contained—a failed part confined in to a loss of life or vehicle. Certain a container or otherwise restrained components, such as pressure vessels, n Conducting nondestructive inspection from free release were automatically considered with a more sensitive technique n Fail-safe—structurally redundant fracture critical. Performing a fracture where special nondestructive designs where remaining components mechanics analysis of the candidates evaluation procedures allowed a could adequately and safely sustain started with an assumed initial crack smaller assumed crack size the loading that the failed member located in the most unfavorable n Limiting the life of the component would have carried or failure would location in the component. The size of n Considering multiple element not result in a catastrophic event the assumed crack was typically based load paths on the nondestructive inspection that n Low risk—parts with large structural was performed on the component. n Demonstrating life by fracture margins or other conditions making The fracture mechanics analysis mechanics testing of the component crack propagation extremely unlikely

Engineering Innovations 283 n Nonhazardous leak-before-burst— With Space Shuttle Program support, Fatigue Crack Computer Program pressure vessels that did not contain a Johnson Space Center (JSC) initiated a By the early 1980s, JSC engineers hazardous fluid where loss of fluid concerted effort in the mid 1970s to developed a computer program— would not cause a catastrophic create a comprehensive database of NASA/FLAGRO—to provide fracture hazard such as loss of vehicle and materials fracture properties. This data and fracture analysis for crewed crew, and where the critical crack involved testing virtually all metallic and uncrewed spacecraft components. size was much greater than the vessel materials in use in the program for NASA/FLAGRO was the first known wall thickness their fracture toughness, environmental program to contain comprehensive crack growth thresholds, and fatigue NASA processed non-fracture critical libraries of crack case solutions, crack growth rate properties. NASA components under conventional material fracture properties, and manufactured and tested specimens aerospace industry verification and crack propagation models. It provided in the environments that Space Shuttle quality assurance procedures. the means for efficient and accurate components experienced—cryogenic, analysis of fracture problems. All parts that could not be classified room, and elevated temperatures as exempt or non-fracture critical were as well as in vacuum, low- and NASGRO ® Becomes a Worldwide classified as fracture critical. Fracture high-humidity air, and selected gaseous Standard in Fracture Analysis critical components had to have or fluid environments. Simultaneously, their damage tolerance demonstrated a parallel program created a Although NASA/FLAGRO was by testing or by analysis. To assure comprehensive library of analytical essentially a shuttle project, NASA conservative results, such tests or solutions. This involved compiling eventually formed an agencywide analyses assumed that a flaw was the small number of known solutions fracture control methodology panel to located in the most unfavorable from various sources as well as the standardize fracture methods and location and was subjected to the arduous task of deriving new ones requirements across the agency and most unfavorable loads. The size of applicable to shuttle configurations. to guide the development of the assumed flaw was based on the C nondestructive inspections that were e used to inspect the hardware. The tests or analyses had to demonstrate that such Crack Models and Material Properties Required for Fracture Analyses an assumed crack would not propagate to failure within four service lifetimes.

Fracture Control Software Development Few analytical tools were available for fracture mechanics analysis at the FFractureracture mechanics prpretestetest and posttest specimens for start of the Space Shuttle Program. ccharacterizingharacterizing material behaviorbehavior.. The number of available analytical

solutions was limited to a few idealized ı crack and loading configurations, and information on material dependency was scarce. Certainly, computing Crack in a payload mounting plate. power and availability provided no a comparison to what eventually became 2c available to engineers. Improved tools TTypicalypypical NASGRO® analytical model of to effect the expanded application of ı ccrackedracked structurstructuree for prpredictionediction of fatigue t fracture mechanics and fracture control aandnd fracturfracturee behavior,behavior, in which the crack W were deemed necessary for safe drivingdriving forceforce (K) is a function of the applied stressstreessss (ı) and the crack depth (a). .. )ı¥›) ı¥›a operation of the shuttle.

284 Engineering Innovations Space Shuttle Main Space Shuttle Main Engine Engine Fracture Control High-Pressure Oxygen Turbopump

The early Space Shuttle Main Engine (SSME) criteria for selecting fracture critical parts included Inconel ® 718 parts that were exposed to gaseous hydrogen. These specific parts were selected because of their potential for hydrogen embrittlement and increased crack growth caused by such exposure. Other parts such as turbine

disks and blades were included for their potential Turbine Inner Knife Edge Seal to produce shrapnel. Titanium parts were identified as fracture critical because of susceptibility to stress corrosion cracking. Using these early criteria, approximately 59 SSME parts involving some 290 welds were identified as being fracture critical.

By the time the alternate turbopumps were introduced into the shuttle fleet in the mid 1990s, fracture control processes had been well defined. Parts were identified as fracture critical if their failure due to cracking would result in a catastrophic 2,500X2,500X event. The fracture critical parts were inspected for preexisting cracks, a fracture mechanics assessment was performed, and materials traceability, and part-specific life limits were

imposed as necessary. This combination of 40X40X inspection, analysis, and life limits ensured SSME These two photographs show the fracture surface fracture critical parts were flown with confidence. indicative of Stage I crystallographic fatigue growth.

NASA/FLAGRO , renamed NASGRO ®, Summary development of fracture mechanics as for partnership with industry. a tool in fracture control and ultimately While other commercial computer Fracture mechanics is a technical to the development of NASGRO ®— programs existed by the end of the discipline first used in the Apollo the internationally recognized fracture Space Shuttle Program, none had Program, yet it really came of age in mechanics analysis software tool. approached NASGRO ® in its breadth the Space Shuttle Program. Although The shuttle was not only a principal of technical capabilities, the size of there is still much to be learned, NASA benefactor of the development of its fracture solution library, and the made great strides in the intervening fracture control, it was also the principal size of its materials database. In 4 decades of the shuttle era in sponsor of its development. addition to gaining several prestigious understanding the physics of fracture engineering awards, NASGRO ® is and the methodology of fracture control. in use by organizations and companies It was this agency’s need to analyze around the world. shuttle and payload fracture critical structural hardware that led to the

Engineering Innovations 285